diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70227377..9d649048 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -466,15 +466,16 @@ jobs:
           grep -q "needs formatting" /tmp/fmt-check.err
           "$SCUZZ" build examples/kernel
           "$SCUZZ" build examples/kernel 2>&1 | tee /tmp/incr.out
-          grep -q "up-to-date" /tmp/incr.out
+          if grep -q "^ok$" /tmp/incr.out; then echo "fingerprint hit should not rebuild" && exit 1; fi
+          test -x examples/kernel/build/kernel
           # Path-dep invalidation: a change in a dependency source must rebuild the root.
           "$SCUZZ" build --full examples/counter
           "$SCUZZ" build examples/counter 2>&1 | tee /tmp/counter-incr.out
-          grep -q "up-to-date" /tmp/counter-incr.out
+          if grep -q "^ok$" /tmp/counter-incr.out; then echo "fingerprint hit should not rebuild" && exit 1; fi
           cp examples/shared/src/Shared.scuzz /tmp/shared-orig.scuzz
           printf 'def counterTitle(): String =\n  "Counter"\n\ndef countLabel(n: Int): String =\n  s"count = $n!"\n' > examples/shared/src/Shared.scuzz
           "$SCUZZ" build examples/counter 2>&1 | tee /tmp/counter-inval.out
-          if grep -q "up-to-date" /tmp/counter-inval.out; then echo "dependency edit should invalidate fingerprint" && exit 1; fi
+          if ! grep -q "^ok$" /tmp/counter-inval.out; then echo "dependency edit should invalidate fingerprint" && exit 1; fi
           cp /tmp/shared-orig.scuzz examples/shared/src/Shared.scuzz
           "$SCUZZ" build --full examples/counter
 
diff --git a/crates/ffi-skia/Makefile b/crates/ffi-skia/Makefile
index eca6d974..61210871 100644
--- a/crates/ffi-skia/Makefile
+++ b/crates/ffi-skia/Makefile
@@ -1,12 +1,17 @@
 CC ?= clang
+CXX ?= clang++
 CFLAGS ?= -std=c11 -Wall -Wextra -Werror -O2
 ROOT := $(abspath ../..)
 TRIPLE ?= $(shell $(ROOT)/scripts/skia_triple.sh)
 PREBUILT_DIR := $(ROOT)/third_party/skia/prebuilt/$(TRIPLE)
 PREBUILT_LIB := $(PREBUILT_DIR)/libsk_capi.a
+PIN := $(ROOT)/third_party/skia/PIN
+SKIA_BRANCH := $(shell awk -F= '/^skia_branch=/{print substr($$0,13); exit}' "$(PIN)")
+SKIA_HDR_URL := https://skia.googlesource.com/skia/+archive/$(SKIA_BRANCH)/include.tar.gz
 INCLUDES := -Iinclude -Isrc
 SRC := src/sk_sw.c src/png_enc.c src/sk_mono.c
 OBJ := $(SRC:src/%.c=build/%.o)
+SHIM_OBJS := build/sk_capi_skia.o build/sk_capi_skia_bridge.o
 
 .PHONY: all clean test lib lib-skia lib-sk-sw lib-gpu ensure-prebuilt
 
@@ -39,8 +44,10 @@ ensure-prebuilt:
 UNAME_S := $(shell uname -s)
 ifeq ($(UNAME_S),Darwin)
 GPU_LIBS := -framework OpenGL
+SKIA_LIBS := -lc++ -lm -lz -lbz2 -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework Carbon
 else
 GPU_LIBS := -lEGL -lGLESv2
+SKIA_LIBS := -lstdc++ -lm -lz -lbz2
 endif
 
 build/%.o: src/%.c include/sk_capi.h src/png_enc.h src/sk_gpu.h | build
@@ -49,6 +56,24 @@ build/%.o: src/%.c include/sk_capi.h src/png_enc.h src/sk_gpu.h | build
 build/sk_gpu.o: src/sk_gpu.c src/sk_gpu.h | build
 	$(CC) $(CFLAGS) -Wno-deprecated-declarations $(INCLUDES) -c $< -o $@
 
+# Headers that match the pin's Skia branch. Not a vendored tree.
+build/skia-src/.stamp: | build
+	@mkdir -p build/skia-src/include
+	@echo "ffi-skia: fetch $(SKIA_BRANCH) include for shim relink"
+	@curl -fsSL "$(SKIA_HDR_URL)" -o build/skia-include.tar.gz
+	@rm -rf build/skia-src/include
+	@mkdir -p build/skia-src/include
+	@tar -xzf build/skia-include.tar.gz -C build/skia-src/include
+	@test -f build/skia-src/include/core/SkCanvas.h
+	@echo "$(SKIA_BRANCH)" > $@
+
+build/sk_capi_skia.o: src/sk_capi_skia.cpp include/sk_capi.h build/skia-src/.stamp
+	$(CXX) -std=c++17 -O2 -fPIC -c src/sk_capi_skia.cpp -o $@ \
+	  -Ibuild/skia-src -DSK_RELEASE -DSCUZZ_SKIA_EMBEDDED_FONT
+
+build/sk_capi_skia_bridge.o: src/sk_capi_skia_bridge.c include/sk_capi.h | build
+	$(CC) $(CFLAGS) $(INCLUDES) -c $< -o $@
+
 lib-sk-sw: $(OBJ) build/sk_gpu_none.o | build
 	@if [ -f build/libsk_capi.a ] && [ -f build/sk_capi_backend ] && grep -qx sk_sw build/sk_capi_backend; then \
 	  fresh=1; \
@@ -73,35 +98,58 @@ lib-gpu: $(OBJ) build/sk_gpu.o | build
 	ar rcs build/libsk_capi.a $(OBJ) build/sk_gpu.o; \
 	echo gpu > build/sk_capi_backend
 
-lib-skia: build/sk_gpu_skia_stub.o build/sk_mono.o | build
+# Pin supplies Skia objects + font. Replace the shim so the C ABI matches
+# sk_capi.h (save/clip/restore, RGBA peek). Fail if clip symbols are missing.
+lib-skia: build/sk_gpu_skia_stub.o build/sk_mono.o $(SHIM_OBJS) | build
 	@test -f "$(PREBUILT_LIB)"
 	@if [ -f build/libsk_capi.a ] && [ -f build/sk_capi_backend ] && grep -qx skia build/sk_capi_backend \
 	    && [ ! "$(PREBUILT_LIB)" -nt build/libsk_capi.a ] \
 	    && [ ! build/sk_gpu_skia_stub.o -nt build/libsk_capi.a ] \
-	    && [ ! build/sk_mono.o -nt build/libsk_capi.a ]; then \
-	  exit 0; \
+	    && [ ! build/sk_mono.o -nt build/libsk_capi.a ] \
+	    && [ ! build/sk_capi_skia.o -nt build/libsk_capi.a ] \
+	    && [ ! build/sk_capi_skia_bridge.o -nt build/libsk_capi.a ]; then \
+	  if nm build/libsk_capi.a | grep -E ' T _?sk_canvas_clip_rect' >/dev/null && \
+	     nm build/libsk_capi.a | grep -E ' T _?sk_canvas_save' >/dev/null && \
+	     nm build/libsk_capi.a | grep -E ' T _?sk_canvas_restore' >/dev/null; then \
+	    exit 0; \
+	  fi; \
 	fi; \
 	rm -f build/*.a; \
 	cp -f "$(PREBUILT_LIB)" build/libsk_capi.a; \
-	ar rcs build/libsk_capi.a build/sk_gpu_skia_stub.o build/sk_mono.o; \
+	ar d build/libsk_capi.a sk_capi_skia.o sk_capi_skia_bridge.o; \
+	ar rcs build/libsk_capi.a $(SHIM_OBJS) build/sk_gpu_skia_stub.o build/sk_mono.o; \
+	if ! nm build/libsk_capi.a | grep -E ' T _?sk_canvas_clip_rect' >/dev/null; then \
+	  echo "ffi-skia: linked archive lacks sk_canvas_clip_rect" >&2; \
+	  exit 1; \
+	fi; \
+	if ! nm build/libsk_capi.a | grep -E ' T _?sk_canvas_save' >/dev/null; then \
+	  echo "ffi-skia: linked archive lacks sk_canvas_save" >&2; \
+	  exit 1; \
+	fi; \
+	if ! nm build/libsk_capi.a | grep -E ' T _?sk_canvas_restore' >/dev/null; then \
+	  echo "ffi-skia: linked archive lacks sk_canvas_restore" >&2; \
+	  exit 1; \
+	fi; \
 	echo skia > build/sk_capi_backend
 
 build/test_skia: tests/test_skia.c lib
 	@extra=""; \
 	if [ -f build/sk_capi_backend ] && grep -qx skia build/sk_capi_backend; then \
-	  if [ "$$(uname -s)" = Darwin ]; then \
-	    extra="-lc++ -lm -lz -lbz2 -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework Carbon"; \
-	  else \
-	    extra="-lstdc++ -lm -lz -lbz2"; \
-	  fi; \
+	  extra="$(SKIA_LIBS)"; \
 	elif [ -f build/sk_capi_backend ] && grep -qx gpu build/sk_capi_backend; then \
 	  extra="$(GPU_LIBS)"; \
 	fi; \
 	$(CC) $(CFLAGS) $(INCLUDES) tests/test_skia.c -Lbuild -lsk_capi $$extra -lpthread -o $@
 
-# Canvas clip against in-tree sk_sw. The pinned Skia archive does not export save/clip.
-build/test_sk_clip: tests/test_sk_clip.c src/sk_sw.c src/png_enc.c src/sk_gpu_none.c include/sk_capi.h src/png_enc.h | build
-	$(CC) $(CFLAGS) $(INCLUDES) tests/test_sk_clip.c src/sk_sw.c src/png_enc.c src/sk_gpu_none.c -o $@
+# Clip / RGBA / UTF-8 against the archive `lib` actually built.
+build/test_sk_clip: tests/test_sk_clip.c lib
+	@extra=""; \
+	if [ -f build/sk_capi_backend ] && grep -qx skia build/sk_capi_backend; then \
+	  extra="$(SKIA_LIBS)"; \
+	elif [ -f build/sk_capi_backend ] && grep -qx gpu build/sk_capi_backend; then \
+	  extra="$(GPU_LIBS)"; \
+	fi; \
+	$(CC) $(CFLAGS) $(INCLUDES) tests/test_sk_clip.c -Lbuild -lsk_capi $$extra -lpthread -o $@
 
 build/test_sk_gpu: tests/test_sk_gpu.c lib
 	$(CC) $(CFLAGS) $(INCLUDES) tests/test_sk_gpu.c -Lbuild -lsk_capi $(GPU_LIBS) -lpthread -o $@
diff --git a/crates/ffi-skia/README.md b/crates/ffi-skia/README.md
index c660775e..377a7f71 100644
--- a/crates/ffi-skia/README.md
+++ b/crates/ffi-skia/README.md
@@ -3,7 +3,8 @@
 Thin Skia-shaped C ABI (`include/sk_capi.h`) for Headless/Desktop paint.
 
 **Default:** pinned Skia CPU prebuilt through `scripts/fetch_skia.sh` /
-`third_party/skia/PIN` → `build/sk_capi_backend` = `skia`.
+`third_party/skia/PIN` → `build/sk_capi_backend` = `skia`. `make lib` compiles
+the in-tree shim into that archive so the C ABI matches `sk_capi.h`.
 **Opt out:** `SCUZZ_SKIA=sk_sw` builds in-tree `src/sk_sw.c`.
 **GPU presenter:** `SCUZZ_SKIA=gpu` paints with `sk_sw` and presents through
 OpenGL (upload + readback). Missing OpenGL fails with one install line.
diff --git a/crates/ffi-skia/src/png_enc.c b/crates/ffi-skia/src/png_enc.c
index dcd88002..a726da06 100644
--- a/crates/ffi-skia/src/png_enc.c
+++ b/crates/ffi-skia/src/png_enc.c
@@ -1,5 +1,6 @@
 #include "png_enc.h"
 
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -159,8 +160,10 @@ uint8_t *sz_png_encode_rgba(const uint8_t *pixels, int width, int height,
     return NULL;
   if (stride <= 0)
     stride = width * 4;
+  if ((size_t)width > (SIZE_MAX - 1u) / 4u)
+    return NULL;
 
-  filt_len = (size_t)(width * 4 + 1) * (size_t)height;
+  filt_len = ((size_t)width * 4u + 1u) * (size_t)height;
   filt = (uint8_t *)malloc(filt_len);
   if (!filt)
     return NULL;
diff --git a/crates/ffi-skia/src/sk_capi_skia.cpp b/crates/ffi-skia/src/sk_capi_skia.cpp
index aacc85fe..9076758d 100644
--- a/crates/ffi-skia/src/sk_capi_skia.cpp
+++ b/crates/ffi-skia/src/sk_capi_skia.cpp
@@ -68,8 +68,8 @@ extern "C" {
 void *scuzz_skia_surface_make(int width, int height) {
   if (width <= 0 || height <= 0)
     return nullptr;
-  sk_sp<SkSurface> surf =
-      SkSurfaces::Raster(SkImageInfo::MakeN32Premul(width, height));
+  sk_sp<SkSurface> surf = SkSurfaces::Raster(SkImageInfo::Make(
+      width, height, kRGBA_8888_SkColorType, kPremul_SkAlphaType));
   if (!surf)
     return nullptr;
   auto *out = new CapSurface();
@@ -246,6 +246,8 @@ int scuzz_skia_encode_png(const void *surface, uint8_t **out_bytes,
 int scuzz_skia_encode_png_to_file(const void *surface, const char *path) {
   uint8_t *bytes = nullptr;
   size_t len = 0;
+  if (!path)
+    return 0;
   if (!scuzz_skia_encode_png(surface, &bytes, &len))
     return 0;
   SkFILEWStream stream(path);
diff --git a/crates/ffi-skia/src/sk_gpu.c b/crates/ffi-skia/src/sk_gpu.c
index c703a780..1211f1b7 100644
--- a/crates/ffi-skia/src/sk_gpu.c
+++ b/crates/ffi-skia/src/sk_gpu.c
@@ -106,16 +106,36 @@ static int gpu_make_current(void) {
   }
   if (!gpu_init_display())
     return 0;
-  if (!eglChooseConfig(g_dpy, cfg_attr, &cfg, 1, &n) || n < 1)
+  if (!eglChooseConfig(g_dpy, cfg_attr, &cfg, 1, &n) || n < 1) {
+    eglTerminate(g_dpy);
+    g_dpy = EGL_NO_DISPLAY;
     return 0;
+  }
   g_surf = eglCreatePbufferSurface(g_dpy, cfg, pb_attr);
-  if (g_surf == EGL_NO_SURFACE)
+  if (g_surf == EGL_NO_SURFACE) {
+    eglTerminate(g_dpy);
+    g_dpy = EGL_NO_DISPLAY;
     return 0;
+  }
   eglBindAPI(EGL_OPENGL_ES_API);
   g_ctx = eglCreateContext(g_dpy, cfg, EGL_NO_CONTEXT, ctx_attr);
-  if (g_ctx == EGL_NO_CONTEXT)
+  if (g_ctx == EGL_NO_CONTEXT) {
+    eglDestroySurface(g_dpy, g_surf);
+    g_surf = EGL_NO_SURFACE;
+    eglTerminate(g_dpy);
+    g_dpy = EGL_NO_DISPLAY;
+    return 0;
+  }
+  if (eglMakeCurrent(g_dpy, g_surf, g_surf, g_ctx) != EGL_TRUE) {
+    eglDestroyContext(g_dpy, g_ctx);
+    eglDestroySurface(g_dpy, g_surf);
+    g_ctx = EGL_NO_CONTEXT;
+    g_surf = EGL_NO_SURFACE;
+    eglTerminate(g_dpy);
+    g_dpy = EGL_NO_DISPLAY;
     return 0;
-  return eglMakeCurrent(g_dpy, g_surf, g_surf, g_ctx) == EGL_TRUE;
+  }
+  return 1;
 }
 
 #endif
diff --git a/crates/ffi-skia/src/sk_sw.c b/crates/ffi-skia/src/sk_sw.c
index 66325142..97118faa 100644
--- a/crates/ffi-skia/src/sk_sw.c
+++ b/crates/ffi-skia/src/sk_sw.c
@@ -187,8 +187,12 @@ void sk_canvas_draw_rect(SkCanvas *canvas, float x, float y, float w, float h,
 }
 
 void sk_canvas_save(SkCanvas *canvas) {
-  if (!canvas || canvas->save_n >= SK_CLIP_STACK)
+  if (!canvas)
     return;
+  if (canvas->save_n >= SK_CLIP_STACK) {
+    fputs("sk_capi: clip save stack is full\n", stderr);
+    abort();
+  }
   canvas->save_x0[canvas->save_n] = canvas->clip_x0;
   canvas->save_y0[canvas->save_n] = canvas->clip_y0;
   canvas->save_x1[canvas->save_n] = canvas->clip_x1;
@@ -328,12 +332,36 @@ static const uint8_t FONT8[95][8] = {
     {0x6E, 0x3B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
 };
 
+/* Same walk as sk_mono.c: one Unicode code point is one cell. */
+static int sw_utf8_clen(const char *s) {
+  unsigned char c;
+  if (!s || !s[0])
+    return 0;
+  c = (unsigned char)s[0];
+  if (c < 0x80)
+    return 1;
+  if ((c & 0xe0) == 0xc0)
+    return s[1] ? 2 : 1;
+  if ((c & 0xf0) == 0xe0)
+    return (s[1] && s[2]) ? 3 : 1;
+  if ((c & 0xf8) == 0xf0)
+    return (s[1] && s[2] && s[3]) ? 4 : 1;
+  return 1;
+}
+
 float sk_font_measure_string(const char *text, float font_px) {
-  size_t n;
+  const char *p;
+  int n = 0;
   float px = font_px > 0.f ? font_px : 8.f;
   if (!text)
     return 0.f;
-  n = strlen(text);
+  for (p = text; *p;) {
+    int clen = sw_utf8_clen(p);
+    if (clen < 1)
+      clen = 1;
+    p += clen;
+    n++;
+  }
   return (float)n * px;
 }
 
@@ -353,10 +381,13 @@ void sk_canvas_draw_string(SkCanvas *canvas, const char *text, float x, float y,
   if (baseline < 0)
     baseline = 0;
   cx = (int)x;
-  for (p = text; *p; p++) {
+  for (p = text; *p;) {
+    int clen = sw_utf8_clen(p);
     unsigned char ch = (unsigned char)*p;
     const uint8_t *glyph;
     int gy = (int)y - baseline;
+    if (clen < 1)
+      clen = 1;
     if (ch < 32 || ch > 126)
       ch = '?';
     glyph = FONT8[ch - 32];
@@ -384,6 +415,7 @@ void sk_canvas_draw_string(SkCanvas *canvas, const char *text, float x, float y,
       }
     }
     cx += advance;
+    p += clen;
   }
 }
 
@@ -448,7 +480,7 @@ int sk_encode_png_to_file(const SkSurface *surface, const char *path) {
   size_t len = 0;
   FILE *f;
   size_t n;
-  if (!sk_encode_png(surface, &bytes, &len))
+  if (!path || !sk_encode_png(surface, &bytes, &len))
     return 0;
   f = fopen(path, "wb");
   if (!f) {
diff --git a/crates/ffi-skia/tests/test_sk_clip.c b/crates/ffi-skia/tests/test_sk_clip.c
index efca1fba..b387ab25 100644
--- a/crates/ffi-skia/tests/test_sk_clip.c
+++ b/crates/ffi-skia/tests/test_sk_clip.c
@@ -1,5 +1,4 @@
-/* Canvas clip against in-tree sk_sw. The pinned Skia archive does not
- * export save/clip/restore. */
+/* Canvas clip against the archive `make lib` actually built. */
 #include "sk_capi.h"
 
 #include <assert.h>
@@ -25,7 +24,7 @@ int main(void) {
   sk_canvas_restore(canvas);
   px = sk_surface_peek_pixels(surf, &px_len);
   assert(px && px_len == 32 * 32 * 4);
-  /* Inside clip: fill. Outside: clear color. */
+  /* Inside clip: fill. Outside: clear color. Peek is RGBA. */
   assert(px[(10 * 32 + 10) * 4] == 240);
   assert(px[(10 * 32 + 10) * 4 + 1] == 240);
   assert(px[(10 * 32 + 10) * 4 + 2] == 240);
diff --git a/crates/ffi-skia/tests/test_skia.c b/crates/ffi-skia/tests/test_skia.c
index 3c8c5d75..7b30b7d5 100644
--- a/crates/ffi-skia/tests/test_skia.c
+++ b/crates/ffi-skia/tests/test_skia.c
@@ -5,6 +5,18 @@
 #include <stdlib.h>
 #include <string.h>
 
+static int cell_has_ink(const uint8_t *px, int w, int x0, int x1, int y0, int y1) {
+  int x, y;
+  for (y = y0; y < y1; y++) {
+    for (x = x0; x < x1; x++) {
+      const uint8_t *p = px + ((size_t)y * (size_t)w + (size_t)x) * 4;
+      if (p[0] > 40 || p[1] > 40 || p[2] > 40)
+        return 1;
+    }
+  }
+  return 0;
+}
+
 int main(void) {
   SkSurface *surf = sk_surface_make_raster_n32_premul(64, 32);
   SkCanvas *canvas;
@@ -61,6 +73,84 @@ int main(void) {
     assert(saw_light);
   }
 
+  /* Peek is row-major RGBA. Red is byte 0 with no channel remap. */
+  {
+    SkSurface *reds = sk_surface_make_raster_n32_premul(4, 4);
+    SkCanvas *rc;
+    const uint8_t *rp;
+    size_t rn = 0;
+    assert(reds);
+    rc = sk_surface_get_canvas(reds);
+    sk_paint_set_color(paint, sk_color_rgba(255, 0, 0, 255));
+    sk_canvas_draw_rect(rc, 0, 0, 4, 4, paint);
+    rp = sk_surface_peek_pixels(reds, &rn);
+    assert(rp && rn >= 4);
+    assert(rp[0] == 255 && rp[1] < 50 && rp[2] < 50);
+    sk_surface_unref(reds);
+  }
+
+  /* UTF-8: one code point is one cell on sk_sw. Never two cells for "é". */
+  {
+    float e = sk_font_measure_string("e", 8.f);
+    float acute = sk_font_measure_string("é", 8.f);
+    float ee = sk_font_measure_string("ee", 8.f);
+    assert(e > 0.f);
+    assert(acute > 0.f);
+    assert(acute != ee);
+    if (sk_font_measure_string("i", 8.f) == sk_font_measure_string("W", 8.f))
+      assert(acute == e);
+  }
+
+  /* draw_mono("éx"): x stays in cell 1. Cell 2 stays empty. */
+  {
+    SkSurface *mono = sk_surface_make_raster_n32_premul(48, 16);
+    SkCanvas *mc;
+    const uint8_t *mp;
+    size_t mn = 0;
+    int cw;
+    assert(mono);
+    mc = sk_surface_get_canvas(mono);
+    sk_canvas_clear(mc, sk_color_rgba(0, 0, 0, 255));
+    sk_paint_set_color(paint, sk_color_rgba(240, 240, 240, 255));
+    sk_paint_set_text_size(paint, 8.f);
+    sk_canvas_draw_mono_string(mc, "éx", 0, 8, paint);
+    mp = sk_surface_peek_pixels(mono, &mn);
+    assert(mp && mn == 48 * 16 * 4);
+    cw = (int)(sk_font_mono_cell(8.f) + 0.5f);
+    if (cw < 1)
+      cw = 1;
+    assert(cell_has_ink(mp, 48, 0, cw, 0, 16));
+    assert(cell_has_ink(mp, 48, cw, cw * 2, 0, 16));
+    assert(!cell_has_ink(mp, 48, cw * 2, cw * 3, 0, 16));
+    sk_surface_unref(mono);
+  }
+
+  /* save / clip / restore on the archive this test linked. */
+  {
+    SkSurface *clip = sk_surface_make_raster_n32_premul(32, 32);
+    SkCanvas *cc;
+    const uint8_t *cp;
+    size_t cn = 0;
+    assert(clip);
+    cc = sk_surface_get_canvas(clip);
+    sk_canvas_clear(cc, sk_color_rgba(20, 40, 80, 255));
+    sk_canvas_save(cc);
+    sk_canvas_clip_rect(cc, 8, 8, 12, 12);
+    sk_paint_set_color(paint, sk_color_rgba(240, 240, 240, 255));
+    sk_canvas_draw_rect(cc, 0, 0, 32, 32, paint);
+    sk_canvas_restore(cc);
+    cp = sk_surface_peek_pixels(clip, &cn);
+    assert(cp && cn == 32 * 32 * 4);
+    assert(cp[(10 * 32 + 10) * 4] == 240);
+    assert(cp[(10 * 32 + 10) * 4 + 1] == 240);
+    assert(cp[(10 * 32 + 10) * 4 + 2] == 240);
+    assert(cp[0] == 20);
+    assert(cp[1] == 40);
+    assert(cp[2] == 80);
+    assert(cp[(20 * 32 + 20) * 4] == 20);
+    sk_surface_unref(clip);
+  }
+
   assert(sk_encode_png(surf, &png, &png_len));
   assert(png_len > 8);
   assert(png[0] == 137 && png[1] == 80 && png[2] == 78 && png[3] == 71);
diff --git a/crates/runtime/include/scuzz_rt.h b/crates/runtime/include/scuzz_rt.h
index de353abd..265e617b 100644
--- a/crates/runtime/include/scuzz_rt.h
+++ b/crates/runtime/include/scuzz_rt.h
@@ -60,6 +60,8 @@ enum {
 void *sz_rc_alloc(size_t size, uint32_t kind);
 void sz_retain(void *ptr);
 void sz_release(void *ptr);
+/* RC kind of `ptr`. A non-RC pointer is `SZ_RC_KIND_COUNT`. */
+uint32_t sz_rc_kind(const void *ptr);
 /* Live heap through sz_alloc/sz_free (user bytes; excludes size header). */
 void sz_alloc_stats(size_t *live_bytes, size_t *live_count);
 /* Sum of RC counts on live RC blocks. Raw sz_alloc blocks add 0. */
@@ -118,6 +120,7 @@ SzString *sz_string_slice(const SzString *s, int64_t start, int64_t end);
 int sz_string_eq(const SzString *a, const SzString *b);
 int64_t sz_string_char_at(const SzString *s, int64_t index); /* byte as i64; -1 OOB */
 SzString *sz_string_from_int(int64_t n);
+SzString *sz_string_from_bool(int64_t b);
 SzString *sz_string_from_float(double x);
 int64_t sz_string_index_of(const SzString *s, const SzString *needle);
 int64_t sz_string_last_index_of(const SzString *s, const SzString *needle);
@@ -165,9 +168,11 @@ SzString *sz_string_repeat(const SzString *s, int64_t n);
 SzString *sz_string_strip_prefix(const SzString *s, const SzString *prefix);
 /* Drop `suffix` when `s` ends with it. Else copy `s`. */
 SzString *sz_string_strip_suffix(const SzString *s, const SzString *suffix);
-/* Pad on the left to width `n`. `n` <= len, or empty pad, copies `s`. */
+/* Pad on the left to code-point width `n`. Fill cycles complete code points.
+ * `n` <= len, or empty pad, copies `s`. */
 SzString *sz_string_pad_left(const SzString *s, int64_t n, const SzString *pad);
-/* Pad on the right to width `n`. `n` <= len, or empty pad, copies `s`. */
+/* Pad on the right to code-point width `n`. Fill cycles complete code points.
+ * `n` <= len, or empty pad, copies `s`. */
 SzString *sz_string_pad_right(const SzString *s, int64_t n, const SzString *pad);
 /* 1 when `s` is empty or only ASCII space, tab, CR, LF. */
 int64_t sz_string_is_blank(const SzString *s);
@@ -433,7 +438,7 @@ struct SzDeferred {
   int ok;
   void *value;
   SzError *error;
-  void *waiters; /* runtime Fiber* list while get is parked */
+  void *waiters; /* FIFO Fiber* list while get is parked */
 };
 
 SzDeferred *sz_deferred_make(void);
@@ -504,7 +509,7 @@ enum {
   SZ_ST_ZIPIDX = 17,
   SZ_ST_FLATTEN = 18,
   SZ_ST_CHANGES = 19,
-  SZ_ST_REPEATN = 20,
+  SZ_ST_RANGE = 20,
   SZ_ST_FILTERNOT = 21,
   SZ_ST_MAPCONCAT = 22,
   SZ_ST_ZIPWITH = 23,
@@ -515,7 +520,9 @@ enum {
   SZ_ST_DROPRIGHT = 28,
   SZ_ST_FINDLAST = 29,
   SZ_ST_EVALTAP = 30,
-  SZ_ST_INTERLEAVE = 31
+  SZ_ST_INTERLEAVE = 31,
+  SZ_ST_ITERATE = 32,
+  SZ_ST_UNFOLD = 33
 };
 
 struct SzStream {
@@ -539,7 +546,7 @@ SzStream *sz_stream_find(SzStream *inner, SzStreamPred pred, void *env);
 SzIo *sz_stream_exists(SzStream *s, SzStreamPred pred, void *env); /* IO[Bool] */
 SzStream *sz_stream_take(SzStream *inner, int64_t n);
 SzStream *sz_stream_drop(SzStream *inner, int64_t n);
-/* Boxed ints `[from, until)`. Empty when `until` <= `from`. */
+/* Boxed ints `[from, until)`. Empty when `until` <= `from`. Pulls one box. */
 SzStream *sz_stream_range(int64_t from, int64_t until);
 /* Concat `inner` with itself `n` times. `n` <= 0 is empty. */
 SzStream *sz_stream_repeat_n(SzStream *inner, int64_t n);
@@ -566,9 +573,9 @@ SzStream *sz_stream_take_right(SzStream *inner, int64_t n);
 SzStream *sz_stream_drop_right(SzStream *inner, int64_t n);
 SzStream *sz_stream_find_last(SzStream *inner, SzStreamPred pred, void *env);
 SzStream *sz_stream_evaltap(SzStream *inner, SzCont f, void *env);
-/* Emit `z`, then `f(z)`, n times. n <= 0 is empty. */
+/* Emit `z`, then `f(z)`, n times. n <= 0 is empty. Pulls one value. */
 SzStream *sz_stream_iterate(void *z, int64_t n, SzStreamMapFn f, void *env);
-/* `f` returns List of 0 or 1 `(A, Z)` pair. Empty stops. Caps at 65536. */
+/* `f` returns List of 0 or 1 `(A, Z)` pair. Empty stops. Cap 65536 pulled steps. */
 SzStream *sz_stream_unfold(void *z, SzStreamMapFn f, void *env);
 SzIo *sz_stream_head(SzStream *s);  /* IO[A]; fails when empty */
 SzIo *sz_stream_last(SzStream *s);  /* IO[A]; fails when empty */
@@ -727,7 +734,8 @@ SzList *sz_list_distinct_by(SzList *xs, SzListMapFn fn, void *env,
  * pair is skipped. Empty is empty. Key kind is boxed Int or String. */
 SzMap *sz_list_to_map(SzList *pairs);
 /* Set from `List[Int]` or `List[String]`. Duplicate cells collapse.
- * Empty is empty. `key_kind` is 0 for boxed Int, 1 for String. */
+ * Empty is empty. A non-empty list infers kind from the first cell.
+ * `key_kind` is unused then. */
 SzMap *sz_list_to_set(SzList *xs, int32_t key_kind);
 /* Cells of `xs` that are missing from `ys`. Empty `xs` is empty. */
 SzList *sz_list_diff(SzList *xs, SzList *ys);
@@ -760,7 +768,8 @@ int64_t sz_list_segment_length(SzList *xs, SzListPred pred, void *env, int64_t f
 int64_t sz_list_is_defined_at(SzList *xs, int64_t index);
 /* Negative when len < n, 0 when equal, positive when len > n. */
 int64_t sz_list_length_compare(SzList *xs, int64_t n);
-/* `as_int` 1 orders boxed Int, else String. `want_max` 1 is max. Empty max panics. */
+/* Kind comes from the first non-null head (boxed Int or String).
+ * `as_int` is unused. Empty max panics. */
 SzList *sz_list_sort(SzList *xs, int64_t as_int);
 SzList *sz_list_sort_by(SzList *xs, SzListMapFn fn, void *env);
 void *sz_list_max(SzList *xs, int64_t as_int);
@@ -776,7 +785,8 @@ int64_t sz_list_sum(SzList *xs);
 int64_t sz_list_product(SzList *xs);
 /* Release the spine; heads drop through RC. */
 void sz_list_free(SzList *xs);
-SzString *sz_list_join(const SzList *xs, const char *sep);
+/* Join string cells with `sep`. A null cell is empty. Other heads panic. */
+SzString *sz_list_join(const SzList *xs, const SzString *sep);
 
 /* Persistent Map / Set (NULL = empty). key_kind 0 = boxed i64, 1 = String. */
 struct SzMap {
@@ -787,10 +797,12 @@ struct SzMap {
   int32_t key_kind;
 };
 SzMap *sz_map_empty(void);
+/* Empty insert infers kind from `key`. A non-empty tree keeps
+ * `m->key_kind`. `key_kind` is unused. */
 SzMap *sz_map_set(SzMap *m, void *key, void *val, int32_t key_kind);
 void *sz_map_get_or(SzMap *m, void *key, void *dflt);
-/* 0–1 list of the value. Miss is empty. Cons retains the value. */
-SzList *sz_map_get(SzMap *m, void *key);
+/* Option of the value. A miss is None. A hit is Some, including null. */
+void *sz_map_get(SzMap *m, void *key);
 int64_t sz_map_contains(SzMap *m, void *key);
 /* Drop `key` if present. Missing key retains `m`. */
 SzMap *sz_map_remove(SzMap *m, void *key);
@@ -820,8 +832,9 @@ int64_t sz_map_exists(SzMap *m, SzListPred pred, void *env);
 int64_t sz_map_forall(SzMap *m, SzListPred pred, void *env);
 /* Keep keys that match `pred`. Empty stays empty. */
 SzMap *sz_set_filter(SzMap *s, SzListPred pred, void *env);
-/* Map each key. Mapper returns +1. `key_kind` is 0 for boxed Int, 1 for
- * String. Duplicate keys collapse. Empty stays empty. */
+/* Map each key. Mapper returns +1. Kind comes from the first mapped
+ * key. `key_kind` is unused then. Duplicate keys collapse. Empty stays
+ * empty. */
 SzMap *sz_set_map(SzMap *s, SzListMapFn fn, void *env, int32_t key_kind);
 /* 1 when any key matches `pred`. Empty is 0. */
 int64_t sz_set_exists(SzMap *s, SzListPred pred, void *env);
@@ -898,20 +911,20 @@ SzIo *sz_sys_read_line(void); /* IO[String]: one stdin line; EOF → ""; parks o
 SzIo *sz_sys_read(int64_t n); /* IO[String]: n stdin bytes (or fewer at EOF); parks on poll */
 SzIo *sz_sys_write(SzString *s); /* IO[Unit]: stdout bytes, no newline */
 SzIo *sz_sys_exec(SzString *cmd); /* IO[(Int, String, String)] code+stdout+stderr; parks on poll; fails under TestRuntime */
-SzIo *sz_sys_spawn(SzString *cmd); /* IO[Int] pid; stdin/stdout pipes; fails under TestRuntime */
+SzIo *sz_sys_spawn(SzString *cmd); /* IO[Int] pid; stdin/stdout pipes; stderr inherited; fails under TestRuntime */
 SzIo *sz_sys_child_write(int64_t pid, SzString *s); /* IO[Unit] child stdin; parks on poll */
-SzIo *sz_sys_child_read(int64_t pid, int64_t n); /* IO[String] child stdout bytes; fewer at EOF; parks on poll */
+SzIo *sz_sys_child_read(int64_t pid, int64_t n); /* IO[String] child stdout bytes; fewer at EOF; unknown pid fails; parks on poll */
 SzIo *sz_sys_child_close(int64_t pid); /* IO[Unit] close child stdin */
 SzIo *sz_sys_alive(int64_t pid);   /* IO[Int] 1 if running */
-SzIo *sz_sys_kill(int64_t pid);    /* IO[Unit] SIGTERM; no-op if already gone */
+SzIo *sz_sys_kill(int64_t pid);    /* IO[Unit] SIGTERM; waitpid WNOHANG; slot stays until reaped */
 SzIo *sz_sys_getenv(SzString *key);
 
 /* Blessed Clock / Random / Net (impurity boundary) */
 SzIo *sz_clock_real_time(void);   /* IO[Int] wall epoch ms */
 SzIo *sz_clock_monotonic(void);   /* IO[Int] monotonic ms */
-int64_t sz_clock_monotonic_ms_sync(void); /* sync read for UI pump dt */
+int64_t sz_clock_monotonic_ms_sync(void); /* sync monotonic ms (scheduler, Net, UI); TestRuntime fake clock */
 
-SzIo *sz_random_next_int(int64_t bound); /* IO[Int] in [0, bound) */
+SzIo *sz_random_next_int(int64_t bound); /* IO[Int] in [0, bound); bound <= 0 fails */
 
 SzIo *sz_net_http_get(SzString *url); /* IO[String] body; 2xx; 1 MiB; http:// or https:// */
 SzIo *sz_net_http_post(SzString *url, SzString *body);
@@ -932,10 +945,12 @@ typedef struct SzNetSock {
 SzIo *sz_net_tcp_connect(SzString *host, int64_t port); /* IO[SzNetSock] */
 SzIo *sz_net_tcp_listen(int64_t port);                  /* IO[SzNetSock] */
 SzIo *sz_net_tcp_accept(SzNetSock *listener);           /* IO[SzNetSock] */
-SzIo *sz_net_tcp_read(SzNetSock *conn, int64_t n);      /* IO[String] */
+/* At most n bytes (cap 1 MiB). Short read when no more data is ready. */
+SzIo *sz_net_tcp_read(SzNetSock *conn, int64_t n); /* IO[String] */
 SzIo *sz_net_tcp_write(SzNetSock *conn, SzString *s);   /* IO[Unit] */
 SzIo *sz_net_tcp_close(SzNetSock *sock);                /* IO[Unit] */
-/* Blessed UDP. Bind 0 picks an ephemeral port. Recv is (host, port, data). */
+/* Blessed UDP. Bind is IPv4 localhost. Bind 0 picks an ephemeral port.
+ * Recv is (host, port, data). An IPv6 send host fails. */
 SzIo *sz_net_udp_bind(int64_t port); /* IO[SzNetSock] */
 SzIo *sz_net_udp_send(SzNetSock *sock, SzString *host, int64_t port,
                      SzString *data);
@@ -943,6 +958,8 @@ SzIo *sz_net_udp_recv(SzNetSock *sock, int64_t n); /* IO[(String, Int, String)]
 SzIo *sz_net_udp_close(SzNetSock *sock);
 void sz_net_sock_on_free(SzNetSock *s);
 void sz_testrt_net_sock_gone(SzNetSock *s);
+/* 4 = IPv4, 6 = IPv6, 0 = not a literal. Writes a canonical host when canon is set. */
+int sz_net_host_family(const char *host, char *canon, size_t canon_cap);
 /* Test-only: UDP nameserver for live HTTP DNS. NULL ip restores /etc/resolv.conf. */
 void sz_net_test_set_nameserver(const char *ipv4, int port);
 /* Test-only: Host header value for HTTP (RFC 9110). */
@@ -1048,7 +1065,7 @@ void sz_testrt_stdout_append(const char *line); /* appends line + '\n' */
 void sz_testrt_stdout_write(const char *bytes, size_t n); /* raw; no extra newline */
 const char *sz_testrt_stdout_cstr(void);
 void sz_testrt_env_set(const char *key, const char *val); /* sealed Sys.getenv map */
-const char *sz_testrt_env_get(const char *key); /* NULL if unset */
+const char *sz_testrt_env_get(const char *key); /* NULL if unset. Install copies SCUZZ_SERVE / SCUZZ_KIT */
 void sz_testrt_proc_put(int64_t pid); /* fake Sys.alive table */
 int sz_testrt_proc_alive(int64_t pid); /* 1 if registered */
 void sz_testrt_proc_kill(int64_t pid); /* drop from table */
@@ -1114,6 +1131,9 @@ void sz_property_session_reset(void);
 void sz_timeline_set_drive(const char *line);
 int sz_timeline_replaying(void);
 int64_t sz_timeline_replay_signal_int(const char *name);
+SzString *sz_timeline_replay_signal_str(const char *name);
+int64_t sz_timeline_replay_signal_list_len(const char *name);
+SzString *sz_timeline_replay_signal_list_at(const char *name, int64_t index);
 int64_t sz_timeline_len(void *tl);
 int64_t sz_timeline_signal_int(void *tl, int64_t i, SzString *name);
 int64_t sz_timeline_signal_list_len(void *tl, int64_t i, SzString *name);
diff --git a/crates/runtime/include/scuzz_ui.h b/crates/runtime/include/scuzz_ui.h
index 34cef3ce..675b70b9 100644
--- a/crates/runtime/include/scuzz_ui.h
+++ b/crates/runtime/include/scuzz_ui.h
@@ -126,10 +126,10 @@ void sz_signal_list_set(SzSignalList *s, SzList *v);
 SzList *sz_signal_list_get(const SzSignalList *s);
 void sz_signal_list_free(SzSignalList *s);
 
-/* Signal store dump: one "kind[id] = value" line per live signal, in creation
-   order (fuzz oracle; caller frees SzString). */
+/* Signal store dump: one "kind[id] name = value" line per live signal.
+ * String values use the editor dump escape dialect. Caller frees SzString. */
 SzString *sz_signal_dump(void);
-/* Property observation: signal store by creation-order id (TestRuntime / fuzz). */
+/* Publish the for-binder name. Property and Timeline kits read that name. */
 void sz_signal_name(const void *sig, const char *name);
 
 int64_t sz_property_signal_int(SzString *name);
@@ -677,8 +677,9 @@ int sz_ui_session_set_record(SzUiSession *session, const char *path);
 int sz_ui_session_reload(SzUiSession *session);
 /* dlopen `path` (copied to a unique sibling so the OS does not keep a stale
  * image) and set the rebuild factory from exported `sz_ui_reload_rebuild`.
- * Signals stay in `rebuild_env`. Does not rebuild until reload/stamp.
- * Stamp-watch loads `SCUZZ_UI_RELOAD_CODE` (if set) before rebuild. */
+ * Unlink the copy after dlopen. Signals stay in `rebuild_env`. Does not
+ * rebuild until reload/stamp. Stamp-watch loads `SCUZZ_UI_RELOAD_CODE` (if
+ * set) before rebuild. */
 int sz_ui_session_load_code(SzUiSession *session, const char *path);
 void sz_ui_unmount(SzUiSession *session);
 /* Snapshot PNG / structural dump from SCUZZ_SNAPSHOT_PATH / SCUZZ_FUZZ_DUMP. */
diff --git a/crates/runtime/src/deferred.c b/crates/runtime/src/deferred.c
index e84c1a91..6f3e4876 100644
--- a/crates/runtime/src/deferred.c
+++ b/crates/runtime/src/deferred.c
@@ -64,6 +64,8 @@ void sz_deferred_complete_now(SzDeferred *d, void *value) {
   sz_retain(value);
   d->value = value;
   sz_fiber_wake_deferred(d);
+  if (d->waiters)
+    sz_panic("sz_deferred_complete_now: waiters remain");
 }
 
 void sz_deferred_fail_now(SzDeferred *d, SzError *err) {
@@ -79,6 +81,8 @@ void sz_deferred_fail_now(SzDeferred *d, SzError *err) {
     sz_retain(err);
   d->error = err;
   sz_fiber_wake_deferred(d);
+  if (d->waiters)
+    sz_panic("sz_deferred_fail_now: waiters remain");
 }
 
 static void *deferred_fail_thunk(void *env) {
diff --git a/crates/runtime/src/fs.c b/crates/runtime/src/fs.c
index 4156126b..8a1b2248 100644
--- a/crates/runtime/src/fs.c
+++ b/crates/runtime/src/fs.c
@@ -137,8 +137,7 @@ static void *fs_write_result(void *env) {
   FsResult *r = (FsResult *)rc_box_zero(sizeof(FsResult));
   const char *p = sz_string_cstr(path);
   FILE *f;
-  sz_timeline_log_bytes("Fs.write", contents ? contents->data : "",
-                        contents ? contents->len : 0);
+  sz_timeline_log_cstr("Fs.write", p);
   f = fopen(p, "wb");
   if (!f) {
     char msg[512];
@@ -198,19 +197,26 @@ static SzList *cons_fs_entry(SzList *acc, const char *name, int is_dir) {
   return out;
 }
 
+static int fs_join_into(char *out, size_t out_sz, const char *dir, const char *name) {
+  int n;
+  size_t dlen = strlen(dir);
+  if (dlen == 1 && dir[0] == '/')
+    n = snprintf(out, out_sz, "/%s", name);
+  else if (dlen > 0 && dir[dlen - 1] == '/')
+    n = snprintf(out, out_sz, "%s%s", dir, name);
+  else if (dlen == 0)
+    n = snprintf(out, out_sz, "%s", name);
+  else
+    n = snprintf(out, out_sz, "%s/%s", dir, name);
+  return n >= 0 && (size_t)n < out_sz;
+}
+
 static int fs_name_is_dir(const char *dir, const char *name) {
   char full[2048];
   struct stat st;
-  size_t n = strlen(dir);
-  if (n == 1 && dir[0] == '/')
-    snprintf(full, sizeof full, "/%s", name);
-  else if (n > 0 && dir[n - 1] == '/')
-    snprintf(full, sizeof full, "%s%s", dir, name);
-  else if (n == 0 || (n == 1 && dir[0] == '.'))
-    snprintf(full, sizeof full, "%s", name);
-  else
-    snprintf(full, sizeof full, "%s/%s", dir, name);
-  if (stat(full, &st) != 0)
+  if (!fs_join_into(full, sizeof full, dir, name))
+    return 0;
+  if (lstat(full, &st) != 0)
     return 0;
   return S_ISDIR(st.st_mode) ? 1 : 0;
 }
@@ -220,7 +226,9 @@ static void *fs_list_result(void *env) {
   SzString *path = pack_path(pack);
   FsResult *r = (FsResult *)rc_box_zero(sizeof(FsResult));
   const char *p = sz_string_cstr(path);
-  DIR *d = opendir(p);
+  DIR *d;
+  sz_timeline_log_cstr("Fs.list", p);
+  d = opendir(p);
   if (!d) {
     char msg[512];
     snprintf(msg, sizeof(msg), "Fs.list: cannot open %s: %s", p, strerror(errno));
@@ -282,6 +290,12 @@ static void *fs_mkdirs_result(void *env) {
   const char *p = sz_string_cstr(path);
   char tmp[1024];
   size_t len = strlen(p);
+  sz_timeline_log_cstr("Fs.mkdirs", p);
+  if (len == 0 || strcmp(p, ".") == 0 || strcmp(p, "/") == 0) {
+    r->is_err = 0;
+    r->as.ok = NULL;
+    goto done;
+  }
   if (len >= sizeof(tmp)) {
     r->is_err = 1;
     r->as.err = sz_error_new(2, "Fs.mkdirs: path too long");
@@ -318,7 +332,9 @@ static void *fs_canonicalize_result(void *env) {
   SzString *path = pack_path(pack);
   FsResult *r = (FsResult *)rc_box_zero(sizeof(FsResult));
   const char *p = sz_string_cstr(path);
-  char *resolved = realpath(p, NULL);
+  char *resolved;
+  sz_timeline_log_cstr("Fs.canonicalize", p);
+  resolved = realpath(p, NULL);
   if (!resolved) {
     char msg[512];
     snprintf(msg, sizeof(msg), "Fs.canonicalize: %s: %s", p, strerror(errno));
@@ -350,6 +366,7 @@ static void *fs_exists_result(void *env) {
   FsResult *r = (FsResult *)rc_box_zero(sizeof(FsResult));
   const char *p = sz_string_cstr(path);
   struct stat st;
+  sz_timeline_log_cstr("Fs.exists", p);
   r->is_err = 0;
   r->as.ok = sz_box_i64(stat(p, &st) == 0 ? 1 : 0);
   return r;
@@ -364,22 +381,74 @@ static SzIo *fs_after_exists(void *value, void *env) {
 
 SzIo *sz_fs_exists(SzString *path) { return fs_bind(path, fs_after_exists); }
 
-static int fs_join_into(char *out, size_t out_sz, const char *dir, const char *name) {
-  int n;
-  size_t dlen = strlen(dir);
-  if (dlen == 1 && dir[0] == '/')
-    n = snprintf(out, out_sz, "/%s", name);
-  else if (dlen > 0 && dir[dlen - 1] == '/')
-    n = snprintf(out, out_sz, "%s%s", dir, name);
-  else if (dlen == 0)
-    n = snprintf(out, out_sz, "%s", name);
-  else
-    n = snprintf(out, out_sz, "%s/%s", dir, name);
-  return n >= 0 && (size_t)n < out_sz;
+/* Collapse duplicate slashes, trailing slashes, and "." segments.
+ * Keep ".." segments. Writes a NUL-terminated path into out. */
+static int fs_collapse_dot_slash(const char *p, char *out, size_t out_sz) {
+  size_t i = 0;
+  size_t o = 0;
+  int abs = 0;
+  if (!p)
+    p = "";
+  if (p[0] == '/') {
+    abs = 1;
+    if (out_sz < 2)
+      return 0;
+    out[o++] = '/';
+    while (p[i] == '/')
+      i++;
+  }
+  while (p[i]) {
+    size_t start = i;
+    size_t n;
+    while (p[i] && p[i] != '/')
+      i++;
+    n = i - start;
+    if (n == 1 && p[start] == '.') {
+      /* skip "." */
+    } else if (n > 0) {
+      if (o > 0 && out[o - 1] != '/') {
+        if (o + 1 >= out_sz)
+          return 0;
+        out[o++] = '/';
+      }
+      if (o + n >= out_sz)
+        return 0;
+      memcpy(out + o, p + start, n);
+      o += n;
+    }
+    while (p[i] == '/')
+      i++;
+  }
+  if (o > 1 && out[o - 1] == '/')
+    o--;
+  out[o] = '\0';
+  if (!abs && o == 0) {
+    if (out_sz < 2)
+      return 0;
+    out[0] = '.';
+    out[1] = '\0';
+  }
+  return 1;
+}
+
+static int fs_same_inode(const char *a, const char *b) {
+  struct stat sa;
+  struct stat sb;
+  if (lstat(a, &sa) != 0 || lstat(b, &sb) != 0)
+    return 0;
+  return sa.st_dev == sb.st_dev && sa.st_ino == sb.st_ino;
 }
 
 static int fs_is_root_path(const char *p) {
-  return !p || !p[0] || strcmp(p, ".") == 0 || strcmp(p, "/") == 0;
+  char collapsed[2048];
+  if (!p || !p[0])
+    return 1;
+  if (!fs_collapse_dot_slash(p, collapsed, sizeof collapsed))
+    return 0;
+  if (strcmp(collapsed, ".") == 0 || strcmp(collapsed, "/") == 0 ||
+      strcmp(collapsed, "..") == 0)
+    return 1;
+  return fs_same_inode(p, "/") || fs_same_inode(p, ".");
 }
 
 static int fs_parent_is_dir(const char *path) {
@@ -465,6 +534,7 @@ static void *fs_delete_result(void *env) {
   SzString *path = pack_path(pack);
   FsResult *r = (FsResult *)rc_box_zero(sizeof(FsResult));
   const char *p = sz_string_cstr(path);
+  sz_timeline_log_cstr("Fs.delete", p);
   if (fs_is_root_path(p)) {
     r->is_err = 1;
     r->as.err = sz_error_new(2, "Fs.delete: refused root");
@@ -495,6 +565,7 @@ static void *fs_rename_result(void *env) {
   const char *src = sz_string_cstr(from);
   const char *dst = sz_string_cstr(to);
   struct stat st;
+  sz_timeline_log_cstr("Fs.rename", src);
   if (fs_is_root_path(src) || fs_is_root_path(dst)) {
     r->is_err = 1;
     r->as.err = sz_error_new(2, "Fs.rename: refused root");
@@ -631,6 +702,7 @@ static void *fs_walk_result(void *env) {
   const char *p = sz_string_cstr(path);
   struct stat st;
   SzList *acc;
+  sz_timeline_log_cstr("Fs.walk", p);
   if (stat(p, &st) != 0 || !S_ISDIR(st.st_mode)) {
     char msg[512];
     snprintf(msg, sizeof msg, "Fs.walk: not a directory: %s", p);
diff --git a/crates/runtime/src/impurity.c b/crates/runtime/src/impurity.c
index 5f077d73..5d7e8fcd 100644
--- a/crates/runtime/src/impurity.c
+++ b/crates/runtime/src/impurity.c
@@ -48,10 +48,13 @@ static SzIo *do_read_line(void *value, void *env) {
 
 static SzIo *after_args(void *value, void *env) {
   SzList *xs = (SzList *)value;
+  SzString *sep;
   SzString *joined;
   SzIo *io;
   (void)env;
-  joined = sz_list_join(xs, ",");
+  sep = sz_string_from_cstr(",");
+  joined = sz_list_join(xs, sep);
+  sz_release(sep);
   sz_release(xs);
   io = labeled("args:", joined);
   sz_release(joined);
diff --git a/crates/runtime/src/json.c b/crates/runtime/src/json.c
index e5270441..d2d689bb 100644
--- a/crates/runtime/src/json.c
+++ b/crates/runtime/src/json.c
@@ -54,34 +54,40 @@ static locale_t json_c_locale(void) {
 
 static double json_strtod(const char *s, char **end) {
   locale_t loc = json_c_locale();
+  if (!loc) {
+    if (end)
+      *end = (char *)s;
+    return 0.0;
+  }
 #ifdef __APPLE__
-  if (loc)
-    return strtod_l(s, end, loc);
+  return strtod_l(s, end, loc);
 #else
-  if (loc) {
+  {
     locale_t old = uselocale(loc);
     double x = strtod(s, end);
     uselocale(old);
     return x;
   }
 #endif
-  return strtod(s, end);
 }
 
 static int json_fmt_double(char *tmp, size_t n, double x) {
   locale_t loc = json_c_locale();
+  if (!loc) {
+    if (n)
+      tmp[0] = '\0';
+    return -1;
+  }
 #ifdef __APPLE__
-  if (loc)
-    return snprintf_l(tmp, n, loc, "%.17g", x);
+  return snprintf_l(tmp, n, loc, "%.17g", x);
 #else
-  if (loc) {
+  {
     locale_t old = uselocale(loc);
     int r = snprintf(tmp, n, "%.17g", x);
     uselocale(old);
     return r;
   }
 #endif
-  return snprintf(tmp, n, "%.17g", x);
 }
 
 static void *box_f64(double x) {
@@ -518,6 +524,8 @@ static SzAdt *jp_value(Jp *p) {
 SzAdt *sz_json_parse(SzString *s) {
   Jp p;
   SzAdt *v;
+  if (!json_c_locale())
+    return result_err("C locale");
   if (!s)
     return result_err("Json.parse(null)");
   p.s = sz_string_cstr(s);
@@ -682,6 +690,8 @@ static void jb_value(Jb *b, const SzAdt *j) {
 SzAdt *sz_json_stringify(SzAdt *j) {
   Jb b;
   SzString *s;
+  if (!json_c_locale())
+    return result_err("C locale");
   if (!j)
     return result_err("Json.stringify(null)");
   memset(&b, 0, sizeof b);
diff --git a/crates/runtime/src/list.c b/crates/runtime/src/list.c
index ab4cc791..aa521381 100644
--- a/crates/runtime/src/list.c
+++ b/crates/runtime/src/list.c
@@ -27,6 +27,31 @@ static SzList *sz_list_cons_take(void *head, SzList *tail) {
   return n;
 }
 
+/* First non-null head must be boxed Int or String. Empty or all-null panics. */
+static uint32_t list_elem_kind(SzList *xs, const char *msg) {
+  SzList *p;
+  uint32_t k;
+  for (p = xs; p; p = p->tail) {
+    if (!p->head)
+      continue;
+    k = sz_rc_kind(p->head);
+    if (k == SZ_RC_BOX || k == SZ_RC_STRING)
+      return k;
+    sz_panic(msg);
+  }
+  sz_panic(msg);
+}
+
+static void list_require_kind(const SzList *xs, uint32_t want, const char *msg) {
+  const SzList *p;
+  for (p = xs; p; p = p->tail) {
+    if (!p->head)
+      continue;
+    if (sz_rc_kind(p->head) != want)
+      sz_panic(msg);
+  }
+}
+
 void *sz_list_head(const SzList *xs) {
   if (!xs)
     sz_panic("List.head on empty");
@@ -320,6 +345,7 @@ static SzList *flatten_from_rev(SzList *rev) {
   SzList *out = NULL;
   SzList *p;
   SzList *next;
+  list_require_kind(rev, SZ_RC_LIST, "List.flatten: not List");
   for (p = rev; p; p = p->tail) {
     next = sz_list_concat((SzList *)p->head, out);
     sz_release(out);
@@ -643,6 +669,7 @@ SzPair *sz_list_unzip(SzList *pairs) {
   SzList *arev;
   SzList *brev;
   SzPair *out;
+  list_require_kind(pairs, SZ_RC_PAIR, "List.unzip: not pair");
   for (p = pairs; p; p = p->tail) {
     inner = (SzPair *)p->head;
     if (!inner)
@@ -878,9 +905,10 @@ SzMap *sz_list_to_map(SzList *pairs) {
   SzMap *acc = NULL;
   SzList *p;
   int32_t kind = 1;
+  list_require_kind(pairs, SZ_RC_PAIR, "List.toMap: not pair");
   if (pairs && pairs->head) {
     SzPair *first = (SzPair *)pairs->head;
-    if (first && first->left)
+    if (first->left)
       kind = sz_map_infer_key_kind(first->left);
   }
   for (p = pairs; p; p = p->tail) {
@@ -898,8 +926,11 @@ SzMap *sz_list_to_map(SzList *pairs) {
 SzMap *sz_list_to_set(SzList *xs, int32_t key_kind) {
   SzMap *acc = NULL;
   SzList *p;
+  int32_t kind = key_kind;
+  if (xs && xs->head)
+    kind = sz_map_infer_key_kind(xs->head);
   for (p = xs; p; p = p->tail) {
-    SzMap *next = sz_map_set(acc, p->head, NULL, key_kind);
+    SzMap *next = sz_map_set(acc, p->head, NULL, kind);
     sz_release(acc);
     acc = next;
   }
@@ -1239,8 +1270,12 @@ SzList *sz_list_sort(SzList *xs, int64_t as_int) {
   SzSortSlot *slots;
   SzList *p;
   size_t i;
+  uint32_t kind;
+  (void)as_int;
   if (!xs)
     return NULL;
+  kind = list_elem_kind(xs, "List.sort: not Int or String");
+  list_require_kind(xs, kind, "List.sort: not Int or String");
   slots = (SzSortSlot *)sz_alloc((size_t)n * sizeof(SzSortSlot));
   i = 0;
   for (p = xs; p; p = p->tail) {
@@ -1249,7 +1284,8 @@ SzList *sz_list_sort(SzList *xs, int64_t as_int) {
     slots[i].idx = i;
     i++;
   }
-  return sort_slots(slots, (size_t)n, as_int ? cmp_int_slots : cmp_str_slots);
+  return sort_slots(slots, (size_t)n,
+                    kind == SZ_RC_BOX ? cmp_int_slots : cmp_str_slots);
 }
 
 SzList *sz_list_sort_by(SzList *xs, SzListMapFn fn, void *env) {
@@ -1274,8 +1310,8 @@ SzList *sz_list_sort_by(SzList *xs, SzListMapFn fn, void *env) {
   return sort_slots(slots, (size_t)n, cmp_key_slots);
 }
 
-static int cell_ord(void *a, void *b, int64_t as_int) {
-  if (as_int) {
+static int cell_ord(void *a, void *b, uint32_t kind) {
+  if (kind == SZ_RC_BOX) {
     int64_t ka = sz_unbox_i64(a);
     int64_t kb = sz_unbox_i64(b);
     if (ka < kb)
@@ -1291,11 +1327,17 @@ static void *list_extreme(SzList *xs, int64_t as_int, int want_max,
                           const char *empty_msg) {
   SzList *p;
   void *best;
+  uint32_t kind;
+  const char *bad =
+      want_max ? "List.max: not Int or String" : "List.min: not Int or String";
+  (void)as_int;
   if (!xs)
     sz_panic(empty_msg);
+  kind = list_elem_kind(xs, bad);
+  list_require_kind(xs, kind, bad);
   best = xs->head;
   for (p = xs->tail; p; p = p->tail) {
-    int c = cell_ord(p->head, best, as_int);
+    int c = cell_ord(p->head, best, kind);
     if (want_max ? c > 0 : c < 0)
       best = p->head;
   }
@@ -1339,6 +1381,7 @@ SzMap *sz_list_group_by(SzList *xs, SzListMapFn fn, void *env, int32_t key_kind)
 int64_t sz_list_sum(SzList *xs) {
   uint64_t acc = 0;
   SzList *p;
+  list_require_kind(xs, SZ_RC_BOX, "List.sum: not Int");
   for (p = xs; p; p = p->tail)
     acc += (uint64_t)sz_unbox_i64(p->head);
   return (int64_t)acc;
@@ -1347,6 +1390,7 @@ int64_t sz_list_sum(SzList *xs) {
 int64_t sz_list_product(SzList *xs) {
   uint64_t acc = 1;
   SzList *p;
+  list_require_kind(xs, SZ_RC_BOX, "List.product: not Int");
   for (p = xs; p; p = p->tail)
     acc *= (uint64_t)sz_unbox_i64(p->head);
   return (int64_t)acc;
@@ -1398,12 +1442,22 @@ int sz_list_non_empty(const SzList *xs) { return xs != NULL; }
 
 void sz_list_free(SzList *xs) { sz_release(xs); }
 
-SzString *sz_list_join(const SzList *xs, const char *sep) {
-  if (!sep)
-    sep = "";
-  size_t sep_len = strlen(sep);
+SzString *sz_list_join(const SzList *xs, const SzString *sep) {
+  const char *sep_data = "";
+  size_t sep_len = 0;
   size_t total = 0;
   size_t count = 0;
+  char *buf;
+  size_t off = 0;
+  size_t i = 0;
+  SzString *out;
+  list_require_kind(xs, SZ_RC_STRING, "List.join: not String");
+  if (sep) {
+    if (sz_rc_kind(sep) != SZ_RC_STRING)
+      sz_panic("List.join: not String");
+    sep_data = sep->data ? sep->data : "";
+    sep_len = sep->len;
+  }
   for (const SzList *p = xs; p; p = p->tail) {
     SzString *s = (SzString *)p->head;
     if (s) {
@@ -1420,12 +1474,10 @@ SzString *sz_list_join(const SzList *xs, const char *sep) {
   }
   if (total == SIZE_MAX)
     sz_panic("List.join too large");
-  char *buf = (char *)sz_alloc(total + 1);
-  size_t off = 0;
-  size_t i = 0;
+  buf = (char *)sz_alloc(total + 1);
   for (const SzList *p = xs; p; p = p->tail) {
     if (i > 0 && sep_len) {
-      memcpy(buf + off, sep, sep_len);
+      memcpy(buf + off, sep_data, sep_len);
       off += sep_len;
     }
     SzString *s = (SzString *)p->head;
@@ -1436,7 +1488,7 @@ SzString *sz_list_join(const SzList *xs, const char *sep) {
     i++;
   }
   buf[off] = '\0';
-  SzString *out = sz_string_from_bytes(buf, off);
+  out = sz_string_from_bytes(buf, off);
   sz_free(buf);
   return out;
 }
diff --git a/crates/runtime/src/map.c b/crates/runtime/src/map.c
index 8bad15b2..7c31af60 100644
--- a/crates/runtime/src/map.c
+++ b/crates/runtime/src/map.c
@@ -48,16 +48,19 @@ static SzMap *map_take_right(void *k, void *v, SzMap *l, SzMap *r, int32_t kind)
 
 SzMap *sz_map_set(SzMap *m, void *k, void *v, int32_t kind) {
   int c;
+  int32_t knd;
+  (void)kind;
   if (!m)
-    return map_node(k, v, NULL, NULL, kind);
+    return map_node(k, v, NULL, NULL, sz_map_infer_key_kind(k));
+  knd = m->key_kind;
   c = map_cmp(m, k);
   if (c == 0)
-    return map_node(k, v, m->left, m->right, m->key_kind);
+    return map_node(k, v, m->left, m->right, knd);
   if (c > 0)
-    return map_take_left(m->key, m->val, sz_map_set(m->left, k, v, kind), m->right,
-                         m->key_kind);
-  return map_take_right(m->key, m->val, m->left, sz_map_set(m->right, k, v, kind),
-                        m->key_kind);
+    return map_take_left(m->key, m->val, sz_map_set(m->left, k, v, knd), m->right,
+                         knd);
+  return map_take_right(m->key, m->val, m->left, sz_map_set(m->right, k, v, knd),
+                        knd);
 }
 
 void *sz_map_get_or(SzMap *m, void *k, void *dflt) {
@@ -72,11 +75,16 @@ void *sz_map_get_or(SzMap *m, void *k, void *dflt) {
   return sz_map_get_or(m->right, k, dflt);
 }
 
-SzList *sz_map_get(SzMap *m, void *k) {
-  void *v = sz_map_get_or(m, k, NULL);
-  if (!v)
-    return NULL;
-  return sz_list_cons(v, NULL);
+void *sz_map_get(SzMap *m, void *k) {
+  int c;
+  if (!m)
+    return sz_adt_new(0, NULL);
+  c = map_cmp(m, k);
+  if (c == 0)
+    return sz_adt_new(1, m->val);
+  if (c > 0)
+    return sz_map_get(m->left, k);
+  return sz_map_get(m->right, k);
 }
 
 int64_t sz_map_contains(SzMap *m, void *k) {
@@ -348,6 +356,8 @@ SzMap *sz_set_map(SzMap *s, SzListMapFn fn, void *env, int32_t key_kind) {
   SzMap *out = NULL;
   SzMap *next;
   void *nk;
+  int32_t kind = key_kind;
+  int got = 0;
   if (!fn)
     sz_panic("sz_set_map(null fn)");
   if (!s)
@@ -356,7 +366,11 @@ SzMap *sz_set_map(SzMap *s, SzListMapFn fn, void *env, int32_t key_kind) {
   for (p = keys; p; p = p->tail) {
     /* Mapper returns +1. Set retains. Drop the mapper ref. */
     nk = fn(p->head, env);
-    next = sz_map_set(out, nk, NULL, key_kind);
+    if (!got) {
+      kind = sz_map_infer_key_kind(nk);
+      got = 1;
+    }
+    next = sz_map_set(out, nk, NULL, kind);
     sz_release(nk);
     sz_release(out);
     out = next;
diff --git a/crates/runtime/src/net.c b/crates/runtime/src/net.c
index 0d8645e3..031681b7 100644
--- a/crates/runtime/src/net.c
+++ b/crates/runtime/src/net.c
@@ -881,7 +881,7 @@ void sz_net_test_http_host_header(const char *host, int port, char *out,
   http_fmt_hosthdr(out, cap, host, port, 80);
 }
 
-static void http_build_req(HttpSt *st) {
+static int http_build_req(HttpSt *st) {
   char hosthdr[300];
   const char *method = st->method[0] ? st->method : "GET";
   const char *body = st->req_body ? sz_string_cstr(st->req_body) : "";
@@ -902,8 +902,8 @@ static void http_build_req(HttpSt *st) {
     hn = snprintf(hdr, sizeof hdr,
                   "%s %s HTTP/1.0\r\nHost: %s\r\nConnection: close\r\n\r\n",
                   method, st->path, hosthdr);
-  if (hn < 0)
-    hn = 0;
+  if (hn < 0 || (size_t)hn >= sizeof hdr)
+    return 0;
   nreq = (size_t)hn + (has_body ? blen : 0);
   st->req = (char *)sz_alloc(nreq + 1);
   memcpy(st->req, hdr, (size_t)hn);
@@ -916,6 +916,7 @@ static void http_build_req(HttpSt *st) {
   st->acc[0] = '\0';
   st->acc_cap = 1;
   st->total = 0;
+  return 1;
 }
 
 static SSL_CTX *g_http_ssl_ctx;
@@ -1011,7 +1012,11 @@ static void *http_tcp_connect(void *env) {
       st->fd4 = -1;
       st->fd6 = -1;
     }
-    http_build_req(st);
+    if (!http_build_req(st)) {
+      r->is_err = 1;
+      r->as.err = http_err(st, "request failed");
+      return r;
+    }
     st->connect_deadline_ms = sz_clock_monotonic_ms_sync() + HE_CONNECT_MS;
     if (st->he_wait4)
       st->he_v4_at_ms = sz_clock_monotonic_ms_sync() + HE_A_DELAY_MS;
@@ -1025,7 +1030,11 @@ static void *http_tcp_connect(void *env) {
     return r;
   }
   st->fd = fd;
-  http_build_req(st);
+  if (!http_build_req(st)) {
+    r->is_err = 1;
+    r->as.err = http_err(st, "request failed");
+    return r;
+  }
   st->connect_deadline_ms = sz_clock_monotonic_ms_sync() + HE_CONNECT_MS;
   r->is_err = 0;
   return r;
@@ -1914,7 +1923,7 @@ static int serve_bind_v6(int port) {
 
 static int serve_accept_wait(int err) {
   return err == EAGAIN || err == EWOULDBLOCK || err == ECONNABORTED ||
-         err == EMFILE || err == ENFILE || err == EINTR;
+         err == EINTR;
 }
 
 static void *serve_ensure_listen(void *env) {
@@ -2087,6 +2096,12 @@ static void *serve_read_req(void *env) {
       r->as.err = sz_error_new(6, "Net.serve: expected HTTP request");
       return r;
     }
+    if (sz_clock_monotonic_ms_sync() >= st->req_deadline_ms) {
+      r->is_err = 1;
+      r->drop = 1;
+      r->as.err = sz_error_new(6, "Net.serve: request timed out");
+      return r;
+    }
     r->retry = 1;
     return r;
   }
diff --git a/crates/runtime/src/net_sock.c b/crates/runtime/src/net_sock.c
index d330a977..33081751 100644
--- a/crates/runtime/src/net_sock.c
+++ b/crates/runtime/src/net_sock.c
@@ -12,8 +12,8 @@
 #include <unistd.h>
 
 /* Blessed TCP and UDP. Listen/bind is localhost. Connect takes IPv4/IPv6
- * literals or localhost. No DNS. Fibers park on poll. TestRuntime uses a
- * mailbox. Opaque SzNetSock owns the fds. */
+ * literals or localhost. UDP bind is IPv4 only. No DNS. Fibers park on poll.
+ * TestRuntime uses a mailbox. Opaque SzNetSock owns the fds. */
 
 enum { NS_TCP = 1, NS_LISTEN = 2, NS_UDP = 3 };
 enum { NS_IO_MS = 1000 };
@@ -147,6 +147,28 @@ static int parse_tcp_host(const char *host, struct sockaddr_storage *ss,
   return 0;
 }
 
+int sz_net_host_family(const char *host, char *canon, size_t canon_cap) {
+  struct sockaddr_storage ss;
+  socklen_t len = 0;
+  if (canon && canon_cap)
+    canon[0] = '\0';
+  if (!parse_tcp_host(host, &ss, &len, 1))
+    return 0;
+  if (ss.ss_family == AF_INET) {
+    struct sockaddr_in *a = (struct sockaddr_in *)&ss;
+    if (canon && canon_cap)
+      inet_ntop(AF_INET, &a->sin_addr, canon, (socklen_t)canon_cap);
+    return 4;
+  }
+  if (ss.ss_family == AF_INET6) {
+    struct sockaddr_in6 *a = (struct sockaddr_in6 *)&ss;
+    if (canon && canon_cap)
+      inet_ntop(AF_INET6, &a->sin6_addr, canon, (socklen_t)canon_cap);
+    return 6;
+  }
+  return 0;
+}
+
 static int tcp_begin(const struct sockaddr *sa, socklen_t len) {
   int fd;
   if (!sa || len == 0)
@@ -492,7 +514,7 @@ static void *accept_cleanup(void *env) {
 
 static int accept_wait_err(int err) {
   return err == EAGAIN || err == EWOULDBLOCK || err == ECONNABORTED ||
-         err == EMFILE || err == ENFILE || err == EINTR;
+         err == EINTR;
 }
 
 static void *accept_try(void *env) {
@@ -587,11 +609,39 @@ SzIo *sz_net_tcp_accept(SzNetSock *listener) {
   }
 }
 
+static int read_acc_append(ConnOp *op, const char *p, size_t n) {
+  size_t need;
+  if (!op || !p || n == 0)
+    return 1;
+  need = op->acc_len + n;
+  if (need > op->acc_cap) {
+    size_t cap = op->acc_cap ? op->acc_cap : 64;
+    char *nb;
+    while (cap < need)
+      cap *= 2;
+    if (cap > NS_READ_MAX)
+      cap = NS_READ_MAX;
+    if (need > cap)
+      n = cap - op->acc_len;
+    if (n == 0)
+      return 1;
+    need = op->acc_len + n;
+    nb = (char *)sz_alloc(cap);
+    if (op->acc_len)
+      memcpy(nb, op->acc, op->acc_len);
+    sz_free(op->acc);
+    op->acc = nb;
+    op->acc_cap = cap;
+  }
+  memcpy(op->acc + op->acc_len, p, n);
+  op->acc_len += n;
+  return 1;
+}
+
 static void *read_try(void *env) {
   ConnOp *op = (ConnOp *)env;
   SockResult *r = (SockResult *)rc_box_zero(sizeof(SockResult));
   char buf[4096];
-  ssize_t n;
   size_t want;
   if (!op->sock || op->sock->fd < 0) {
     r->is_err = 1;
@@ -605,22 +655,41 @@ static void *read_try(void *env) {
   }
   if (want > NS_READ_MAX)
     want = NS_READ_MAX;
-  n = read(op->sock->fd, buf, want < sizeof buf ? want : sizeof buf);
-  if (n < 0 && (errno == EAGAIN || errno == EWOULDBLOCK)) {
-    if (sz_clock_monotonic_ms_sync() >= op->deadline_ms) {
-      r->is_err = 1;
-      r->as.err = sz_error_new(6, "Net.tcpRead: timed out");
+  for (;;) {
+    size_t room;
+    ssize_t n;
+    if (op->acc_len >= want)
+      break;
+    room = want - op->acc_len;
+    if (room > sizeof buf)
+      room = sizeof buf;
+    n = read(op->sock->fd, buf, room);
+    if (n > 0) {
+      read_acc_append(op, buf, (size_t)n);
+      continue;
+    }
+    if (n == 0) {
+      r->as.ok = sz_string_from_bytes(op->acc ? op->acc : "", op->acc_len);
+      return r;
+    }
+    if (errno == EAGAIN || errno == EWOULDBLOCK) {
+      if (op->acc_len > 0) {
+        r->as.ok = sz_string_from_bytes(op->acc, op->acc_len);
+        return r;
+      }
+      if (sz_clock_monotonic_ms_sync() >= op->deadline_ms) {
+        r->is_err = 1;
+        r->as.err = sz_error_new(6, "Net.tcpRead: timed out");
+        return r;
+      }
+      r->retry = 1;
       return r;
     }
-    r->retry = 1;
-    return r;
-  }
-  if (n < 0) {
     r->is_err = 1;
     r->as.err = sz_error_new(6, "Net.tcpRead: read failed");
     return r;
   }
-  r->as.ok = sz_string_from_bytes(buf, (size_t)n);
+  r->as.ok = sz_string_from_bytes(op->acc, op->acc_len);
   return r;
 }
 
diff --git a/crates/runtime/src/random.c b/crates/runtime/src/random.c
index 602d3d79..31fc7309 100644
--- a/crates/runtime/src/random.c
+++ b/crates/runtime/src/random.c
@@ -4,7 +4,8 @@
 #include <stdio.h>
 #include <time.h>
 
-/* Blessed Random — live entropy or TestRuntime seeded LCG. */
+/* Blessed Random. Live seeds once from /dev/urandom then LCG.
+ * TestRuntime is a seeded LCG. */
 
 static int g_fake = 0;
 static uint64_t g_state = 1;
@@ -50,25 +51,24 @@ static uint64_t next_u64(void) {
 
 static void *random_next_thunk(void *env) {
   int64_t bound = sz_unbox_i64(env);
+  uint64_t u;
+  uint64_t lim;
   int64_t n;
   sz_timeline_log_cstr("Random.nextInt", "");
-  if (bound <= 0)
-    n = 0;
-  else {
-    uint64_t lim = (uint64_t)bound;
-    uint64_t zone = UINT64_MAX - (UINT64_MAX % lim);
-    uint64_t u;
-    do {
-      u = next_u64();
-    } while (u >= zone);
-    n = (int64_t)(u % lim);
-  }
+  lim = (uint64_t)bound;
+  u = next_u64();
+  /* Lemire 2019: map through high bits. LCG bit 0 has period 2. */
+  n = (int64_t)(((__uint128_t)u * lim) >> 64);
   return sz_box_i64(n);
 }
 
 SzIo *sz_random_next_int(int64_t bound) {
-  void *b = sz_box_i64(bound);
-  SzIo *io = sz_io_delay(random_next_thunk, b);
+  void *b;
+  SzIo *io;
+  if (bound <= 0)
+    return sz_io_fail_cstr("Random.nextInt: bound <= 0");
+  b = sz_box_i64(bound);
+  io = sz_io_delay(random_next_thunk, b);
   sz_release(b);
   return io;
 }
diff --git a/crates/runtime/src/resource.c b/crates/runtime/src/resource.c
index 1720aa86..c0115c4f 100644
--- a/crates/runtime/src/resource.c
+++ b/crates/runtime/src/resource.c
@@ -10,6 +10,8 @@ typedef struct LangResSt {
   void *acquired;
 } LangResSt;
 
+/* Acquire hands one retain to st->acquired. Use and release neths borrow
+ * that pointer. This drop is the only release of the acquired value. */
 static SzIo *lang_fin_free_ok(void *ignored, void *env) {
   LangResSt *st = (LangResSt *)env;
   sz_release(ignored);
diff --git a/crates/runtime/src/rt_util.h b/crates/runtime/src/rt_util.h
index d05314bb..844f7d30 100644
--- a/crates/runtime/src/rt_util.h
+++ b/crates/runtime/src/rt_util.h
@@ -53,4 +53,121 @@ static inline SzString *pack_path(void *env) {
   return pack ? (SzString *)pack->left : NULL;
 }
 
+/* Grow a C string buffer. Used by signal dump, a11y dump, and inject read. */
+static inline void sz_dump_append(char **buf, size_t *len, size_t *cap,
+                                  const char *s) {
+  size_t n = strlen(s);
+  if (*len + n + 1 > *cap) {
+    size_t ncap = *cap ? *cap : 256;
+    char *nb;
+    while (*len + n + 1 > ncap)
+      ncap *= 2;
+    nb = (char *)sz_alloc(ncap);
+    if (*buf) {
+      memcpy(nb, *buf, *len);
+      sz_free(*buf);
+    }
+    *buf = nb;
+    *cap = ncap;
+  }
+  memcpy(*buf + *len, s, n);
+  *len += n;
+  (*buf)[*len] = '\0';
+}
+
+/* Editor dump dialect: \\ \" \n \r \t. No surrounding quotes. */
+static inline void sz_dump_append_escaped(char **buf, size_t *len, size_t *cap,
+                                          const char *s) {
+  const char *p;
+  if (!s)
+    return;
+  for (p = s; *p; p++) {
+    unsigned char c = (unsigned char)*p;
+    if (c == '\\')
+      sz_dump_append(buf, len, cap, "\\\\");
+    else if (c == '"')
+      sz_dump_append(buf, len, cap, "\\\"");
+    else if (c == '\n')
+      sz_dump_append(buf, len, cap, "\\n");
+    else if (c == '\r')
+      sz_dump_append(buf, len, cap, "\\r");
+    else if (c == '\t')
+      sz_dump_append(buf, len, cap, "\\t");
+    else {
+      char t[2];
+      t[0] = (char)c;
+      t[1] = '\0';
+      sz_dump_append(buf, len, cap, t);
+    }
+  }
+}
+
+static inline unsigned char sz_dump_unescape_char(const char **p) {
+  const char *s = *p;
+  unsigned char c;
+  if (*s == '\\' && s[1]) {
+    s++;
+    if (*s == 'n')
+      c = '\n';
+    else if (*s == 'r')
+      c = '\r';
+    else if (*s == 't')
+      c = '\t';
+    else
+      c = (unsigned char)*s;
+    s++;
+    *p = s;
+    return c;
+  }
+  c = (unsigned char)*s;
+  *p = s + 1;
+  return c;
+}
+
+/* Unescape a dump/script payload. Caller frees. */
+static inline char *sz_dump_unescape(const char *s) {
+  char *buf = NULL;
+  size_t len = 0, cap = 0;
+  const char *p = s ? s : "";
+  while (*p) {
+    char t[2];
+    t[0] = (char)sz_dump_unescape_char(&p);
+    t[1] = '\0';
+    sz_dump_append(&buf, &len, &cap, t);
+  }
+  if (!buf)
+    sz_dump_append(&buf, &len, &cap, "");
+  return buf;
+}
+
+/* Parse `"…"` with the dump escape dialect. p points at the opening quote.
+ * Returns the pointer after the closing quote, or NULL. When out is set,
+ * writes the unescaped bytes (caller frees). */
+static inline const char *sz_dump_parse_quoted(const char *p, char **out) {
+  char *buf = NULL;
+  size_t len = 0, cap = 0;
+  if (out)
+    *out = NULL;
+  if (!p || *p != '"')
+    return NULL;
+  p++;
+  while (*p && *p != '"') {
+    char t[2];
+    t[0] = (char)sz_dump_unescape_char(&p);
+    t[1] = '\0';
+    if (out)
+      sz_dump_append(&buf, &len, &cap, t);
+  }
+  if (*p != '"') {
+    sz_free(buf);
+    return NULL;
+  }
+  if (out) {
+    if (!buf)
+      sz_dump_append(&buf, &len, &cap, "");
+    *out = buf;
+  }
+  return p + 1;
+}
+
 #endif
diff --git a/crates/runtime/src/runtime.c b/crates/runtime/src/runtime.c
index 681186a4..7744c8d8 100644
--- a/crates/runtime/src/runtime.c
+++ b/crates/runtime/src/runtime.c
@@ -11,8 +11,9 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
-
+#include <locale.h>
 #if defined(__APPLE__)
+#include <xlocale.h>
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
@@ -459,6 +460,12 @@ void sz_retain(void *ptr) {
   sz_rc_hdr(ptr)->rc += 1;
 }
 
+uint32_t sz_rc_kind(const void *ptr) {
+  if (!sz_is_rc(ptr))
+    return SZ_RC_KIND_COUNT;
+  return sz_rc_hdr(ptr)->kind;
+}
+
 void sz_release(void *ptr) {
   SzRcHdr *h;
   uint32_t kind;
@@ -642,11 +649,12 @@ void sz_release(void *ptr) {
           tag == SZ_ST_ZIPALL || tag == SZ_ST_ORELSE)
         sz_release(right);
       /* TAKE/DROP/GROUPED/SLIDING/TAKERIGHT/DROPRIGHT store a count in env.
+       * RANGE stores from in env and until in right. Those are not RC.
        * Filter, map, scan, and flatMap nodes store a capture. Function
        * pointers in right are not RC. */
       if (tag != SZ_ST_TAKE && tag != SZ_ST_DROP && tag != SZ_ST_GROUPED &&
           tag != SZ_ST_SLIDING && tag != SZ_ST_TAKERIGHT &&
-          tag != SZ_ST_DROPRIGHT)
+          tag != SZ_ST_DROPRIGHT && tag != SZ_ST_RANGE)
         sz_release(env);
       return;
     }
@@ -702,6 +710,8 @@ void sz_release(void *ptr) {
     int bad = d->completed && !d->ok;
     void *v = d->value;
     SzError *err = d->error;
+    if (d->waiters)
+      sz_panic("sz_deferred_free: waiters remain");
     d->value = NULL;
     d->error = NULL;
     sz_rc_retire(ptr);
@@ -758,6 +768,8 @@ void sz_release(void *ptr) {
 
 /* --- strings ------------------------------------------------------------- */
 
+static uint32_t utf8_decode(const char *p, size_t left, size_t *used);
+
 SzString *sz_string_from_bytes(const char *bytes, size_t len) {
   SzString *s = (SzString *)sz_rc_alloc(sizeof(SzString), SZ_RC_STRING);
   size_t i;
@@ -770,12 +782,16 @@ SzString *sz_string_from_bytes(const char *bytes, size_t len) {
   s->ulen = 0;
   s->cp_hint = 0;
   s->off_hint = 0;
-  for (i = 0; i < len; i++) {
+  /* Count with the same walk as utf8_decode so a lone continuation is one
+   * code point, not invisible. */
+  for (i = 0; i < len; ) {
+    size_t used;
     unsigned char c = (unsigned char)s->data[i];
     if (c >= 0x80)
       s->is_ascii = 0;
-    if ((c & 0xC0) != 0x80)
-      s->ulen++;
+    utf8_decode(s->data + i, len - i, &used);
+    i += used;
+    s->ulen++;
   }
   return s;
 }
@@ -795,13 +811,17 @@ void sz_string_free(SzString *s) { sz_release(s); }
 SzString *sz_string_concat(const SzString *a, const SzString *b) {
   size_t al = a && a->data ? a->len : 0;
   size_t bl = b && b->data ? b->len : 0;
-  char *buf = (char *)sz_alloc(al + bl + 1);
+  char *buf;
+  SzString *out;
+  if (bl > SIZE_MAX - al)
+    sz_panic("Str.concat too large");
+  buf = (char *)sz_alloc(al + bl + 1);
   if (al)
     memcpy(buf, a->data, al);
   if (bl)
     memcpy(buf + al, b->data, bl);
   buf[al + bl] = '\0';
-  SzString *out = sz_string_from_bytes(buf, al + bl);
+  out = sz_string_from_bytes(buf, al + bl);
   sz_free(buf);
   return out;
 }
@@ -811,14 +831,19 @@ static void builder_append_bytes(SzBuilder *b, const char *p, size_t n) {
   char *d;
   if (!b || n == 0)
     return;
+  if (n > SIZE_MAX - b->len)
+    sz_panic("Builder.append too large");
   if (b->len + n <= b->cap) {
     memcpy(b->data + b->len, p, n);
     b->len += n;
     return;
   }
   cap = b->cap ? b->cap : 64;
-  while (cap < b->len + n)
+  while (cap < b->len + n) {
+    if (cap > SIZE_MAX / 2)
+      sz_panic("Builder.append too large");
     cap *= 2;
+  }
   d = (char *)sz_alloc(cap);
   if (b->len)
     memcpy(d, b->data, b->len);
@@ -917,14 +942,40 @@ SzString *sz_string_from_int(int64_t n) {
   return sz_string_from_cstr(buf);
 }
 
+SzString *sz_string_from_bool(int64_t b) {
+  return sz_string_from_cstr(b ? "true" : "false");
+}
+
+static locale_t str_c_locale(void) {
+  static locale_t loc;
+  if (!loc)
+    loc = newlocale(LC_ALL_MASK, "C", (locale_t)0);
+  return loc;
+}
+
 SzString *sz_string_from_float(double x) {
-  char buf[64];
+  char buf[512];
   char *dot;
   char *end;
+  int n;
+  locale_t loc;
   if (x != x) {
     return sz_string_from_cstr("NaN");
   }
-  snprintf(buf, sizeof(buf), "%.6f", x);
+  loc = str_c_locale();
+  if (!loc)
+    sz_panic("Str.fromFloat: C locale");
+#ifdef __APPLE__
+  n = snprintf_l(buf, sizeof(buf), loc, "%.6f", x);
+#else
+  {
+    locale_t old = uselocale(loc);
+    n = snprintf(buf, sizeof(buf), "%.6f", x);
+    uselocale(old);
+  }
+#endif
+  if (n < 0 || (size_t)n >= sizeof(buf))
+    sz_panic("Str.fromFloat overflow");
   dot = strchr(buf, '.');
   if (dot) {
     end = buf + strlen(buf);
@@ -1072,15 +1123,16 @@ static int64_t utf8_cp_off(const SzString *s, int64_t cp) {
     i = 0;
     k = 0;
   }
-  for (; i < s->len; i++) {
-    if (!utf8_cont((unsigned char)s->data[i])) {
-      if (k == cp) {
-        mut->cp_hint = cp;
-        mut->off_hint = (int64_t)i;
-        return (int64_t)i;
-      }
-      k++;
+  while (i < s->len) {
+    size_t used;
+    if (k == cp) {
+      mut->cp_hint = cp;
+      mut->off_hint = (int64_t)i;
+      return (int64_t)i;
     }
+    utf8_decode(s->data + i, s->len - i, &used);
+    i += used;
+    k++;
   }
   if (k == cp) {
     mut->cp_hint = cp;
@@ -1186,11 +1238,19 @@ SzString *sz_string_ureverse(const SzString *s) {
 
 /* Code-point count of the byte range [0, byte_end). */
 static int64_t utf8_cp_before(const SzString *s, int64_t byte_end) {
-  int64_t i;
+  size_t i = 0;
   int64_t k = 0;
-  for (i = 0; i < byte_end && i < (int64_t)s->len; i++) {
-    if (!utf8_cont((unsigned char)s->data[i]))
-      k++;
+  size_t end;
+  if (byte_end <= 0)
+    return 0;
+  end = (size_t)byte_end;
+  if (end > s->len)
+    end = s->len;
+  while (i < end) {
+    size_t used;
+    utf8_decode(s->data + i, s->len - i, &used);
+    k++;
+    i += used;
   }
   return k;
 }
@@ -1472,32 +1532,68 @@ SzString *sz_string_strip_suffix(const SzString *s, const SzString *suffix) {
 }
 
 static SzString *sz_string_pad(const SzString *s, int64_t n, const SzString *pad, int left) {
-  size_t slen = s && s->data ? s->len : 0;
-  size_t plen = pad && pad->data ? pad->len : 0;
+  int64_t slen = sz_string_ulen(s);
+  int64_t plen = sz_string_ulen(pad);
+  size_t sbytes = s && s->data ? s->len : 0;
+  size_t pbytes = pad && pad->data ? pad->len : 0;
   const char *src = s && s->data ? s->data : "";
   const char *psrc = pad && pad->data ? pad->data : "";
-  size_t want;
-  size_t need;
+  int64_t need;
+  size_t fill_bytes;
+  size_t po;
+  size_t off;
+  int64_t k;
   char *buf;
   SzString *out;
-  size_t i;
-  if (n <= 0 || (uint64_t)n <= (uint64_t)slen)
+  size_t want;
+  if (n <= 0 || n <= slen)
     return sz_string_copy(s);
-  if (plen == 0)
+  if (plen <= 0)
     return sz_string_copy(s);
-  if ((uint64_t)n > (uint64_t)SIZE_MAX)
+  need = n - slen;
+  if ((uint64_t)need > (uint64_t)SIZE_MAX / 4)
+    sz_panic("Str.pad too large");
+  fill_bytes = 0;
+  po = 0;
+  for (k = 0; k < need; k++) {
+    size_t used;
+    if (po >= pbytes)
+      po = 0;
+    utf8_decode(psrc + po, pbytes - po, &used);
+    if (used > SIZE_MAX - fill_bytes)
+      sz_panic("Str.pad too large");
+    fill_bytes += used;
+    po += used;
+  }
+  if (fill_bytes > SIZE_MAX - sbytes)
     sz_panic("Str.pad too large");
-  want = (size_t)n;
-  need = want - slen;
+  want = fill_bytes + sbytes;
   buf = (char *)sz_alloc(want + 1);
+  po = 0;
   if (left) {
-    for (i = 0; i < need; i++)
-      buf[i] = psrc[i % plen];
-    memcpy(buf + need, src, slen);
+    off = 0;
+    for (k = 0; k < need; k++) {
+      size_t used;
+      if (po >= pbytes)
+        po = 0;
+      utf8_decode(psrc + po, pbytes - po, &used);
+      memcpy(buf + off, psrc + po, used);
+      off += used;
+      po += used;
+    }
+    memcpy(buf + fill_bytes, src, sbytes);
   } else {
-    memcpy(buf, src, slen);
-    for (i = 0; i < need; i++)
-      buf[slen + i] = psrc[i % plen];
+    memcpy(buf, src, sbytes);
+    off = sbytes;
+    for (k = 0; k < need; k++) {
+      size_t used;
+      if (po >= pbytes)
+        po = 0;
+      utf8_decode(psrc + po, pbytes - po, &used);
+      memcpy(buf + off, psrc + po, used);
+      off += used;
+      po += used;
+    }
   }
   buf[want] = '\0';
   out = sz_string_from_bytes(buf, want);
@@ -2629,8 +2725,11 @@ static void queue_waiter_remove(SzQueue *q, Fiber *f) {
 }
 
 static void def_waiter_add(SzDeferred *d, Fiber *f) {
-  f->wait_next = (Fiber *)d->waiters;
-  d->waiters = f;
+  Fiber **pp = (Fiber **)&d->waiters;
+  f->wait_next = NULL;
+  while (*pp)
+    pp = &(*pp)->wait_next;
+  *pp = f;
 }
 
 static void def_waiter_remove(SzDeferred *d, Fiber *f) {
@@ -3640,6 +3739,26 @@ static int idle_advance(Sched *s) {
         return 1;
       continue;
     }
+    if (sz_testrt_clock_is_fake()) {
+      /* Do not poll with a wall timeout. Virtual time does not move. */
+      pr = poll(pfds, (nfds_t)npoll, 0);
+      if (pr < 0 && errno == EINTR)
+        continue;
+      now = sz_clock_monotonic_ms_sync();
+      if (pr > 0 && wake_pollers(s, pfds, fibs, npoll))
+        return 1;
+      if (wake_sleepers(s, now))
+        return 1;
+      if (pr < 0)
+        return 0;
+      if (next < 0)
+        return 0;
+      delta = next - now;
+      if (delta > 0)
+        sz_testrt_clock_advance(delta);
+      now = sz_clock_monotonic_ms_sync();
+      return wake_sleepers(s, now);
+    }
     if (next < 0)
       timeout_ms = -1;
     else {
@@ -3694,6 +3813,11 @@ static void sched_free_fibers(Sched *s) {
       sz_release(f->qwait);
       f->qwait = NULL;
     }
+    if (f->dwait) {
+      def_waiter_remove(f->dwait, f);
+      sz_release(f->dwait);
+      f->dwait = NULL;
+    }
     cont_free_all(f->stack);
     f->stack = NULL;
     fiber_release_result(f);
diff --git a/crates/runtime/src/signal.c b/crates/runtime/src/signal.c
index f35ba856..a6a70006 100644
--- a/crates/runtime/src/signal.c
+++ b/crates/runtime/src/signal.c
@@ -54,16 +54,24 @@ static void sig_register(SigKind kind, const void *sig) {
   g_sig_tail = r;
 }
 
-/* Publish the author-facing name of a signal (its `for` binder name). */
+/* Publish the author-facing name of a signal (its `for` binder name).
+ * Last non-empty name wins: a later bind clears the same name on others. */
 void sz_signal_name(const void *sig, const char *name) {
   SigReg *r;
+  SigReg *mine = NULL;
+  const char *n = name ? name : "";
   for (r = g_sig_head; r; r = r->next) {
-    if (r->sig == sig) {
+    if (r->sig == sig)
+      mine = r;
+    else if (n[0] && r->name && strcmp(r->name, n) == 0) {
       sz_free(r->name);
-      r->name = sz_strdup(name);
-      return;
+      r->name = sz_strdup("");
     }
   }
+  if (!mine)
+    return;
+  sz_free(mine->name);
+  mine->name = sz_strdup(n);
 }
 
 static void sig_unregister(const void *sig) {
@@ -108,26 +116,6 @@ static void sig_set_elem_str(const void *sig, int64_t elem_str) {
   }
 }
 
-static void dump_append(char **buf, size_t *len, size_t *cap, const char *s) {
-  size_t n = strlen(s);
-  if (*len + n + 1 > *cap) {
-    size_t ncap = *cap ? *cap : 256;
-    char *nb;
-    while (*len + n + 1 > ncap)
-      ncap *= 2;
-    nb = (char *)sz_alloc(ncap);
-    if (*buf) {
-      memcpy(nb, *buf, *len);
-      sz_free(*buf);
-    }
-    *buf = nb;
-    *cap = ncap;
-  }
-  memcpy(*buf + *len, s, n);
-  *len += n;
-  (*buf)[*len] = '\0';
-}
-
 SzString *sz_signal_dump(void) {
   char *buf = NULL;
   size_t len = 0, cap = 0;
@@ -135,7 +123,7 @@ SzString *sz_signal_dump(void) {
   char tag[256];
   SigReg *r;
   SzString *out;
-  dump_append(&buf, &len, &cap, "");
+  sz_dump_append(&buf, &len, &cap, "");
   for (r = g_sig_head; r; r = r->next) {
     if (r->name && r->name[0])
       snprintf(tag, sizeof tag, "%s ", r->name);
@@ -145,30 +133,33 @@ SzString *sz_signal_dump(void) {
     case SIG_INT:
       snprintf(line, sizeof line, "int[%d] %s= %lld\n", r->id, tag,
                (long long)sz_signal_int_get((const SzSignalInt *)r->sig));
-      dump_append(&buf, &len, &cap, line);
+      sz_dump_append(&buf, &len, &cap, line);
       break;
     case SIG_STR:
-      snprintf(line, sizeof line, "str[%d] %s= \"%s\"\n", r->id, tag,
-               sz_signal_str_get((const SzSignalStr *)r->sig));
-      dump_append(&buf, &len, &cap, line);
+      snprintf(line, sizeof line, "str[%d] %s= \"", r->id, tag);
+      sz_dump_append(&buf, &len, &cap, line);
+      sz_dump_append_escaped(&buf, &len, &cap,
+                             sz_signal_str_get((const SzSignalStr *)r->sig));
+      sz_dump_append(&buf, &len, &cap, "\"\n");
       break;
     case SIG_LIST: {
       SzList *p = sz_signal_list_get((const SzSignalList *)r->sig);
       if (!r->elem_str) {
         snprintf(line, sizeof line, "list[%d] %s= <%lld>\n", r->id, tag,
                  (long long)sz_list_len(p));
-        dump_append(&buf, &len, &cap, line);
+        sz_dump_append(&buf, &len, &cap, line);
         break;
       }
       snprintf(line, sizeof line, "list[%d] %s= [", r->id, tag);
-      dump_append(&buf, &len, &cap, line);
+      sz_dump_append(&buf, &len, &cap, line);
       for (; p; p = p->tail) {
         const SzString *s = (const SzString *)p->head;
-        snprintf(line, sizeof line, "\"%s\"%s", s ? sz_string_cstr(s) : "",
-                 p->tail ? ", " : "");
-        dump_append(&buf, &len, &cap, line);
+        sz_dump_append(&buf, &len, &cap, "\"");
+        sz_dump_append_escaped(&buf, &len, &cap,
+                               s ? sz_string_cstr(s) : "");
+        sz_dump_append(&buf, &len, &cap, p->tail ? "\", " : "\"");
       }
-      dump_append(&buf, &len, &cap, "]\n");
+      sz_dump_append(&buf, &len, &cap, "]\n");
       break;
     }
     }
@@ -188,7 +179,11 @@ int64_t sz_property_signal_int(SzString *name) {
 }
 
 SzString *sz_property_signal_str(SzString *name) {
-  SigReg *r = sig_find(SIG_STR, name ? sz_string_cstr(name) : "");
+  const char *n = name ? sz_string_cstr(name) : "";
+  SigReg *r;
+  if (sz_timeline_replaying())
+    return sz_timeline_replay_signal_str(n);
+  r = sig_find(SIG_STR, n);
   if (r)
     return sz_string_from_cstr(
         sz_signal_str_get((const SzSignalStr *)r->sig));
@@ -196,7 +191,11 @@ SzString *sz_property_signal_str(SzString *name) {
 }
 
 int64_t sz_property_signal_list_len(SzString *name) {
-  SigReg *r = sig_find(SIG_LIST, name ? sz_string_cstr(name) : "");
+  const char *n = name ? sz_string_cstr(name) : "";
+  SigReg *r;
+  if (sz_timeline_replaying())
+    return sz_timeline_replay_signal_list_len(n);
+  r = sig_find(SIG_LIST, n);
   if (r)
     return (int64_t)sz_list_len(
         sz_signal_list_get((const SzSignalList *)r->sig));
@@ -207,9 +206,12 @@ SzString *sz_property_signal_list_at(SzString *name, int64_t index) {
   SigReg *r;
   const SzList *p;
   int64_t i;
+  const char *n = name ? sz_string_cstr(name) : "";
   if (index < 0)
     return sz_string_from_cstr("");
-  r = sig_find(SIG_LIST, name ? sz_string_cstr(name) : "");
+  if (sz_timeline_replaying())
+    return sz_timeline_replay_signal_list_at(n, index);
+  r = sig_find(SIG_LIST, n);
   if (r && r->elem_str) {
     p = sz_signal_list_get((const SzSignalList *)r->sig);
     i = 0;
diff --git a/crates/runtime/src/stream.c b/crates/runtime/src/stream.c
index e4912741..0cd37392 100644
--- a/crates/runtime/src/stream.c
+++ b/crates/runtime/src/stream.c
@@ -107,16 +107,10 @@ SzStream *sz_stream_drop(SzStream *inner, int64_t n) {
 }
 
 SzStream *sz_stream_range(int64_t from, int64_t until) {
-  SzStream *s = sz_stream_nil();
-  int64_t i;
   if (until <= from)
-    return s;
-  for (i = until - 1; i >= from; i--) {
-    void *box = sz_box_i64(i);
-    SzStream *cons = st_new(SZ_ST_CONS, box, s, NULL);
-    s = cons;
-  }
-  return s;
+    return sz_stream_nil();
+  return st_new(SZ_ST_RANGE, NULL, (void *)(intptr_t)until,
+                (void *)(intptr_t)from);
 }
 
 SzStream *sz_stream_repeat_n(SzStream *inner, int64_t n) {
@@ -240,83 +234,28 @@ SzStream *sz_stream_evaltap(SzStream *inner, SzCont f, void *env) {
   return st_new(SZ_ST_EVALTAP, st_keep(inner), (void *)f, env);
 }
 
+#define SZ_UNFOLD_CAP 65536
+
 SzStream *sz_stream_iterate(void *z, int64_t n, SzStreamMapFn f, void *env) {
-  SzList *nf;
-  SzList *of;
-  SzStream *s;
-  void *cur;
-  int64_t i;
+  void *nb;
+  SzPair *pack;
   if (!f)
     sz_panic("sz_stream_iterate(null fn)");
   if (n <= 0)
     return sz_stream_nil();
   sz_retain(z);
-  cur = z;
-  nf = sz_list_nil();
-  for (i = 0; i < n; i++) {
-    SzList *next_list = sz_list_cons(cur, nf);
-    sz_release(nf);
-    nf = next_list;
-    if (i + 1 < n) {
-      void *next = f(cur, env);
-      sz_release(cur);
-      cur = next;
-    }
-  }
-  sz_release(cur);
-  of = sz_list_reverse(nf);
-  sz_release(nf);
-  s = sz_stream_emits(of);
-  sz_release(of);
-  return s;
+  nb = sz_box_i64(n);
+  pack = sz_pair_new(nb, env);
+  sz_release(nb);
+  return st_new(SZ_ST_ITERATE, z, (void *)f, pack);
 }
 
-#define SZ_UNFOLD_CAP 65536
-
 SzStream *sz_stream_unfold(void *z, SzStreamMapFn f, void *env) {
-  SzList *nf;
-  SzList *of;
-  SzStream *s;
-  void *state;
-  int64_t n;
   if (!f)
     sz_panic("sz_stream_unfold(null fn)");
   sz_retain(z);
-  state = z;
-  nf = sz_list_nil();
-  n = 0;
-  for (;;) {
-    SzList *step = (SzList *)f(state, env);
-    SzPair *p;
-    void *a;
-    void *next;
-    SzList *next_list;
-    if (sz_list_is_empty(step)) {
-      sz_release(step);
-      break;
-    }
-    p = (SzPair *)sz_list_head(step);
-    a = sz_pair_left(p);
-    next = sz_pair_right(p);
-    sz_retain(a);
-    sz_retain(next);
-    next_list = sz_list_cons(a, nf);
-    sz_release(nf);
-    nf = next_list;
-    sz_release(a);
-    sz_release(state);
-    state = next;
-    sz_release(step);
-    n += 1;
-    if (n >= SZ_UNFOLD_CAP)
-      sz_panic("Stream.unfold: did not terminate");
-  }
-  sz_release(state);
-  of = sz_list_reverse(nf);
-  sz_release(nf);
-  s = sz_stream_emits(of);
-  sz_release(of);
-  return s;
+  sz_retain(env);
+  return st_new(SZ_ST_UNFOLD, z, (void *)f, env);
 }
 
 typedef struct StEval {
@@ -411,6 +350,13 @@ static SzIo *dropwhile_into(SzStream *s, SzList *acc, int64_t remain,
                             SzStreamPred pred, void *penv);
 static SzIo *after_or_else(void *acc, void *env);
 static SzIo *after_tap_inner(void *inner_acc, void *env);
+static SzIo *mapconcat_into(SzStream *s, SzList *acc, int64_t remain,
+                            SzStreamMapFn f, void *fenv);
+static SzIo *changes_into(SzStream *s, SzList *acc, int64_t remain, void *prev,
+                          int have);
+static SzIo *flatmap_into(SzStream *s, SzList *acc, int64_t remain,
+                          SzStreamMapFn f, void *fenv);
+static int64_t filter_not_pred(void *v, void *env);
 
 static int64_t remain_dec(int64_t remain) {
   return remain < 0 ? remain : remain - 1;
@@ -464,6 +410,7 @@ static SzIo *after_or_else(void *acc, void *env) {
   int64_t added;
   sz_free(st);
   added = (int64_t)sz_list_len((SzList *)acc) - acc_len;
+  /* Empty left is not a fail. Pull the right stream. */
   if (added > 0)
     return pure_drop(acc);
   return compile_into(right, (SzList *)acc, remain);
@@ -920,7 +867,7 @@ static SzIo *filter_into(SzStream *s, SzList *acc, int64_t remain,
       st->penv = penv;
       st->remain = remain;
       st->acc_len = (int64_t)sz_list_len(acc);
-      return fm_drop(compile_into(s, acc, -1), after_filter, st);
+      return fm_drop(compile_into(s, acc, remain), after_filter, st);
     }
     }
   }
@@ -1057,6 +1004,74 @@ static SzIo *compile_into(SzStream *s, SzList *acc, int64_t remain) {
       s = (SzStream *)s->right;
       remain = remain_dec(remain);
       break;
+    case SZ_ST_RANGE: {
+      int64_t from = (int64_t)(intptr_t)s->env;
+      int64_t until = (int64_t)(intptr_t)s->right;
+      while (from < until && remain != 0) {
+        void *box = sz_box_i64(from);
+        acc = cons_take(box, acc);
+        sz_release(box);
+        from++;
+        remain = remain_dec(remain);
+      }
+      return pure_drop(acc);
+    }
+    case SZ_ST_ITERATE: {
+      SzPair *pack = (SzPair *)s->env;
+      int64_t n = pack ? sz_unbox_i64(pack->left) : 0;
+      void *fenv = pack ? pack->right : NULL;
+      SzStreamMapFn f = (SzStreamMapFn)s->right;
+      void *cur;
+      int64_t i;
+      if (n <= 0)
+        return pure_drop(acc);
+      sz_retain(s->left);
+      cur = s->left;
+      for (i = 0; i < n && remain != 0; i++) {
+        acc = cons_take(cur, acc);
+        remain = remain_dec(remain);
+        if (i + 1 < n && remain != 0) {
+          void *next = f(cur, fenv);
+          sz_release(cur);
+          cur = next;
+        }
+      }
+      sz_release(cur);
+      return pure_drop(acc);
+    }
+    case SZ_ST_UNFOLD: {
+      SzStreamMapFn f = (SzStreamMapFn)s->right;
+      void *state;
+      int64_t steps = 0;
+      sz_retain(s->left);
+      state = s->left;
+      while (remain != 0) {
+        SzList *step = (SzList *)f(state, s->env);
+        SzPair *p;
+        void *a;
+        void *next;
+        if (sz_list_is_empty(step)) {
+          sz_release(step);
+          break;
+        }
+        p = (SzPair *)sz_list_head(step);
+        a = sz_pair_left(p);
+        next = sz_pair_right(p);
+        sz_retain(a);
+        sz_retain(next);
+        sz_release(step);
+        acc = cons_take(a, acc);
+        sz_release(a);
+        sz_release(state);
+        state = next;
+        remain = remain_dec(remain);
+        steps += 1;
+        if (steps >= SZ_UNFOLD_CAP)
+          sz_panic("Stream.unfold: did not terminate");
+      }
+      sz_release(state);
+      return pure_drop(acc);
+    }
     case SZ_ST_EVAL: {
       StEval *st = (StEval *)sz_alloc(sizeof(StEval));
       st->tail = (SzStream *)s->right;
@@ -1118,17 +1133,24 @@ static SzIo *compile_into(SzStream *s, SzList *acc, int64_t remain) {
     case SZ_ST_ZIPIDX:
     case SZ_ST_INTERSPERSE:
     case SZ_ST_GROUPED:
-    case SZ_ST_FLATTEN:
-    case SZ_ST_CHANGES:
     case SZ_ST_SCAN:
-    case SZ_ST_FLATMAP:
-    case SZ_ST_FILTERNOT:
-    case SZ_ST_MAPCONCAT:
     case SZ_ST_SLIDING:
     case SZ_ST_TAKERIGHT:
     case SZ_ST_DROPRIGHT:
     case SZ_ST_FINDLAST:
       return lift_into(s, acc, remain);
+    case SZ_ST_FLATTEN:
+      return mapconcat_into((SzStream *)s->left, acc, remain, NULL, NULL);
+    case SZ_ST_MAPCONCAT:
+      return mapconcat_into((SzStream *)s->left, acc, remain,
+                            (SzStreamMapFn)s->right, s->env);
+    case SZ_ST_CHANGES:
+      return changes_into((SzStream *)s->left, acc, remain, NULL, 0);
+    case SZ_ST_FLATMAP:
+      return flatmap_into((SzStream *)s->left, acc, remain,
+                          (SzStreamMapFn)s->right, s->env);
+    case SZ_ST_FILTERNOT:
+      return filter_into((SzStream *)s->left, acc, remain, filter_not_pred, s);
     case SZ_ST_ZIP:
     case SZ_ST_ZIPWITH:
     case SZ_ST_ZIPALL:
@@ -1342,12 +1364,387 @@ static SzIo *lift_into(SzStream *s, SzList *acc, int64_t remain) {
     int64_t n = (int64_t)(intptr_t)s->env;
     inner_remain = n <= 0 ? 0 : remain + n - 1;
   }
-  if ((s->tag == SZ_ST_TAKERIGHT || s->tag == SZ_ST_DROPRIGHT) && remain >= 0)
+  /* takeRight, dropRight, and findLast need the whole inner stream. */
+  if ((s->tag == SZ_ST_TAKERIGHT || s->tag == SZ_ST_DROPRIGHT ||
+       s->tag == SZ_ST_FINDLAST) &&
+      remain >= 0)
     inner_remain = -1;
   return fm_drop(compile_into((SzStream *)s->left, sz_list_nil(), inner_remain),
                  after_lift, st);
 }
 
+static int64_t filter_not_pred(void *v, void *env) {
+  SzStream *node = (SzStream *)env;
+  SzStreamPred pred = (SzStreamPred)node->right;
+  return pred(v, node->env) == 0;
+}
+
+typedef struct StMc {
+  SzStreamMapFn f;
+  void *fenv;
+  int64_t remain;
+  int64_t acc_len;
+  SzStream *next;
+  SzList *acc;
+} StMc;
+
+static SzList *emit_chunk(SzList *acc, SzList *chunk, int64_t *remain) {
+  SzList *p = chunk;
+  while (!sz_list_is_empty(p) && *remain != 0) {
+    acc = cons_take(sz_list_head(p), acc);
+    p = sz_list_tail(p);
+    *remain = remain_dec(*remain);
+  }
+  return acc;
+}
+
+static SzList *mc_apply(SzList *acc, void *v, SzStreamMapFn f, void *fenv,
+                        int64_t *remain) {
+  SzList *chunk;
+  if (f) {
+    chunk = (SzList *)f(v, fenv);
+    acc = emit_chunk(acc, chunk, remain);
+    sz_release(chunk);
+  } else {
+    acc = emit_chunk(acc, (SzList *)v, remain);
+  }
+  return acc;
+}
+
+static SzIo *after_mc_eval(void *value, void *env) {
+  StMc *st = (StMc *)env;
+  SzList *acc = st->acc;
+  SzStream *next = st->next;
+  int64_t remain = st->remain;
+  SzStreamMapFn f = st->f;
+  void *fenv = st->fenv;
+  sz_free(st);
+  acc = mc_apply(acc, value, f, fenv, &remain);
+  sz_release(value);
+  if (remain == 0)
+    return pure_drop(acc);
+  return mapconcat_into(next, acc, remain, f, fenv);
+}
+
+static SzIo *after_mc_concat(void *acc, void *env) {
+  StMc *st = (StMc *)env;
+  SzStream *right = st->next;
+  int64_t remain = st->remain;
+  int64_t acc_len = st->acc_len;
+  SzStreamMapFn f = st->f;
+  void *fenv = st->fenv;
+  int64_t added;
+  sz_free(st);
+  if (remain >= 0) {
+    added = (int64_t)sz_list_len((SzList *)acc) - acc_len;
+    remain = remain - added;
+    if (remain < 0)
+      remain = 0;
+  }
+  if (remain == 0)
+    return pure_drop(acc);
+  return mapconcat_into(right, (SzList *)acc, remain, f, fenv);
+}
+
+static SzIo *mapconcat_into(SzStream *s, SzList *acc, int64_t remain,
+                            SzStreamMapFn f, void *fenv) {
+  while (s && s->tag != SZ_ST_NIL) {
+    if (remain == 0)
+      return pure_drop(acc);
+    switch (s->tag) {
+    case SZ_ST_TAKE: {
+      int64_t n = (int64_t)(intptr_t)s->env;
+      if (n <= 0)
+        return pure_drop(acc);
+      if (remain < 0 || n < remain)
+        remain = n;
+      s = (SzStream *)s->left;
+      break;
+    }
+    case SZ_ST_CONS:
+      acc = mc_apply(acc, s->left, f, fenv, &remain);
+      s = (SzStream *)s->right;
+      break;
+    case SZ_ST_EVAL: {
+      StMc *st = (StMc *)sz_alloc(sizeof(StMc));
+      st->f = f;
+      st->fenv = fenv;
+      st->remain = remain;
+      st->acc_len = 0;
+      st->next = (SzStream *)s->right;
+      st->acc = acc;
+      return fm_drop((SzIo *)s->left, after_mc_eval, st);
+    }
+    case SZ_ST_CONCAT: {
+      StMc *st = (StMc *)sz_alloc(sizeof(StMc));
+      st->f = f;
+      st->fenv = fenv;
+      st->remain = remain;
+      st->acc_len = (int64_t)sz_list_len(acc);
+      st->next = (SzStream *)s->right;
+      st->acc = acc;
+      return fm_drop(mapconcat_into((SzStream *)s->left, acc, remain, f, fenv),
+                     after_mc_concat, st);
+    }
+    default: {
+      StLift *st = (StLift *)sz_alloc(sizeof(StLift));
+      st->outer = acc;
+      st->remain = remain;
+      st->tag = f ? SZ_ST_MAPCONCAT : SZ_ST_FLATTEN;
+      st->arg = (void *)f;
+      st->env = fenv;
+      return fm_drop(compile_into(s, sz_list_nil(), -1), after_lift, st);
+    }
+    }
+  }
+  return pure_drop(acc);
+}
+
+typedef struct StCh {
+  void *prev;
+  int have;
+  int64_t remain;
+  int64_t acc_len;
+  SzStream *next;
+  SzList *acc;
+} StCh;
+
+static SzIo *after_ch_eval(void *value, void *env) {
+  StCh *st = (StCh *)env;
+  SzList *acc = st->acc;
+  SzStream *next = st->next;
+  int64_t remain = st->remain;
+  void *prev = st->prev;
+  int have = st->have;
+  sz_free(st);
+  if (!have || !sz_ptr_eq(prev, value)) {
+    acc = cons_take(value, acc);
+    prev = value;
+    have = 1;
+    remain = remain_dec(remain);
+  }
+  sz_release(value);
+  if (remain == 0)
+    return pure_drop(acc);
+  return changes_into(next, acc, remain, prev, have);
+}
+
+static SzIo *after_ch_concat(void *acc, void *env) {
+  StCh *st = (StCh *)env;
+  SzStream *right = st->next;
+  int64_t remain = st->remain;
+  int64_t acc_len = st->acc_len;
+  void *prev = st->prev;
+  int have = st->have;
+  int64_t added;
+  sz_free(st);
+  added = (int64_t)sz_list_len((SzList *)acc) - acc_len;
+  if (added > 0) {
+    prev = sz_list_head((SzList *)acc);
+    have = 1;
+  }
+  if (remain >= 0) {
+    remain = remain - added;
+    if (remain < 0)
+      remain = 0;
+  }
+  if (remain == 0)
+    return pure_drop(acc);
+  return changes_into(right, (SzList *)acc, remain, prev, have);
+}
+
+static SzIo *changes_into(SzStream *s, SzList *acc, int64_t remain, void *prev,
+                          int have) {
+  while (s && s->tag != SZ_ST_NIL) {
+    if (remain == 0)
+      return pure_drop(acc);
+    switch (s->tag) {
+    case SZ_ST_TAKE: {
+      int64_t n = (int64_t)(intptr_t)s->env;
+      if (n <= 0)
+        return pure_drop(acc);
+      if (remain < 0 || n < remain)
+        remain = n;
+      s = (SzStream *)s->left;
+      break;
+    }
+    case SZ_ST_CONS:
+      if (!have || !sz_ptr_eq(prev, s->left)) {
+        acc = cons_take(s->left, acc);
+        prev = s->left;
+        have = 1;
+        remain = remain_dec(remain);
+      }
+      s = (SzStream *)s->right;
+      break;
+    case SZ_ST_EVAL: {
+      StCh *st = (StCh *)sz_alloc(sizeof(StCh));
+      st->prev = prev;
+      st->have = have;
+      st->remain = remain;
+      st->acc_len = 0;
+      st->next = (SzStream *)s->right;
+      st->acc = acc;
+      return fm_drop((SzIo *)s->left, after_ch_eval, st);
+    }
+    case SZ_ST_CONCAT: {
+      StCh *st = (StCh *)sz_alloc(sizeof(StCh));
+      st->prev = prev;
+      st->have = have;
+      st->remain = remain;
+      st->acc_len = (int64_t)sz_list_len(acc);
+      st->next = (SzStream *)s->right;
+      st->acc = acc;
+      return fm_drop(changes_into((SzStream *)s->left, acc, remain, prev, have),
+                     after_ch_concat, st);
+    }
+    default: {
+      StLift *st = (StLift *)sz_alloc(sizeof(StLift));
+      st->outer = acc;
+      st->remain = remain;
+      st->tag = SZ_ST_CHANGES;
+      st->arg = NULL;
+      st->env = NULL;
+      return fm_drop(compile_into(s, sz_list_nil(), -1), after_lift, st);
+    }
+    }
+  }
+  return pure_drop(acc);
+}
+
+typedef struct StFp {
+  SzStreamMapFn f;
+  void *fenv;
+  int64_t remain;
+  int64_t acc_len;
+  SzStream *next;
+  SzStream *cur;
+  SzList *acc;
+} StFp;
+
+static SzIo *after_fp_inner(void *acc, void *env) {
+  StFp *st = (StFp *)env;
+  int64_t added = (int64_t)sz_list_len((SzList *)acc) - st->acc_len;
+  SzStream *next = st->next;
+  SzStreamMapFn f = st->f;
+  void *fenv = st->fenv;
+  int64_t remain = st->remain;
+  if (st->cur) {
+    sz_release(st->cur);
+    st->cur = NULL;
+  }
+  sz_free(st);
+  if (remain >= 0) {
+    remain -= added;
+    if (remain < 0)
+      remain = 0;
+  }
+  if (remain == 0)
+    return pure_drop(acc);
+  return flatmap_into(next, (SzList *)acc, remain, f, fenv);
+}
+
+static SzIo *flatmap_one(void *v, SzList *acc, int64_t remain, SzStream *next,
+                         SzStreamMapFn f, void *fenv, int own_v) {
+  StFp *st = (StFp *)sz_alloc(sizeof(StFp));
+  SzStream *inner = (SzStream *)f(v, fenv);
+  if (own_v)
+    sz_release(v);
+  st->f = f;
+  st->fenv = fenv;
+  st->remain = remain;
+  st->acc_len = (int64_t)sz_list_len(acc);
+  st->next = next;
+  st->cur = inner;
+  st->acc = acc;
+  return fm_drop(compile_into(inner, acc, remain), after_fp_inner, st);
+}
+
+static SzIo *after_fp_eval(void *value, void *env) {
+  StFp *st = (StFp *)env;
+  SzList *acc = st->acc;
+  SzStream *next = st->next;
+  int64_t remain = st->remain;
+  SzStreamMapFn f = st->f;
+  void *fenv = st->fenv;
+  sz_free(st);
+  return flatmap_one(value, acc, remain, next, f, fenv, 1);
+}
+
+static SzIo *after_fp_concat(void *acc, void *env) {
+  StFp *st = (StFp *)env;
+  SzStream *right = st->next;
+  int64_t remain = st->remain;
+  int64_t acc_len = st->acc_len;
+  SzStreamMapFn f = st->f;
+  void *fenv = st->fenv;
+  int64_t added;
+  sz_free(st);
+  if (remain >= 0) {
+    added = (int64_t)sz_list_len((SzList *)acc) - acc_len;
+    remain = remain - added;
+    if (remain < 0)
+      remain = 0;
+  }
+  if (remain == 0)
+    return pure_drop(acc);
+  return flatmap_into(right, (SzList *)acc, remain, f, fenv);
+}
+
+static SzIo *flatmap_into(SzStream *s, SzList *acc, int64_t remain,
+                          SzStreamMapFn f, void *fenv) {
+  while (s && s->tag != SZ_ST_NIL) {
+    if (remain == 0)
+      return pure_drop(acc);
+    switch (s->tag) {
+    case SZ_ST_TAKE: {
+      int64_t n = (int64_t)(intptr_t)s->env;
+      if (n <= 0)
+        return pure_drop(acc);
+      if (remain < 0 || n < remain)
+        remain = n;
+      s = (SzStream *)s->left;
+      break;
+    }
+    case SZ_ST_CONS:
+      return flatmap_one(s->left, acc, remain, (SzStream *)s->right, f, fenv, 0);
+    case SZ_ST_EVAL: {
+      StFp *st = (StFp *)sz_alloc(sizeof(StFp));
+      st->f = f;
+      st->fenv = fenv;
+      st->remain = remain;
+      st->acc_len = 0;
+      st->next = (SzStream *)s->right;
+      st->cur = NULL;
+      st->acc = acc;
+      return fm_drop((SzIo *)s->left, after_fp_eval, st);
+    }
+    case SZ_ST_CONCAT: {
+      StFp *st = (StFp *)sz_alloc(sizeof(StFp));
+      st->f = f;
+      st->fenv = fenv;
+      st->remain = remain;
+      st->acc_len = (int64_t)sz_list_len(acc);
+      st->next = (SzStream *)s->right;
+      st->cur = NULL;
+      st->acc = acc;
+      return fm_drop(flatmap_into((SzStream *)s->left, acc, remain, f, fenv),
+                     after_fp_concat, st);
+    }
+    default: {
+      StLift *st = (StLift *)sz_alloc(sizeof(StLift));
+      st->outer = acc;
+      st->remain = remain;
+      st->tag = SZ_ST_FLATMAP;
+      st->arg = (void *)f;
+      st->env = fenv;
+      return fm_drop(compile_into(s, sz_list_nil(), -1), after_lift, st);
+    }
+    }
+  }
+  return pure_drop(acc);
+}
+
 typedef struct StZip {
   SzStream *right;
   SzList *outer;
@@ -1410,6 +1807,7 @@ static SzIo *zip_into(SzStream *s, SzList *acc, int64_t remain) {
   st->extra = s->env;
   {
     int64_t inner_remain = remain;
+    /* Interleave compiles both sides fully. take does not stop a side early. */
     if (s->tag == SZ_ST_INTERLEAVE)
       inner_remain = -1;
     return fm_drop(compile_into((SzStream *)s->left, sz_list_nil(), inner_remain),
@@ -1602,6 +2000,8 @@ static SzIo *reverse_acc(void *acc, void *env) {
 }
 
 static void *st_release_io(void *env) {
+  /* Delay env pins the stream (RC). The thunk stays empty. Last release
+   * is delay_env_drop on that env. */
   (void)env;
   return NULL;
 }
@@ -1648,21 +2048,16 @@ SzIo *sz_stream_exists(SzStream *s, SzStreamPred pred, void *env) {
   return fm_drop(io, exists_from_list, NULL);
 }
 
-static SzIo *forall_from_list(void *list, void *env) {
+static int64_t forall_miss_pred(void *v, void *env) {
   StFilter *st = (StFilter *)env;
-  SzList *xs = (SzList *)list;
-  int64_t ok = 1;
-  SzList *p = xs;
-  while (!sz_list_is_empty(p)) {
-    if (st->pred(sz_list_head(p), st->penv) == 0) {
-      ok = 0;
-      break;
-    }
-    p = sz_list_tail(p);
-  }
-  sz_release(xs);
-  sz_free(st);
-  return pure_drop(sz_box_i64(ok));
+  return st->pred(v, st->penv) == 0;
+}
+
+static SzIo *forall_from_exists(void *box, void *env) {
+  int64_t hit = sz_unbox_i64(box);
+  sz_release(box);
+  sz_free(env);
+  return pure_drop(sz_box_i64(hit ? 0 : 1));
 }
 
 SzIo *sz_stream_forall(SzStream *s, SzStreamPred pred, void *env) {
@@ -1671,7 +2066,8 @@ SzIo *sz_stream_forall(SzStream *s, SzStreamPred pred, void *env) {
   st->penv = env;
   st->remain = 0;
   st->acc_len = 0;
-  return fm_drop(sz_stream_compile_to_list(s), forall_from_list, st);
+  return fm_drop(sz_stream_exists(s, forall_miss_pred, st), forall_from_exists,
+                 st);
 }
 
 static SzIo *fold_from_list(void *list, void *env) {
@@ -1715,7 +2111,10 @@ static SzIo *head_from_list(void *list, void *env) {
 }
 
 SzIo *sz_stream_head(SzStream *s) {
-  return fm_drop(sz_stream_compile_to_list(s), head_from_list, NULL);
+  SzStream *one = sz_stream_take(s, 1);
+  SzIo *io = sz_stream_compile_to_list(one);
+  sz_release(one);
+  return fm_drop(io, head_from_list, NULL);
 }
 
 static SzIo *last_from_list(void *list, void *env) {
diff --git a/crates/runtime/src/sys.c b/crates/runtime/src/sys.c
index b7abe6d2..6d66bc75 100644
--- a/crates/runtime/src/sys.c
+++ b/crates/runtime/src/sys.c
@@ -346,6 +346,7 @@ SzIo *sz_sys_write(SzString *s) {
 }
 
 #define EXEC_CAP (1024 * 1024)
+#define EXEC_FD_MAX 256
 
 typedef struct ExecSt {
   SzString *cmd;
@@ -353,6 +354,7 @@ typedef struct ExecSt {
   int err_fd;
   pid_t pid;
   int status;
+  int overflow;
   char *out_buf;
   size_t out_len;
   size_t out_cap;
@@ -368,14 +370,32 @@ static void exec_close_fd(int *fd) {
   }
 }
 
-static void exec_free(ExecSt *st) {
+static void exec_close_extra_fds(void) {
+  int fd;
+  for (fd = 3; fd < EXEC_FD_MAX; fd++)
+    (void)close(fd);
+}
+
+static void exec_reap_pid(pid_t pid) {
   int status = 0;
+  pid_t w;
+  if (pid <= 0)
+    return;
+  (void)kill(pid, SIGKILL);
+  do {
+    w = waitpid(pid, &status, 0);
+  } while (w < 0 && errno == EINTR);
+}
+
+static void exec_free(ExecSt *st) {
   if (!st)
     return;
   exec_close_fd(&st->out_fd);
   exec_close_fd(&st->err_fd);
-  if (st->pid > 0)
-    (void)waitpid(st->pid, &status, WNOHANG);
+  if (st->pid > 0) {
+    exec_reap_pid(st->pid);
+    st->pid = 0;
+  }
   sz_free(st->out_buf);
   sz_free(st->err_buf);
   st->out_buf = NULL;
@@ -384,6 +404,11 @@ static void exec_free(ExecSt *st) {
   st->cmd = NULL;
 }
 
+static void *exec_cleanup(void *env) {
+  exec_free((ExecSt *)env);
+  return NULL;
+}
+
 static void exec_set_cloexec_nb(int fd) {
   int fl;
   (void)fcntl(fd, F_SETFD, FD_CLOEXEC);
@@ -393,13 +418,14 @@ static void exec_set_cloexec_nb(int fd) {
 }
 
 static int exec_append(char **buf, size_t *len, size_t *cap, const char *src,
-                       size_t n) {
-  size_t room;
-  if (*len >= EXEC_CAP)
+                       size_t n, int *overflow) {
+  if (*len >= EXEC_CAP || n > EXEC_CAP - *len) {
+    if (overflow) {
+      *overflow = 1;
+      return 0;
+    }
     return 1;
-  room = EXEC_CAP - *len;
-  if (n > room)
-    n = room;
+  }
   if (!n)
     return 1;
   if (*len + n + 1 > *cap) {
@@ -422,14 +448,16 @@ static int exec_append(char **buf, size_t *len, size_t *cap, const char *src,
   return 1;
 }
 
-static int exec_drain_fd(int *fd, char **buf, size_t *len, size_t *cap) {
+static int exec_drain_fd(int *fd, char **buf, size_t *len, size_t *cap,
+                         int *overflow) {
   char tmp[4096];
   if (!fd || *fd < 0)
     return 1;
   for (;;) {
     ssize_t n = read(*fd, tmp, sizeof tmp);
     if (n > 0) {
-      exec_append(buf, len, cap, tmp, (size_t)n);
+      if (!exec_append(buf, len, cap, tmp, (size_t)n, overflow))
+        return 0;
       continue;
     }
     if (n == 0) {
@@ -485,6 +513,7 @@ static void *sys_exec_start(void *env) {
       close(out_fds[1]);
     if (err_fds[1] != STDERR_FILENO && err_fds[1] != STDOUT_FILENO)
       close(err_fds[1]);
+    exec_close_extra_fds();
     execl("/bin/sh", "sh", "-c", c, (char *)NULL);
     _exit(127);
   }
@@ -535,9 +564,14 @@ static SzIo *exec_after_poll(void *value, void *env) {
   int status = 0;
   pid_t w = 0;
   (void)value;
-  if (!exec_drain_fd(&st->out_fd, &st->out_buf, &st->out_len, &st->out_cap) ||
-      !exec_drain_fd(&st->err_fd, &st->err_buf, &st->err_len, &st->err_cap))
+  if (!exec_drain_fd(&st->out_fd, &st->out_buf, &st->out_len, &st->out_cap,
+                     &st->overflow) ||
+      !exec_drain_fd(&st->err_fd, &st->err_buf, &st->err_len, &st->err_cap,
+                     &st->overflow)) {
+    if (st->overflow)
+      return sz_io_fail_cstr("Sys.exec: output exceeds 1 MiB");
     return sz_io_fail_cstr("Sys.exec: read failed");
+  }
   if (st->pid > 0) {
     do {
       w = waitpid(st->pid, &status, WNOHANG);
@@ -551,13 +585,10 @@ static SzIo *exec_after_poll(void *value, void *env) {
   if (st->out_fd >= 0 || st->err_fd >= 0)
     return exec_wait_ready(st);
   if (st->pid > 0) {
-    do {
-      w = waitpid(st->pid, &status, 0);
-    } while (w < 0 && errno == EINTR);
+    if (w == 0)
+      return fm_drop(sz_io_sleep_ms(1), exec_after_poll, st);
     if (w < 0)
       return sz_io_fail_cstr("Sys.exec: wait failed");
-    st->status = status;
-    st->pid = 0;
   }
   return unwrap_sys(sys_exec_pack(st, exec_exit_code(st->status)), NULL);
 }
@@ -576,31 +607,13 @@ static SzIo *exec_wait_ready(ExecSt *st) {
   return fm_drop(ready, exec_after_poll, st);
 }
 
-static SzIo *exec_finish(void *code, void *env) {
-  exec_free((ExecSt *)env);
-  return pure_drop(code);
-}
-
-static SzIo *exec_on_err(SzError *err, void *env) {
-  exec_free((ExecSt *)env);
-  return fail_drop(err);
-}
-
 static SzIo *exec_after_start(void *value, void *env) {
   ExecSt *st = (ExecSt *)env;
   SysResult *r = (SysResult *)value;
-  SzIo *io;
   if (!r || r->is_err)
     return unwrap_sys(value, NULL);
   sz_release(r);
-  io = exec_wait_ready(st);
-  return fm_drop(io, exec_finish, st);
-}
-
-static SzIo *exec_keep_pair(void *value, void *env) {
-  (void)value;
-  (void)env;
-  return pure_drop(NULL);
+  return exec_wait_ready(st);
 }
 
 static SzIo *exec_after_kick(void *ignored, void *env) {
@@ -615,10 +628,12 @@ static SzIo *exec_after_kick(void *ignored, void *env) {
   st->err_fd = -1;
   io = fm_drop(sz_io_delay(sys_exec_start, st), exec_after_start, st);
   {
-    SzIo *handled = sz_io_handle_error_with(io, exec_on_err, st);
+    SzIo *fin = sz_io_delay(exec_cleanup, st);
+    SzIo *ens = sz_io_ensure(io, fin);
     sz_release(io);
+    sz_release(fin);
     sz_release(st);
-    return handled;
+    return ens;
   }
 }
 
@@ -630,8 +645,7 @@ static void *sys_proc_dispatch(void *env) {
 static SzIo *sys_after_exec_dispatch(void *value, void *env) {
   SzPair *p = (SzPair *)env;
   if ((intptr_t)value)
-    return fm_drop(sz_io_fail_cstr("Sys.exec: rejected under TestRuntime"),
-                   exec_keep_pair, p);
+    return sz_io_fail_cstr("Sys.exec: rejected under TestRuntime");
   return fm_drop(sz_io_pure(NULL), exec_after_kick, p);
 }
 
@@ -705,7 +719,7 @@ static void child_clear(ChildSlot *c) {
 static int child_drain(ChildSlot *c) {
   if (!c)
     return 1;
-  return exec_drain_fd(&c->out_fd, &c->buf, &c->len, &c->cap);
+  return exec_drain_fd(&c->out_fd, &c->buf, &c->len, &c->cap, NULL);
 }
 
 static void child_gc(void) {
@@ -721,9 +735,10 @@ static void child_gc(void) {
     } while (w < 0 && errno == EINTR);
     if (w == 0)
       continue;
-    if (!child_drain(c))
-      continue;
-    if (c->len == 0 && c->out_fd < 0)
+    (void)child_drain(c);
+    exec_close_fd(&c->in_fd);
+    exec_close_fd(&c->out_fd);
+    if (c->len == 0)
       child_clear(c);
   }
 }
@@ -787,6 +802,7 @@ static void *sys_spawn_result(void *env) {
       close(out_fds[0]);
     if (out_fds[1] != STDOUT_FILENO && out_fds[1] != STDIN_FILENO)
       close(out_fds[1]);
+    exec_close_extra_fds();
     execl("/bin/sh", "sh", "-c", c, (char *)NULL);
     _exit(127);
   }
@@ -808,8 +824,7 @@ static void *sys_spawn_result(void *env) {
 static SzIo *sys_after_spawn_dispatch(void *value, void *env) {
   SzPair *p = (SzPair *)env;
   if ((intptr_t)value)
-    return fm_drop(sz_io_fail_cstr("Sys.spawn: rejected under TestRuntime"),
-                   exec_keep_pair, p);
+    return sz_io_fail_cstr("Sys.spawn: rejected under TestRuntime");
   return fm_drop(sz_io_delay(sys_spawn_result, p), unwrap_sys, NULL);
 }
 
@@ -867,7 +882,20 @@ static void *sys_kill_result(void *env) {
     r->as.err = sz_error_new(3, "Sys.kill: kill failed");
     return r;
   }
-  child_drop_pid((pid_t)pid);
+  {
+    ChildSlot *c = child_find((pid_t)pid);
+    int status = 0;
+    pid_t w = 0;
+    if (c)
+      exec_close_fd(&c->in_fd);
+    if (pid > 0) {
+      do {
+        w = waitpid((pid_t)pid, &status, WNOHANG);
+      } while (w < 0 && errno == EINTR);
+    }
+    if (w > 0 || (w < 0 && errno == ECHILD) || pid <= 0)
+      child_drop_pid((pid_t)pid);
+  }
   return r;
 }
 
@@ -1029,7 +1057,9 @@ static SzIo *child_read_after_try(void *value, void *env) {
     sz_release(r);
     child_gc();
     c = child_find((pid_t)st->pid);
-    if (!c || c->out_fd < 0)
+    if (!c)
+      return sz_io_fail_cstr("Sys.childRead: unknown pid");
+    if (c->out_fd < 0)
       return child_read_pump(NULL, st);
     return fm_drop(sz_io_poll_readable(c->out_fd), child_read_pump, st);
   }
@@ -1043,8 +1073,8 @@ static void *child_read_try(void *env) {
   child_gc();
   c = child_find((pid_t)st->pid);
   if (!c) {
-    r->is_err = 0;
-    r->as.ok = sz_string_from_cstr("");
+    r->is_err = 1;
+    r->as.err = sz_error_new(3, "Sys.childRead: unknown pid");
     return r;
   }
   if (!child_drain(c)) {
diff --git a/crates/runtime/src/testrt.c b/crates/runtime/src/testrt.c
index e2bee6ac..7d8eb308 100644
--- a/crates/runtime/src/testrt.c
+++ b/crates/runtime/src/testrt.c
@@ -59,31 +59,9 @@ static void sz_testrt_fs_install(void) {
 
 int sz_testrt_fs_is_fake(void) { return g_fs_fake; }
 
-static char *norm_path(const char *p) {
-  size_t n;
-  char *out;
-  size_t i, j;
-  if (!p)
-    p = "";
-  /* Strip leading ./ and collapse duplicate slashes; drop trailing slash. */
-  while (p[0] == '.' && p[1] == '/')
-    p += 2;
-  n = strlen(p);
-  out = (char *)sz_alloc(n + 1);
-  j = 0;
-  for (i = 0; i < n; i++) {
-    if (p[i] == '/' && j > 0 && out[j - 1] == '/')
-      continue;
-    out[j++] = p[i];
-  }
-  while (j > 0 && out[j - 1] == '/')
-    j--;
-  out[j] = '\0';
-  /* Map a lone '.' to the root path. */
-  if (strcmp(out, ".") == 0)
-    out[0] = '\0';
-  return out;
-}
+static char *canon_path(const char *p);
+
+static char *norm_path(const char *p) { return canon_path(p); }
 
 static MemNode *fs_find(const char *path) {
   MemNode *n;
@@ -391,10 +369,10 @@ void sz_effect_log(const char *line) {
   sz_timeline_log_cstr(line ? line : "", "");
 }
 
-static void fs_log(const char *op) {
+static void fs_log(const char *op, const char *path) {
   char buf[48];
   snprintf(buf, sizeof buf, "Fs.%s", op);
-  sz_timeline_log_cstr(buf, "");
+  sz_timeline_log_cstr(buf, path ? path : "");
 }
 
 static int fs_fault(BoxResult *r) {
@@ -422,6 +400,11 @@ static void *mem_read(void *env) {
   if (fs_fault(r))
     return r;
   path = norm_path(sz_string_cstr(path_s));
+  if (!path) {
+    r->is_err = 1;
+    r->as.err = sz_error_new(2, "Fs.read: path too deep (mem)");
+    goto done;
+  }
   n = fs_find(path);
   sz_free(path);
   if (!n || n->is_dir) {
@@ -447,12 +430,16 @@ static void *mem_write(void *env) {
   char *path;
   char parent[1024];
   MemNode *n;
-  SzString *c;
-  sz_timeline_log_bytes("Fs.write", contents ? contents->data : "",
-                        contents ? contents->len : 0);
+  SzString *c = contents ? contents : NULL;
+  sz_timeline_log_cstr("Fs.write", path_s ? sz_string_cstr(path_s) : "");
   if (fs_fault(r))
     return r;
   path = norm_path(sz_string_cstr(path_s));
+  if (!path) {
+    r->is_err = 1;
+    r->as.err = sz_error_new(2, "Fs.write: path too deep (mem)");
+    goto done;
+  }
   c = contents ? contents : sz_string_from_cstr("");
 
   if (!parent_path(path, parent, sizeof parent)) {
@@ -539,10 +526,15 @@ static void *mem_list(void *env) {
   MemNode *dir;
   MemNode *n;
   SzList *acc;
-  fs_log("list");
+  fs_log("list", path_s ? sz_string_cstr(path_s) : "");
   if (fs_fault(r))
     return r;
   path = norm_path(sz_string_cstr(path_s));
+  if (!path) {
+    r->is_err = 1;
+    r->as.err = sz_error_new(2, "Fs.list: path too deep (mem)");
+    goto done;
+  }
   dir = fs_find(path);
 
   if (!dir || !dir->is_dir) {
@@ -592,14 +584,20 @@ static void *mem_exists(void *env) {
   BoxResult *r = (BoxResult *)rc_box_zero(sizeof(BoxResult));
   char *path;
   MemNode *n;
-  fs_log("exists");
+  fs_log("exists", path_s ? sz_string_cstr(path_s) : "");
   if (fs_fault(r))
     return r;
   path = norm_path(sz_string_cstr(path_s));
+  if (!path) {
+    r->is_err = 1;
+    r->as.err = sz_error_new(2, "Fs.exists: path too deep (mem)");
+    goto done;
+  }
   n = fs_find(path);
   sz_free(path);
   r->is_err = 0;
   r->as.ok = sz_box_i64(n ? 1 : 0);
+done:
   return r;
 }
 
@@ -636,11 +634,16 @@ static void *mem_delete(void *env) {
   char *path;
   MemNode *n;
   MemNode **pp;
-  fs_log("delete");
+  fs_log("delete", path_s ? sz_string_cstr(path_s) : "");
   if (fs_fault(r))
     return r;
   path = norm_path(sz_string_cstr(path_s));
-  if (!path[0]) {
+  if (!path) {
+    r->is_err = 1;
+    r->as.err = sz_error_new(2, "Fs.delete: path too deep (mem)");
+    goto done;
+  }
+  if (!path[0] || (path[0] == '/' && path[1] == '\0')) {
     sz_free(path);
     r->is_err = 1;
     r->as.err = sz_error_new(2, "Fs.delete: refused root (mem)");
@@ -685,12 +688,20 @@ static void *mem_rename(void *env) {
   MemNode *src;
   MemNode *n;
   size_t from_len;
-  fs_log("rename");
+  fs_log("rename", from_s ? sz_string_cstr(from_s) : "");
   if (fs_fault(r))
     return r;
   from = norm_path(sz_string_cstr(from_s));
   to = norm_path(sz_string_cstr(to_s));
-  if (!from[0] || !to[0]) {
+  if (!from || !to) {
+    sz_free(from);
+    sz_free(to);
+    r->is_err = 1;
+    r->as.err = sz_error_new(2, "Fs.rename: path too deep (mem)");
+    goto done;
+  }
+  if (!from[0] || !to[0] || (from[0] == '/' && from[1] == '\0') ||
+      (to[0] == '/' && to[1] == '\0')) {
     sz_free(from);
     sz_free(to);
     r->is_err = 1;
@@ -773,10 +784,15 @@ static void *mem_walk(void *env) {
   MemNode *n;
   SzList *acc;
   size_t dlen;
-  fs_log("walk");
+  fs_log("walk", path_s ? sz_string_cstr(path_s) : "");
   if (fs_fault(r))
     return r;
   path = norm_path(sz_string_cstr(path_s));
+  if (!path) {
+    r->is_err = 1;
+    r->as.err = sz_error_new(2, "Fs.walk: path too deep (mem)");
+    goto done;
+  }
   dir = fs_find(path);
   if (!dir || !dir->is_dir) {
     sz_free(path);
@@ -828,10 +844,15 @@ static void *mem_mkdirs(void *env) {
   char tmp[1024];
   size_t len;
   size_t i;
-  fs_log("mkdirs");
+  fs_log("mkdirs", path_s ? sz_string_cstr(path_s) : "");
   if (fs_fault(r))
     return r;
   path = norm_path(sz_string_cstr(path_s));
+  if (!path) {
+    r->is_err = 1;
+    r->as.err = sz_error_new(2, "Fs.mkdirs: path too deep (mem)");
+    goto done;
+  }
   len = strlen(path);
 
   if (len == 0) {
@@ -877,53 +898,50 @@ SzIo *sz_testrt_fs_mkdirs(SzString *path) {
 }
 
 static char *canon_path(const char *p) {
-  char *norm = norm_path(p);
   char *parts[256];
   size_t nparts = 0;
   size_t i = 0;
   int abs = 0;
   char *out;
   size_t out_len = 1;
-  if (norm[0] == '/')
+  if (!p)
+    p = "";
+  if (p[0] == '/')
     abs = 1;
-  while (norm[i]) {
+  while (p[i]) {
     size_t start = i;
-    while (norm[i] && norm[i] != '/')
+    while (p[i] && p[i] != '/')
       i++;
     if (i > start) {
       size_t n = i - start;
-      char *seg = (char *)sz_alloc(n + 1);
-      memcpy(seg, norm + start, n);
-      seg[n] = '\0';
-      if (strcmp(seg, ".") == 0) {
-        sz_free(seg);
-      } else if (strcmp(seg, "..") == 0) {
-        sz_free(seg);
+      if (n == 1 && p[start] == '.') {
+        /* skip "." */
+      } else if (n == 2 && p[start] == '.' && p[start + 1] == '.') {
+        /* .. past the virtual root stays at root. */
         if (nparts > 0) {
           sz_free(parts[nparts - 1]);
           nparts--;
         }
       } else if (nparts < 256) {
+        char *seg = (char *)sz_alloc(n + 1);
+        memcpy(seg, p + start, n);
+        seg[n] = '\0';
         parts[nparts++] = seg;
       } else {
-        /* Fail when the path has too many segments. Do not drop extra segments. */
         size_t k;
-        sz_free(seg);
-        sz_free(norm);
         for (k = 0; k < nparts; k++)
           sz_free(parts[k]);
         return NULL;
       }
     }
-    if (norm[i] == '/')
+    if (p[i] == '/')
       i++;
   }
-  sz_free(norm);
   for (i = 0; i < nparts; i++)
     out_len += strlen(parts[i]) + 1;
   out = (char *)sz_alloc(out_len + 2);
   out[0] = '\0';
-  if (abs)
+  if (abs && nparts > 0)
     strcat(out, "/");
   for (i = 0; i < nparts; i++) {
     if (i > 0)
@@ -931,10 +949,6 @@ static char *canon_path(const char *p) {
     strcat(out, parts[i]);
     sz_free(parts[i]);
   }
-  if (abs && nparts == 0) {
-    out[0] = '/';
-    out[1] = '\0';
-  }
   return out;
 }
 
@@ -944,7 +958,7 @@ static void *mem_canonicalize(void *env) {
   BoxResult *r = (BoxResult *)rc_box_zero(sizeof(BoxResult));
   char *path;
   MemNode *n;
-  fs_log("canonicalize");
+  fs_log("canonicalize", path_s ? sz_string_cstr(path_s) : "");
   if (fs_fault(r))
     return r;
   path = canon_path(sz_string_cstr(path_s));
@@ -1538,6 +1552,7 @@ void sz_testrt_net_set_last_serve_body(const char *body) {
 
 enum { FAKE_CAP = 64 };
 enum { FK_TCP = 1, FK_LISTEN = 2, FK_UDP = 3 };
+enum { FAKE_READ_MAX = 1024u * 1024u };
 
 typedef struct FakeDgram {
   char *host;
@@ -1558,10 +1573,12 @@ typedef struct FakeSock {
   size_t len;
   size_t cap;
   SzDeferred *read_wait;
+  size_t read_want;
   SzDeferred *accept_wait;
   int accept_q[16];
   int accept_n;
   FakeDgram *dgrams;
+  FakeDgram *dgrams_tail;
   SzDeferred *recv_wait;
 } FakeSock;
 
@@ -1762,9 +1779,9 @@ static SzNetSock *fake_take_accept(FakeSock *ln) {
   return fake_wrap(srv);
 }
 
-static void fake_deliver_accept(FakeSock *ln, FakeSock *server) {
+static int fake_deliver_accept(FakeSock *ln, FakeSock *server) {
   if (!ln || !server)
-    return;
+    return 0;
   if (ln->accept_wait) {
     SzNetSock *wrap = fake_wrap(server);
     SzDeferred *w = ln->accept_wait;
@@ -1772,11 +1789,12 @@ static void fake_deliver_accept(FakeSock *ln, FakeSock *server) {
     sz_deferred_complete_now(w, wrap);
     sz_release(w);
     sz_release(wrap);
-    return;
+    return 1;
   }
   if (ln->accept_n >= 16)
-    return;
+    return 0;
   ln->accept_q[ln->accept_n++] = server->id;
+  return 1;
 }
 
 static void fake_flush_connects(FakeSock *ln) {
@@ -1790,20 +1808,35 @@ static void fake_flush_connects(FakeSock *ln) {
     *pp = p->next;
     {
       FakeSock *cli = fake_alloc(FK_TCP, ln->port);
-      FakeSock *srv = fake_alloc(FK_TCP, ln->port);
+      FakeSock *srv;
       SzNetSock *wrap;
-      if (!cli || !srv) {
+      if (!cli) {
+        sz_deferred_fail_now(p->wait, sz_error_new(6, "Net.tcpConnect: full"));
+        sz_release(p->wait);
+        sz_free(p);
+        continue;
+      }
+      srv = fake_alloc(FK_TCP, ln->port);
+      if (!srv) {
+        fake_slot_clear(cli);
         sz_deferred_fail_now(p->wait, sz_error_new(6, "Net.tcpConnect: full"));
         sz_release(p->wait);
         sz_free(p);
         continue;
       }
       fake_pair(cli, srv);
+      if (!fake_deliver_accept(ln, srv)) {
+        fake_slot_clear(cli);
+        fake_slot_clear(srv);
+        sz_deferred_fail_now(p->wait, sz_error_new(6, "Net.tcpConnect: connect failed"));
+        sz_release(p->wait);
+        sz_free(p);
+        continue;
+      }
       wrap = fake_wrap(cli);
       sz_deferred_complete_now(p->wait, wrap);
       sz_release(p->wait);
       sz_release(wrap);
-      fake_deliver_accept(ln, srv);
     }
     sz_free(p);
   }
@@ -1830,11 +1863,19 @@ static BoxResult *fake_connect_pair(int64_t port) {
   if (!ln)
     return NULL;
   cli = fake_alloc(FK_TCP, port);
+  if (!cli)
+    return box_err("Net.tcpConnect: connect failed");
   srv = fake_alloc(FK_TCP, port);
-  if (!cli || !srv)
+  if (!srv) {
+    fake_slot_clear(cli);
     return box_err("Net.tcpConnect: connect failed");
+  }
   fake_pair(cli, srv);
-  fake_deliver_accept(ln, srv);
+  if (!fake_deliver_accept(ln, srv)) {
+    fake_slot_clear(cli);
+    fake_slot_clear(srv);
+    return box_err("Net.tcpConnect: connect failed");
+  }
   return box_ok(fake_wrap(cli));
 }
 
@@ -1979,6 +2020,8 @@ static void *tcp_read_now(void *env) {
   if (!f || f->closed)
     return box_err("Net.tcpRead: closed");
   want = op->n > 0 ? (size_t)op->n : 0;
+  if (want > FAKE_READ_MAX)
+    want = FAKE_READ_MAX;
   if (want == 0)
     return box_ok(sz_string_from_cstr(""));
   if (f->len > 0)
@@ -1997,13 +2040,17 @@ static SzIo *after_tcp_read(void *value, void *env) {
   if (!f || f->closed)
     return sz_io_fail_cstr("Net.tcpRead: closed");
   want = op->n > 0 ? (size_t)op->n : 0;
+  if (want > FAKE_READ_MAX)
+    want = FAKE_READ_MAX;
   if (f->len > 0)
     return unwrap_box(box_ok(fake_take(f, want)), NULL);
   d = sz_deferred_make();
   f->read_wait = d;
+  f->read_want = want;
   if (f->len > 0) {
     SzString *got = fake_take(f, want);
     f->read_wait = NULL;
+    f->read_want = 0;
     sz_release(d);
     return pure_drop(got);
   }
@@ -2044,8 +2091,9 @@ static void *tcp_write_now(void *env) {
   if (peer->read_wait) {
     SzDeferred *w = peer->read_wait;
     SzString *got;
-    size_t want = n;
+    size_t want = peer->read_want;
     peer->read_wait = NULL;
+    peer->read_want = 0;
     got = fake_take(peer, want);
     sz_deferred_complete_now(w, got);
     sz_release(w);
@@ -2122,17 +2170,46 @@ typedef struct UdpSendPack {
   int64_t port;
 } UdpSendPack;
 
+static void fake_dgram_push(FakeSock *dst, FakeDgram *d) {
+  d->next = NULL;
+  if (dst->dgrams_tail)
+    dst->dgrams_tail->next = d;
+  else
+    dst->dgrams = d;
+  dst->dgrams_tail = d;
+}
+
+static FakeDgram *fake_dgram_pop(FakeSock *f) {
+  FakeDgram *d = f->dgrams;
+  if (!d)
+    return NULL;
+  f->dgrams = d->next;
+  if (!f->dgrams)
+    f->dgrams_tail = NULL;
+  d->next = NULL;
+  return d;
+}
+
 static void *udp_send_now(void *env) {
   UdpSendPack *p = (UdpSendPack *)env;
   FakeSock *src = p && p->sock ? fake_by_id(p->sock->fake_id) : NULL;
   FakeSock *dst;
   FakeDgram *d;
   const char *data;
+  const char *h;
   size_t n;
+  char canon[64];
+  int fam;
   if (!src || src->kind != FK_UDP || src->closed)
     return box_err("Net.udpSend: closed");
   if (p->port < 1 || p->port > 65535)
     return box_err("Net.udpSend: host must be an IP literal");
+  h = p->host ? sz_string_cstr(p->host) : "";
+  fam = sz_net_host_family(h, canon, sizeof canon);
+  if (!fam)
+    return box_err("Net.udpSend: host must be an IP literal");
+  if (fam == 6)
+    return box_err("Net.udpSend: send failed");
   dst = fake_udp_port(p->port);
   if (!dst)
     return box_err("Net.udpSend: send failed");
@@ -2140,7 +2217,7 @@ static void *udp_send_now(void *env) {
   n = p->data ? (size_t)sz_string_len(p->data) : 0;
   d = (FakeDgram *)sz_alloc(sizeof(FakeDgram));
   memset(d, 0, sizeof(FakeDgram));
-  d->host = dup_cstr("127.0.0.1");
+  d->host = dup_cstr(canon[0] ? canon : "127.0.0.1");
   d->port = src->port;
   d->data = (char *)sz_alloc(n + 1);
   if (n)
@@ -2164,8 +2241,7 @@ static void *udp_send_now(void *env) {
     sz_release(outer);
     fake_dgram_free(d);
   } else {
-    d->next = dst->dgrams;
-    dst->dgrams = d;
+    fake_dgram_push(dst, d);
   }
   return box_ok(NULL);
 }
@@ -2211,8 +2287,7 @@ static void *udp_recv_now(void *env) {
     return box_err("Net.udpRecv: closed");
   if (!f->dgrams)
     return NULL;
-  d = f->dgrams;
-  f->dgrams = d->next;
+  d = fake_dgram_pop(f);
   n = d->len;
   if (p->n > 0 && (size_t)p->n < n)
     n = (size_t)p->n;
@@ -2393,12 +2468,6 @@ void sz_testrt_proc_kill(int64_t pid) {
   }
 }
 
-static void env_copy_host(const char *key) {
-  const char *v = getenv(key);
-  if (v && v[0])
-    sz_testrt_env_set(key, v);
-}
-
 static void free_fake_argv(void) {
   int i;
   if (!g_fake_argv)
@@ -2557,13 +2626,23 @@ SzIo *sz_testrt_sys_read(int64_t n) {
   return io;
 }
 
+/* Drive.testEnv sets these on the process. Copy them into the sealed
+ * map so Sys.getenv can arm kit gates without reading the host map. */
+static void env_seed_drive(void) {
+  static const char *const keys[] = {"SCUZZ_SERVE", "SCUZZ_KIT"};
+  size_t i;
+  const char *v;
+  for (i = 0; i < sizeof keys / sizeof keys[0]; i++) {
+    v = getenv(keys[i]);
+    if (v && v[0])
+      sz_testrt_env_set(keys[i], v);
+  }
+}
+
 static void sz_testrt_sys_install(void) {
   sz_testrt_sys_reset_live();
   g_sys_fake = 1;
-  /* App fixtures the CLI sets. Do not copy PATH/HOME/SCUZZ_TESTRT. */
-  env_copy_host("SCUZZ_TODO_PATH");
-  env_copy_host("SCUZZ_SERVE");
-  env_copy_host("SCUZZ_KIT");
+  env_seed_drive();
 }
 
 int sz_testrt_sys_is_fake(void) { return g_sys_fake; }
@@ -2571,9 +2650,17 @@ int sz_testrt_sys_is_fake(void) { return g_sys_fake; }
 /* --- install / reset ----------------------------------------------------- */
 
 void sz_testrt_install(void) {
+  uint64_t rand_seed = 42;
+  const char *rs;
   fault_arm_from_env();
   sz_testrt_clock_install(1);
-  sz_testrt_random_install(42);
+  rs = getenv("SCUZZ_RAND_SEED");
+  if (rs && rs[0]) {
+    unsigned long long parsed = strtoull(rs, NULL, 10);
+    if (parsed != 0)
+      rand_seed = (uint64_t)parsed;
+  }
+  sz_testrt_random_install(rand_seed);
   sz_testrt_fs_install();
   sz_testrt_net_install();
   sz_testrt_sys_install();
@@ -3138,11 +3225,93 @@ int64_t sz_timeline_replay_signal_int(const char *name) {
   return sep ? (int64_t)atoll(sep + 3) : 0;
 }
 
+static const char *tl_sig_payload(const char *sep) {
+  if (!sep || memcmp(sep, " = ", 3) != 0)
+    return NULL;
+  return sep + 3;
+}
+
+static SzString *tl_parse_quoted_str(const char *sep) {
+  const char *p = tl_sig_payload(sep);
+  char *val = NULL;
+  SzString *out;
+  if (!p || *p != '"')
+    return sz_string_from_cstr("");
+  if (!sz_dump_parse_quoted(p, &val) || !val)
+    return sz_string_from_cstr("");
+  out = sz_string_from_cstr(val);
+  sz_free(val);
+  return out;
+}
+
+static int64_t tl_count_quoted_list(const char *p) {
+  int64_t n = 0;
+  if (!p)
+    return 0;
+  while (*p && *p != ']' && *p != '\n') {
+    while (*p == ' ' || *p == ',')
+      p++;
+    if (*p != '"')
+      break;
+    p = sz_dump_parse_quoted(p, NULL);
+    if (!p)
+      break;
+    n++;
+  }
+  return n;
+}
+
 static int64_t tl_parse_signal_int(const char *dump, const char *name) {
   const char *sep = tl_sig_line(dump, "int", name);
   return sep ? (int64_t)atoll(sep + 3) : 0;
 }
 
+SzString *sz_timeline_replay_signal_str(const char *name) {
+  return tl_parse_quoted_str(tl_sig_line(g_replay_signals, "str", name));
+}
+
+int64_t sz_timeline_replay_signal_list_len(const char *name) {
+  const char *sep = tl_sig_line(g_replay_signals, "list", name);
+  const char *p;
+  if (!sep)
+    return 0;
+  if (memcmp(sep, " = <", 4) == 0)
+    return (int64_t)atoll(sep + 4);
+  if (memcmp(sep, " = [", 4) != 0)
+    return 0;
+  p = sep + 4;
+  return tl_count_quoted_list(p);
+}
+
+SzString *sz_timeline_replay_signal_list_at(const char *name, int64_t index) {
+  const char *sep = tl_sig_line(g_replay_signals, "list", name);
+  const char *p;
+  int64_t i = 0;
+  if (index < 0 || !sep || memcmp(sep, " = [", 4) != 0)
+    return sz_string_from_cstr("");
+  p = sep + 4;
+  while (*p && *p != ']' && *p != '\n') {
+    char *val = NULL;
+    while (*p == ' ' || *p == ',')
+      p++;
+    if (*p != '"')
+      break;
+    p = sz_dump_parse_quoted(p, &val);
+    if (!p) {
+      sz_free(val);
+      break;
+    }
+    if (i == index) {
+      SzString *out = sz_string_from_cstr(val ? val : "");
+      sz_free(val);
+      return out;
+    }
+    sz_free(val);
+    i++;
+  }
+  return sz_string_from_cstr("");
+}
+
 static SzTlState *tl_at(void *tl, int64_t i) {
   SzTimeline *t = (SzTimeline *)tl;
   if (!t || i < 0 || i >= t->n)
@@ -3161,12 +3330,11 @@ int64_t sz_timeline_signal_int(void *tl, int64_t i, SzString *name) {
            : 0;
 }
 
-/* List length from the signals dump: `list[<id>] <name> = ["a", "b"]` holds
- * one quoted string per element (no escaping), so quotes pair per element. */
+/* List length from the signals dump: `list[<id>] <name> = ["a", "b"]`
+ * counts quoted strings with the dump escape dialect. */
 static int64_t tl_parse_signal_list_len(const char *dump, const char *name) {
   const char *sep = tl_sig_line(dump, "list", name);
   const char *p;
-  int64_t quotes = 0;
   if (!sep)
     return 0;
   /* Record lists dump the count only: `list[<id>] <name> = <n>`. */
@@ -3175,12 +3343,7 @@ static int64_t tl_parse_signal_list_len(const char *dump, const char *name) {
   if (memcmp(sep, " = [", 4) != 0)
     return 0;
   p = sep + 4;
-  while (*p && *p != ']' && *p != '\n') {
-    if (*p == '"')
-      quotes += 1;
-    p += 1;
-  }
-  return quotes / 2;
+  return tl_count_quoted_list(p);
 }
 
 int64_t sz_timeline_signal_list_len(void *tl, int64_t i, SzString *name) {
@@ -3190,35 +3353,27 @@ int64_t sz_timeline_signal_list_len(void *tl, int64_t i, SzString *name) {
            : 0;
 }
 
-/* 1 when the `str[<id>] <name> = "<value>"` line in the state's signals dump
- * holds `needle` as a substring, searched from the ` = ` separator so the
- * name cannot false-match. */
+/* 1 when the unescaped `str[<id>] <name> = "<value>"` holds `needle`.
+ * An empty needle is true when the value is empty. */
 int64_t sz_timeline_signal_str_has(void *tl, int64_t i, SzString *name,
                                    SzString *needle) {
-  const char *p;
-  const char *end;
   SzTlState *s = tl_at(tl, i);
   const char *n = needle ? sz_string_cstr(needle) : "";
-  if (!s || !s->signals || !n[0])
+  const char *sep;
+  const char *p;
+  char *val = NULL;
+  int64_t hit = 0;
+  if (!s || !s->signals)
     return 0;
-  p = tl_sig_line(s->signals, "str", name ? sz_string_cstr(name) : "");
-  if (!p)
+  sep = tl_sig_line(s->signals, "str", name ? sz_string_cstr(name) : "");
+  p = tl_sig_payload(sep);
+  if (!p || *p != '"')
     return 0;
-  end = strchr(p, '\n');
-  if (!end)
-    end = p + strlen(p);
-  {
-    size_t len = (size_t)(end - p);
-    size_t m = strlen(n);
-    size_t k;
-    if (m > len)
-      return 0;
-    for (k = 0; k + m <= len; k++) {
-      if (memcmp(p + k, n, m) == 0)
-        return 1;
-    }
-  }
-  return 0;
+  if (!sz_dump_parse_quoted(p, &val) || !val)
+    return 0;
+  hit = !n[0] ? (val[0] == '\0' ? 1 : 0) : (strstr(val, n) != NULL ? 1 : 0);
+  sz_free(val);
+  return hit;
 }
 
 int64_t sz_timeline_a11y_has(void *tl, int64_t i, SzString *needle) {
diff --git a/crates/runtime/src/ui.c b/crates/runtime/src/ui.c
index 15aa60ea..4392c4e1 100644
--- a/crates/runtime/src/ui.c
+++ b/crates/runtime/src/ui.c
@@ -13,6 +13,8 @@
 #include <pthread.h>
 #include <sched.h>
 #include <dlfcn.h>
+#include <unistd.h>
+#include <stdint.h>
 
 static int want_gpu_presenter(void) {
   const char *e = getenv("SCUZZ_SKIA");
@@ -170,6 +172,9 @@ struct SzUiSession {
 static SzUiSession *g_live_session;
 static char *g_pending_title;
 
+static void host_free(char **p);
+static void session_drop_pointer(SzUiSession *session);
+
 static int runtime_kind_ok(SzUiRuntimeKind kind) {
   return kind == SZ_UI_RUNTIME_HEADLESS || kind == SZ_UI_RUNTIME_DESKTOP ||
          kind == SZ_UI_RUNTIME_MOBILE;
@@ -265,6 +270,7 @@ void sz_ui_session_take_root(SzUiSession *session) {
 int sz_ui_session_replace_root(SzUiSession *session, SzView *root) {
   if (!session || !root)
     return 0;
+  session_drop_pointer(session);
   if (session->owns_view)
     sz_view_free(session->root);
   session->root = root;
@@ -273,21 +279,65 @@ int sz_ui_session_replace_root(SzUiSession *session, SzView *root) {
   return 1;
 }
 
-enum { SZ_UI_STAMP_CAP = 4096 };
-
-static char *stamp_snapshot(const char *path) {
+/* Whole-file read for inject playback (prefix-extend). Grows like signal dump. */
+static char *read_file_all(const char *path) {
   FILE *f;
-  char buf[SZ_UI_STAMP_CAP];
+  char *buf = NULL;
+  size_t len = 0, cap = 0;
+  char tmp[4096];
   size_t n;
   if (!path)
     return sz_strdup("");
   f = fopen(path, "rb");
   if (!f)
     return sz_strdup("");
-  n = fread(buf, 1, sizeof(buf) - 1, f);
+  while ((n = fread(tmp, 1, sizeof tmp, f)) > 0) {
+    if (len + n + 1 > cap) {
+      size_t ncap = cap ? cap : 256;
+      char *nb;
+      while (len + n + 1 > ncap)
+        ncap *= 2;
+      nb = (char *)sz_alloc(ncap);
+      if (buf) {
+        memcpy(nb, buf, len);
+        sz_free(buf);
+      }
+      buf = nb;
+      cap = ncap;
+    }
+    memcpy(buf + len, tmp, n);
+    len += n;
+  }
+  fclose(f);
+  if (!buf)
+    return sz_strdup("");
+  buf[len] = '\0';
+  return buf;
+}
+
+/* Small watch stamp: length plus FNV-1a of the whole file. */
+static char *watch_stamp(const char *path) {
+  FILE *f;
+  unsigned char tmp[4096];
+  size_t n, total = 0;
+  uint32_t h = 2166136261u;
+  char out[64];
+  if (!path)
+    return sz_strdup("0:0");
+  f = fopen(path, "rb");
+  if (!f)
+    return sz_strdup("0:0");
+  while ((n = fread(tmp, 1, sizeof tmp, f)) > 0) {
+    size_t i;
+    total += n;
+    for (i = 0; i < n; i++) {
+      h ^= tmp[i];
+      h *= 16777619u;
+    }
+  }
   fclose(f);
-  buf[n] = '\0';
-  return sz_strdup(buf);
+  snprintf(out, sizeof out, "%zu:%08x", total, h);
+  return sz_strdup(out);
 }
 
 static int stamp_changed(SzUiSession *session) {
@@ -295,7 +345,7 @@ static int stamp_changed(SzUiSession *session) {
   int changed;
   if (!session || !session->watch_path)
     return 0;
-  now = stamp_snapshot(session->watch_path);
+  now = watch_stamp(session->watch_path);
   changed = !session->watch_fp || strcmp(session->watch_fp, now) != 0;
   if (changed) {
     sz_free(session->watch_fp);
@@ -322,7 +372,7 @@ int sz_ui_session_watch(SzUiSession *session, const char *path) {
   sz_free(session->watch_path);
   sz_free(session->watch_fp);
   session->watch_path = sz_strdup(path);
-  session->watch_fp = stamp_snapshot(path);
+  session->watch_fp = watch_stamp(path);
   return 1;
 }
 
@@ -344,7 +394,7 @@ int sz_ui_session_set_inject(SzUiSession *session, const char *path) {
   sz_free(session->inject_path);
   sz_free(session->inject_fp);
   session->inject_path = sz_strdup(path);
-  session->inject_fp = stamp_snapshot(path);
+  session->inject_fp = read_file_all(path);
   return 1;
 }
 
@@ -381,26 +431,30 @@ static void fputs_dump_quoted(FILE *f, const char *s) {
 }
 
 /* Editor dump: keep newlines as \\n so a file buffer stays one node. */
-static void fputs_dump_escaped(FILE *f, const char *s) {
+static void fputs_escaped_body(FILE *f, const char *s) {
   const char *p;
-  fputc('"', f);
-  if (s) {
-    for (p = s; *p; p++) {
-      unsigned char c = (unsigned char)*p;
-      if (c == '\\')
-        fputs("\\\\", f);
-      else if (c == '"')
-        fputs("\\\"", f);
-      else if (c == '\n')
-        fputs("\\n", f);
-      else if (c == '\r')
-        fputs("\\r", f);
-      else if (c == '\t')
-        fputs("\\t", f);
-      else
-        fputc(*p, f);
-    }
+  if (!s)
+    return;
+  for (p = s; *p; p++) {
+    unsigned char c = (unsigned char)*p;
+    if (c == '\\')
+      fputs("\\\\", f);
+    else if (c == '"')
+      fputs("\\\"", f);
+    else if (c == '\n')
+      fputs("\\n", f);
+    else if (c == '\r')
+      fputs("\\r", f);
+    else if (c == '\t')
+      fputs("\\t", f);
+    else
+      fputc(*p, f);
   }
+}
+
+static void fputs_dump_escaped(FILE *f, const char *s) {
+  fputc('"', f);
+  fputs_escaped_body(f, s);
   fputc('"', f);
 }
 
@@ -671,16 +725,22 @@ int sz_ui_session_load_code(SzUiSession *session, const char *path) {
   if (snprintf(staged, sizeof staged, "%s.load-%d", path, session->code_gen) >=
       (int)sizeof staged)
     return 0;
-  if (!copy_file(path, staged))
+  if (!copy_file(path, staged)) {
+    unlink(staged);
     return 0;
+  }
   h = dlopen(staged, RTLD_NOW | RTLD_LOCAL);
-  if (!h)
+  if (!h) {
+    unlink(staged);
     return 0;
+  }
   fn = (SzUiRebuildFn)dlsym(h, "sz_ui_reload_rebuild");
   if (!fn) {
     dlclose(h);
+    unlink(staged);
     return 0;
   }
+  unlink(staged);
   session->code_stale = session->code_handle;
   session->code_handle = h;
   session->rebuild = fn;
@@ -749,11 +809,31 @@ static void host_free(char **p) {
   *p = NULL;
 }
 
+static void session_drop_pointer(SzUiSession *session) {
+  if (!session)
+    return;
+  session->pointer_down = 0;
+  session->pointer_button = 0;
+  session->pointer_scroll = NULL;
+  session->pointer_slider = NULL;
+  session->pointer_field = NULL;
+  session->hover_seen = 0;
+  host_free(&session->hover_desc);
+  session->last_hit_seen = 0;
+  host_free(&session->last_hit_desc);
+  session->last_secondary_seen = 0;
+  host_free(&session->last_secondary_desc);
+  host_free(&session->record_hover_desc);
+  if (session->root)
+    sz_view_clear_hover(session->root);
+}
+
 void sz_ui_unmount(SzUiSession *session) {
   if (!session)
     return;
   if (g_live_session == session)
     g_live_session = NULL;
+  session_drop_pointer(session);
   sz_ui_bridge_flush(session);
   pthread_mutex_destroy(&session->bridge_lock);
   if (session->cfg.kind == SZ_UI_RUNTIME_DESKTOP)
@@ -1128,9 +1208,11 @@ static void record_clipboard_verb(SzUiSession *session, int op) {
     fputs("copy\n", f);
   else if (op == 2)
     fputs("cut\n", f);
-  else if (session->clipboard && session->clipboard[0])
-    fprintf(f, "paste %s\n", session->clipboard);
-  else
+  else if (session->clipboard && session->clipboard[0]) {
+    fputs("paste ", f);
+    fputs_escaped_body(f, session->clipboard);
+    fputc('\n', f);
+  } else
     fputs("paste\n", f);
   fclose(f);
 }
@@ -1171,15 +1253,20 @@ static void record_live_event(SzUiSession *session, const SzInputEvent *ev) {
     if (!clipboard_chord(ev->key, ev->key_mods))
       record_key_line(f, ev);
   } else if (ev->kind == SZ_INPUT_COMPOSE) {
-    if (ev->text && ev->text[0])
-      fprintf(f, "compose %s\n", ev->text);
-    else
+    if (ev->text && ev->text[0]) {
+      fputs("compose ", f);
+      fputs_escaped_body(f, ev->text);
+      fputc('\n', f);
+    } else
       fputs("commit\n", f);
   } else if (ev->kind == SZ_INPUT_TEXT_EDIT) {
     if (!ev->text || !ev->text[0])
       fputs("backspace\n", f);
-    else
-      fprintf(f, "type %s\n", ev->text);
+    else {
+      fputs("type ", f);
+      fputs_escaped_body(f, ev->text);
+      fputc('\n', f);
+    }
   } else if (ev->kind == SZ_INPUT_POINTER &&
              ev->pointer_phase == SZ_POINTER_MOVE && !session->pointer_down) {
     SzView *tip;
@@ -1279,7 +1366,7 @@ static int take_inject(SzUiSession *session, char **out) {
   if (!session || !session->inject_path || !out)
     return 0;
   *out = NULL;
-  now = stamp_snapshot(session->inject_path);
+  now = read_file_all(session->inject_path);
   if (session->inject_fp && strcmp(session->inject_fp, now) == 0) {
     sz_free(now);
     return 0;
diff --git a/crates/runtime/src/ui_script.c b/crates/runtime/src/ui_script.c
index 0afcce86..939e079f 100644
--- a/crates/runtime/src/ui_script.c
+++ b/crates/runtime/src/ui_script.c
@@ -1,6 +1,7 @@
 #include "ui_script.h"
 
 #include "scuzz_rt.h"
+#include "rt_util.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -506,7 +507,9 @@ static void play_script_line(SzUiSession *session, char *line) {
   } else if (strncmp(line, "type ", 5) == 0 || strcmp(line, "type") == 0) {
     int idx;
     const char *payload = script_field_payload(len > 4 ? line + 5 : "", &idx);
-    script_type(session, idx, payload);
+    char *raw = sz_dump_unescape(payload);
+    script_type(session, idx, raw);
+    sz_free(raw);
   } else if (strncmp(line, "key ", 4) == 0 || strcmp(line, "key") == 0) {
     const char *rest = len > 3 ? line + 4 : "";
     char token[96];
@@ -528,9 +531,12 @@ static void play_script_line(SzUiSession *session, char *line) {
     script_key(session, name, text, mods, repeat);
   } else if (strncmp(line, "compose ", 8) == 0 || strcmp(line, "compose") == 0) {
     const char *rest = len > 7 ? line + 8 : "";
+    char *raw;
     while (*rest == ' ')
       rest++;
-    script_compose(session, rest);
+    raw = sz_dump_unescape(rest);
+    script_compose(session, raw);
+    sz_free(raw);
   } else if (strcmp(line, "commit") == 0) {
     script_compose(session, "");
   } else if (strncmp(line, "caret ", 6) == 0 || strcmp(line, "caret") == 0) {
@@ -559,10 +565,16 @@ static void play_script_line(SzUiSession *session, char *line) {
       fprintf(stderr, "scuzz: script cut skipped (no text field)\n");
   } else if (strncmp(line, "paste ", 6) == 0 || strcmp(line, "paste") == 0) {
     const char *payload = NULL;
+    char *raw = NULL;
     if (len > 6 && line[5] == ' ' && line[6])
       payload = line + 6;
+    if (payload) {
+      raw = sz_dump_unescape(payload);
+      payload = raw;
+    }
     if (!sz_ui_session_paste(session, payload))
       fprintf(stderr, "scuzz: script paste skipped (no text field)\n");
+    sz_free(raw);
   } else if (strncmp(line, "drag ", 5) == 0) {
     float x1 = 0.f, y1 = 0.f, x2 = 0.f, y2 = 0.f;
     if (sscanf(line + 5, "%f %f %f %f", &x1, &y1, &x2, &y2) == 4)
diff --git a/crates/runtime/src/view.c b/crates/runtime/src/view.c
index f7060d19..9cdaa8bc 100644
--- a/crates/runtime/src/view.c
+++ b/crates/runtime/src/view.c
@@ -55,7 +55,7 @@ struct SzView {
 
   /* View.each: rebuild children from Signal.list at layout (pull). */
   SzSignalList *each_sig;
-  SzList *each_seen; /* last synced list pointer (not owned) */
+  SzList *each_seen; /* last synced list (retained; sentinel 1 = never synced) */
   SzViewEachFn each_fn;
   void *each_env;
 
@@ -1090,9 +1090,9 @@ static const char *a11y_role_name(SzA11yRole role) {
   }
 }
 
-static void a11y_dump_node(SzView *v, char *buf, size_t cap, size_t *len) {
+static void a11y_dump_node(SzView *v, char **buf, size_t *len, size_t *cap) {
   int i;
-  if (!v || !buf || !len || !view_is_shown(v))
+  if (!v || !buf || !len || !cap || !view_is_shown(v))
     return;
   if (v->kind == SZ_VIEW_EXCLUDE_SEMANTICS)
     return;
@@ -1100,7 +1100,6 @@ static void a11y_dump_node(SzView *v, char *buf, size_t cap, size_t *len) {
     char line[256];
     char live[256];
     const char *label = v->a11y_label ? v->a11y_label : "";
-    int n;
     if (v->kind == SZ_VIEW_TEXT && (v->sig_int || v->sig_str)) {
       resolve_text(v, live, sizeof live);
       label = live;
@@ -1156,13 +1155,9 @@ static void a11y_dump_node(SzView *v, char *buf, size_t cap, size_t *len) {
       snprintf(live, sizeof live, "%d", view_overlay_open(v) ? 1 : 0);
       label = live;
     }
-    n = snprintf(line, sizeof line, "%s:%s\n", a11y_role_name(v->a11y_role),
-                 label);
-    if (n > 0 && *len + (size_t)n < cap) {
-      memcpy(buf + *len, line, (size_t)n);
-      *len += (size_t)n;
-      buf[*len] = '\0';
-    }
+    snprintf(line, sizeof line, "%s:%s\n", a11y_role_name(v->a11y_role),
+             label);
+    sz_dump_append(buf, len, cap, line);
   }
   if (v->kind == SZ_VIEW_MERGE_SEMANTICS)
     return;
@@ -1173,15 +1168,18 @@ static void a11y_dump_node(SzView *v, char *buf, size_t cap, size_t *len) {
   if (v->kind == SZ_VIEW_OVERLAY && !view_overlay_open(v))
     return;
   for (i = 0; i < v->child_count; i++)
-    a11y_dump_node(v->children[i], buf, cap, len);
+    a11y_dump_node(v->children[i], buf, len, cap);
 }
 
 SzString *sz_view_a11y_dump(SzView *root) {
-  char buf[4096];
-  size_t len = 0;
-  buf[0] = '\0';
-  a11y_dump_node(root, buf, sizeof buf, &len);
-  return sz_string_from_cstr(buf);
+  char *buf = NULL;
+  size_t len = 0, cap = 0;
+  SzString *out;
+  sz_dump_append(&buf, &len, &cap, "");
+  a11y_dump_node(root, &buf, &len, &cap);
+  out = sz_string_from_cstr(buf);
+  sz_free(buf);
+  return out;
 }
 
 SzView *sz_view_column(void) { return view_new(SZ_VIEW_COLUMN); }
@@ -1217,6 +1215,20 @@ SzView *sz_view_each_map(SzSignalList *sig, SzViewEachFn fn, void *env) {
   return v;
 }
 
+static int each_seen_is_sentinel(SzList *p) {
+  return p == (SzList *)(uintptr_t)1;
+}
+
+static void each_seen_set(SzView *v, SzList *xs) {
+  if (!v)
+    return;
+  if (v->each_seen && !each_seen_is_sentinel(v->each_seen))
+    sz_release(v->each_seen);
+  if (xs)
+    sz_retain(xs);
+  v->each_seen = xs;
+}
+
 static void sync_each(SzView *v) {
   SzList *xs;
   SzList *p;
@@ -1240,7 +1252,7 @@ static void sync_each(SzView *v) {
       sz_view_add_child(v, sz_view_text("- <item>"));
     }
   }
-  v->each_seen = xs;
+  each_seen_set(v, xs);
 }
 
 SzView *sz_view_scroll(SzView *child) {
@@ -1523,6 +1535,9 @@ void sz_view_free(SzView *view) {
   view->tap_env = NULL;
   sz_release(view->each_env);
   view->each_env = NULL;
+  if (view->each_seen && view->each_seen != (SzList *)(uintptr_t)1)
+    sz_release(view->each_seen);
+  view->each_seen = NULL;
   {
     int u;
     for (u = 0; u < view->undo_n; u++)
@@ -3702,11 +3717,6 @@ static void paint_ring_frac(SkCanvas *c, SzRect f, float t, float frac,
 static void paint_string(SkCanvas *c, const char *s, float x, float y,
                          uint32_t argb, float font_px) {
   SkPaint *p;
-  if (g_clip_on) {
-    if (x >= g_clip.x + g_clip.w || y < g_clip.y ||
-        y - font_px > g_clip.y + g_clip.h)
-      return;
-  }
   p = sk_paint_new();
   if (!p)
     return;
@@ -3719,11 +3729,6 @@ static void paint_string(SkCanvas *c, const char *s, float x, float y,
 static void paint_mono_string(SkCanvas *c, const char *s, float x, float y,
                               uint32_t argb, float font_px) {
   SkPaint *p;
-  if (g_clip_on) {
-    if (x >= g_clip.x + g_clip.w || y < g_clip.y ||
-        y - font_px > g_clip.y + g_clip.h)
-      return;
-  }
   p = sk_paint_new();
   if (!p)
     return;
@@ -4040,8 +4045,11 @@ static void paint_children_clipped(SzView *v, SkCanvas *c, const SzTheme *theme)
     g_clip = v->frame;
     g_clip_on = 1;
   }
+  sk_canvas_save(c);
+  sk_canvas_clip_rect(c, v->frame.x, v->frame.y, v->frame.w, v->frame.h);
   for (i = 0; i < v->child_count; i++)
     paint_node(v->children[i], c, theme);
+  sk_canvas_restore(c);
   g_clip = prev;
   g_clip_on = prev_on;
 }
@@ -4698,6 +4706,8 @@ static void paint_node(SzView *v, SkCanvas *c, const SzTheme *theme) {
       g_clip = v->frame;
       g_clip_on = 1;
     }
+    sk_canvas_save(c);
+    sk_canvas_clip_rect(c, v->frame.x, v->frame.y, v->frame.w, v->frame.h);
     paint_rect(c, v->frame.x, v->frame.y, v->frame.w, v->frame.h, theme->surface);
     if (gutter > 0.f)
       paint_rect(c, v->frame.x, v->frame.y, gutter, v->frame.h, theme->background);
@@ -4826,6 +4836,7 @@ static void paint_node(SzView *v, SkCanvas *c, const SzTheme *theme) {
       if (caret.w > 0.f)
         paint_rect(c, caret.x, caret.y, caret.w, caret.h, theme->primary);
     }
+    sk_canvas_restore(c);
     g_clip = prev_clip;
     g_clip_on = prev_on;
     break;
diff --git a/crates/runtime/tests/test_io.c b/crates/runtime/tests/test_io.c
index e9981a25..ee755729 100644
--- a/crates/runtime/tests/test_io.c
+++ b/crates/runtime/tests/test_io.c
@@ -1,4 +1,8 @@
+#define _DEFAULT_SOURCE
 #define _POSIX_C_SOURCE 200809L
+#if defined(__APPLE__)
+#define _DARWIN_C_SOURCE
+#endif
 #include "scuzz_rt.h"
 
 #include <arpa/inet.h>
@@ -12,6 +16,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <dirent.h>
 #include <sys/socket.h>
 #include <sys/wait.h>
 #include <time.h>
@@ -19,6 +24,13 @@
 
 static SzIo *pure_drop(void *value);
 
+static SzString *test_list_join(SzList *xs, const char *sep) {
+  SzString *s = sz_string_from_cstr(sep ? sep : "");
+  SzString *out = sz_list_join(xs, s);
+  sz_release(s);
+  return out;
+}
+
 static void sleep_us(long us) {
   struct timespec ts;
   if (us <= 0)
@@ -28,6 +40,92 @@ static void sleep_us(long us) {
   nanosleep(&ts, NULL);
 }
 
+static int pid_is_zombie(pid_t pid) {
+#ifdef __linux__
+  char path[64];
+  char buf[512];
+  FILE *f;
+  char *rp;
+  if (pid <= 0)
+    return 0;
+  snprintf(path, sizeof path, "/proc/%d/stat", (int)pid);
+  f = fopen(path, "r");
+  if (!f)
+    return 0;
+  if (!fgets(buf, (int)sizeof buf, f)) {
+    fclose(f);
+    return 0;
+  }
+  fclose(f);
+  rp = strrchr(buf, ')');
+  return rp && rp[1] == ' ' && rp[2] == 'Z';
+#else
+  (void)pid;
+  return 0;
+#endif
+}
+
+#ifdef __linux__
+static int kill_reap_sleep_children(void) {
+  DIR *d;
+  struct dirent *ent;
+  pid_t self = getpid();
+  int killed = 0;
+  d = opendir("/proc");
+  if (!d)
+    return 0;
+  while ((ent = readdir(d))) {
+    pid_t pid;
+    char path[64];
+    char buf[512];
+    char line[256];
+    FILE *f;
+    char *rp;
+    int ppid = 0;
+    size_t n;
+    size_t i;
+    if (ent->d_name[0] < '0' || ent->d_name[0] > '9')
+      continue;
+    pid = (pid_t)atoi(ent->d_name);
+    if (pid <= 0 || pid == self)
+      continue;
+    snprintf(path, sizeof path, "/proc/%d/stat", (int)pid);
+    f = fopen(path, "r");
+    if (!f)
+      continue;
+    if (!fgets(buf, (int)sizeof buf, f)) {
+      fclose(f);
+      continue;
+    }
+    fclose(f);
+    rp = strrchr(buf, ')');
+    if (!rp || sscanf(rp + 2, "%*c %d", &ppid) != 1 || ppid != (int)self)
+      continue;
+    snprintf(path, sizeof path, "/proc/%d/cmdline", (int)pid);
+    f = fopen(path, "r");
+    if (!f)
+      continue;
+    n = fread(line, 1, sizeof line - 1, f);
+    fclose(f);
+    line[n] = '\0';
+    for (i = 0; i < n; i++) {
+      if (line[i] == '\0')
+        line[i] = ' ';
+    }
+    if (!strstr(line, "sleep"))
+      continue;
+    (void)kill(pid, SIGKILL);
+    {
+      int st = 0;
+      (void)waitpid(pid, &st, 0);
+    }
+    killed++;
+  }
+  closedir(d);
+  return killed;
+}
+#endif
+
 static uint16_t test_rd16(const uint8_t *p) {
   return (uint16_t)(((uint16_t)p[0] << 8) | p[1]);
 }
@@ -295,6 +393,32 @@ static void *stream_list_dup(void *v, void *env) {
   return two;
 }
 
+static void *stream_list_keep(void *v, void *env) {
+  SzList *nil;
+  SzList *one;
+  (void)env;
+  if (sz_string_len((SzString *)v) == 0)
+    return sz_list_nil();
+  nil = sz_list_nil();
+  one = sz_list_cons(v, nil);
+  sz_release(nil);
+  return one;
+}
+
+static void *stream_emit_keep(void *v, void *env) {
+  (void)env;
+  if (sz_string_len((SzString *)v) == 0)
+    return sz_stream_nil();
+  return sz_stream_emit(v);
+}
+
+static int iterate_calls = 0;
+static void *stream_inc_count(void *v, void *env) {
+  (void)env;
+  iterate_calls++;
+  return sz_box_i64(sz_unbox_i64(v) + 1);
+}
+
 static void *stream_zip_concat(void *pack, void *env) {
   SzPair *p = (SzPair *)pack;
   (void)env;
@@ -1866,6 +1990,14 @@ static void json_expect_stringify_err(SzAdt *j) {
   sz_release(j);
 }
 
+static void expect_fs_refused_root(const char *path) {
+  SzIoResult r = sz_io_unsafe_run(sz_fs_delete(sz_string_from_cstr(path)));
+  assert(!r.ok);
+  assert(r.error != NULL);
+  assert(strstr(sz_string_cstr(r.error->message), "refused root") != NULL);
+  sz_error_free(r.error);
+}
+
 int main(void) {
   /* List.head_opt: None on empty, Some payload on a cell. C List.head still panics. */
   {
@@ -3228,6 +3360,20 @@ int main(void) {
       sz_error_free(r.error);
       sz_deferred_free(d3);
     }
+    {
+      size_t kb0 = 0, kc0 = 0, kb1 = 0, kc1 = 0;
+      SzDeferred *dc;
+      sz_alloc_kind_stats(SZ_RC_DEFERRED, &kb0, &kc0);
+      dc = sz_deferred_make();
+      r = sz_io_unsafe_run(fm_drop(
+          fork_drop(sz_deferred_get(dc)), fiber_interrupt_then_join, NULL));
+      assert(r.ok);
+      sz_deferred_free(dc);
+      sz_alloc_kind_stats(SZ_RC_DEFERRED, &kb1, &kc1);
+      assert(kc1 == kc0);
+      (void)kb0;
+      (void)kb1;
+    }
     sz_deferred_free(def);
   }
 
@@ -3980,7 +4126,7 @@ int main(void) {
         sz_stream_eval(pure_drop(sz_string_from_cstr("c"))));
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    SzString *    joined = sz_list_join((SzList *)r.value, ",");
+    SzString *    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a!,b!,c") == 0);
 
     r = sz_io_unsafe_run(sz_stream_drain(sz_stream_emit(sz_string_from_cstr("d"))));
@@ -3993,7 +4139,7 @@ int main(void) {
     r = sz_io_unsafe_run(
         sz_stream_compile_to_list(sz_stream_take(sz_stream_emits(xs), 2)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
 
     delay_calls = 0;
@@ -4003,7 +4149,7 @@ int main(void) {
         1);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
     assert(delay_calls == 1);
 
@@ -4014,7 +4160,7 @@ int main(void) {
     r = sz_io_unsafe_run(
         sz_stream_compile_to_list(sz_stream_drop(sz_stream_emits(xs), 1)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "b,c") == 0);
 
     delay_calls = 0;
@@ -4024,7 +4170,7 @@ int main(void) {
         1);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "b") == 0);
     assert(delay_calls == 2);
 
@@ -4035,7 +4181,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_filter(sz_stream_emits(xs), stream_nonempty, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
 
     delay_calls = 0;
@@ -4047,7 +4193,7 @@ int main(void) {
         stream_nonempty, NULL);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
     assert(delay_calls == 3);
 
@@ -4063,7 +4209,7 @@ int main(void) {
         1);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
     assert(delay_calls == 1);
 
@@ -4073,7 +4219,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_map(sz_stream_emits(xs), stream_bang_sync, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a!,b!") == 0);
 
     delay_calls = 0;
@@ -4085,7 +4231,7 @@ int main(void) {
         1);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a!") == 0);
     assert(delay_calls == 1);
 
@@ -4098,7 +4244,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_takewhile(sz_stream_emits(xs), stream_nonempty, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
 
     delay_calls = 0;
@@ -4110,7 +4256,7 @@ int main(void) {
         stream_nonempty, NULL);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
     assert(delay_calls == 2);
 
@@ -4123,7 +4269,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_dropwhile(sz_stream_emits(xs), stream_empty, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
 
     delay_calls = 0;
@@ -4135,7 +4281,7 @@ int main(void) {
         stream_empty, NULL);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
     assert(delay_calls == 3);
 
@@ -4151,7 +4297,7 @@ int main(void) {
         1);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
     assert(delay_calls == 2);
 
@@ -4162,7 +4308,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_find(sz_stream_emits(xs), stream_nonempty, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
 
     xs = sz_list_cons(sz_string_from_cstr(""),
@@ -4190,7 +4336,7 @@ int main(void) {
         stream_nonempty, NULL);
     r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
     assert(delay_calls == 2);
 
@@ -4233,7 +4379,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_intersperse(sz_stream_emits(xs), sz_string_from_cstr("|"))));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,|,b") == 0);
 
     xs = sz_list_cons(
@@ -4244,7 +4390,7 @@ int main(void) {
         sz_stream_grouped(sz_stream_emits(xs), 2)));
     assert(r.ok);
     assert(sz_list_len((SzList *)r.value) == 2);
-    joined = sz_list_join((SzList *)sz_list_head((SzList *)r.value), "");
+    joined = test_list_join((SzList *)sz_list_head((SzList *)r.value), "");
     assert(strcmp(sz_string_cstr(joined), "ab") == 0);
 
     r = sz_io_unsafe_run(sz_stream_compile_to_list(sz_stream_range(3, 6)));
@@ -4252,11 +4398,27 @@ int main(void) {
     assert(sz_list_len((SzList *)r.value) == 3);
     assert(sz_unbox_i64(sz_list_head((SzList *)r.value)) == 3);
 
+    {
+      size_t base_bytes = 0, base_count = 0;
+      size_t live_bytes = 0, live_count = 0;
+      SzStream *rng;
+      sz_alloc_stats(&base_bytes, &base_count);
+      rng = sz_stream_range(0, 1000000);
+      sz_alloc_stats(&live_bytes, &live_count);
+      assert(live_count - base_count <= 4);
+      r = sz_io_unsafe_run(
+          sz_stream_compile_to_list(sz_stream_take(rng, 1)));
+      assert(r.ok);
+      assert(sz_list_len((SzList *)r.value) == 1);
+      assert(sz_unbox_i64(sz_list_head((SzList *)r.value)) == 0);
+      sz_release(rng);
+    }
+
     xs = sz_list_cons(sz_string_from_cstr("x"), sz_list_nil());
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_repeat_n(sz_stream_emits(xs), 3)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "x,x,x") == 0);
 
     {
@@ -4281,7 +4443,7 @@ int main(void) {
       r = sz_io_unsafe_run(sz_stream_compile_to_list(
           sz_stream_interleave(sz_stream_emits(as), sz_stream_emits(bs))));
       assert(r.ok);
-      joined = sz_list_join((SzList *)r.value, ",");
+      joined = test_list_join((SzList *)r.value, ",");
       assert(strcmp(sz_string_cstr(joined), "a,b,c") == 0);
     }
 
@@ -4296,7 +4458,7 @@ int main(void) {
       r = sz_io_unsafe_run(sz_stream_compile_to_list(
           sz_stream_interleave(sz_stream_emits(as), sz_stream_emits(bs))));
       assert(r.ok);
-      joined = sz_list_join((SzList *)r.value, ",");
+      joined = test_list_join((SzList *)r.value, ",");
       assert(strcmp(sz_string_cstr(joined), "a,b,c,d,e") == 0);
     }
 
@@ -4306,7 +4468,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_flatmap(sz_stream_emits(xs), stream_dup, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,a,b,b") == 0);
 
     {
@@ -4318,7 +4480,7 @@ int main(void) {
       r = sz_io_unsafe_run(sz_stream_compile_to_list(
           sz_stream_flatten(sz_stream_emits(nested))));
       assert(r.ok);
-      joined = sz_list_join((SzList *)r.value, ",");
+      joined = test_list_join((SzList *)r.value, ",");
       assert(strcmp(sz_string_cstr(joined), "a,b,c") == 0);
     }
 
@@ -4329,7 +4491,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_changes(sz_stream_emits(xs))));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
 
     xs = sz_list_cons(
@@ -4339,7 +4501,7 @@ int main(void) {
         sz_stream_emits(xs), sz_string_from_cstr(""), stream_scan_concat,
         NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), ",a,ab") == 0);
 
     xs = sz_list_cons(
@@ -4364,6 +4526,15 @@ int main(void) {
     assert(r.ok);
     assert(sz_unbox_i64(r.value) == 0);
 
+    delay_calls = 0;
+    r = sz_io_unsafe_run(sz_stream_forall(
+        sz_stream_concat(sz_stream_eval(sz_io_delay(take_hit, (void *)"")),
+                         sz_stream_eval(sz_io_delay(take_hit, (void *)"a"))),
+        stream_nonempty, NULL));
+    assert(r.ok);
+    assert(sz_unbox_i64(r.value) == 0);
+    assert(delay_calls == 1);
+
     r = sz_io_unsafe_run(sz_stream_compile_to_list(sz_stream_range(5, 5)));
     assert(r.ok);
     assert(sz_list_is_empty((SzList *)r.value));
@@ -4391,13 +4562,13 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(sz_stream_interleave(
         sz_stream_nil(), sz_stream_emit(sz_string_from_cstr("a")))));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
 
     r = sz_io_unsafe_run(sz_stream_compile_to_list(sz_stream_interleave(
         sz_stream_emit(sz_string_from_cstr("a")), sz_stream_nil())));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
 
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
@@ -4411,7 +4582,7 @@ int main(void) {
                                                             sz_list_nil())))),
                        3)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b,c") == 0);
 
     r = sz_io_unsafe_run(sz_stream_fold(sz_stream_nil(), sz_string_from_cstr("z"),
@@ -4439,15 +4610,92 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_filter_not(sz_stream_emits(xs), stream_empty, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
+    assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
+
+    delay_calls = 0;
+    s = sz_stream_take(
+        sz_stream_filter_not(
+            sz_stream_concat(sz_stream_eval(sz_io_delay(take_hit, (void *)"")),
+                             sz_stream_eval(sz_io_delay(take_hit, (void *)"a"))),
+            stream_empty, NULL),
+        1);
+    r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
+    assert(r.ok);
+    joined = test_list_join((SzList *)r.value, ",");
+    assert(strcmp(sz_string_cstr(joined), "a") == 0);
+    assert(delay_calls == 2);
+
+    delay_calls = 0;
+    s = sz_stream_take(
+        sz_stream_map_concat(
+            sz_stream_concat(sz_stream_eval(sz_io_delay(take_hit, (void *)"")),
+                             sz_stream_eval(sz_io_delay(take_hit, (void *)"a"))),
+            stream_list_keep, NULL),
+        1);
+    r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
+    assert(r.ok);
+    joined = test_list_join((SzList *)r.value, ",");
+    assert(strcmp(sz_string_cstr(joined), "a") == 0);
+    assert(delay_calls == 2);
+
+    delay_calls = 0;
+    s = sz_stream_take(
+        sz_stream_flatmap(
+            sz_stream_concat(sz_stream_eval(sz_io_delay(take_hit, (void *)"")),
+                             sz_stream_eval(sz_io_delay(take_hit, (void *)"a"))),
+            stream_emit_keep, NULL),
+        1);
+    r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
+    assert(r.ok);
+    joined = test_list_join((SzList *)r.value, ",");
+    assert(strcmp(sz_string_cstr(joined), "a") == 0);
+    assert(delay_calls == 2);
+
+    delay_calls = 0;
+    s = sz_stream_take(
+        sz_stream_changes(sz_stream_concat(
+            sz_stream_concat(sz_stream_eval(sz_io_delay(take_hit, (void *)"a")),
+                             sz_stream_eval(sz_io_delay(take_hit, (void *)"a"))),
+            sz_stream_eval(sz_io_delay(take_hit, (void *)"b")))),
+        2);
+    r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
+    assert(r.ok);
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
+    assert(delay_calls == 3);
+
+    delay_calls = 0;
+    s = sz_stream_take(
+        sz_stream_filter(
+            sz_stream_evalmap(
+                sz_stream_concat(
+                    sz_stream_eval(sz_io_delay(take_hit, (void *)"a")),
+                    sz_stream_eval(sz_io_delay(take_hit, (void *)"b"))),
+                stream_bang, NULL),
+            stream_nonempty, NULL),
+        1);
+    r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
+    assert(r.ok);
+    joined = test_list_join((SzList *)r.value, ",");
+    assert(strcmp(sz_string_cstr(joined), "a!") == 0);
+    assert(delay_calls == 1);
+
+    delay_calls = 0;
+    s = sz_stream_take(
+        sz_stream_interleave(sz_stream_eval(sz_io_delay(take_hit, (void *)"a")),
+                             sz_stream_eval(sz_io_delay(take_hit, (void *)"b"))),
+        1);
+    r = sz_io_unsafe_run(sz_stream_compile_to_list(s));
+    assert(r.ok);
+    assert(delay_calls == 2);
 
     xs = sz_list_cons(sz_string_from_cstr("a"),
                       sz_list_cons(sz_string_from_cstr("b"), sz_list_nil()));
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_map_concat(sz_stream_emits(xs), stream_list_dup, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,a,b,b") == 0);
 
     {
@@ -4460,7 +4708,7 @@ int main(void) {
       r = sz_io_unsafe_run(sz_stream_compile_to_list(sz_stream_zip_with(
           sz_stream_emits(as), sz_stream_emits(bs), stream_zip_concat, NULL)));
       assert(r.ok);
-      joined = sz_list_join((SzList *)r.value, ",");
+      joined = test_list_join((SzList *)r.value, ",");
       assert(strcmp(sz_string_cstr(joined), "a1,b2") == 0);
     }
 
@@ -4480,14 +4728,14 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(sz_stream_or_else(
         sz_stream_nil(), sz_stream_emit(sz_string_from_cstr("z")))));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "z") == 0);
 
     r = sz_io_unsafe_run(sz_stream_compile_to_list(sz_stream_or_else(
         sz_stream_emit(sz_string_from_cstr("a")),
         sz_stream_emit(sz_string_from_cstr("z")))));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a") == 0);
 
     xs = sz_list_cons(
@@ -4506,7 +4754,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_take_right(sz_stream_emits(xs), 2)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "b,c") == 0);
 
     xs = sz_list_cons(
@@ -4516,7 +4764,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_drop_right(sz_stream_emits(xs), 1)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
 
     xs = sz_list_cons(
@@ -4526,7 +4774,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_find_last(sz_stream_emits(xs), stream_nonempty, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "b") == 0);
 
     tap_n = 0;
@@ -4535,7 +4783,7 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_evaltap(sz_stream_emits(xs), stream_tap_count, NULL)));
     assert(r.ok);
-    joined = sz_list_join((SzList *)r.value, ",");
+    joined = test_list_join((SzList *)r.value, ",");
     assert(strcmp(sz_string_cstr(joined), "a,b") == 0);
     assert(tap_n == 2);
 
@@ -4548,6 +4796,14 @@ int main(void) {
       assert(sz_unbox_i64(sz_list_head((SzList *)r.value)) == 0);
     }
 
+    iterate_calls = 0;
+    r = sz_io_unsafe_run(sz_stream_compile_to_list(sz_stream_take(
+        sz_stream_iterate(sz_box_i64(0), 100, stream_inc_count, NULL), 1)));
+    assert(r.ok);
+    assert(sz_list_len((SzList *)r.value) == 1);
+    assert(sz_unbox_i64(sz_list_head((SzList *)r.value)) == 0);
+    assert(iterate_calls == 0);
+
     r = sz_io_unsafe_run(sz_stream_compile_to_list(
         sz_stream_iterate(sz_box_i64(0), 0, stream_inc, NULL)));
     assert(r.ok);
@@ -4571,6 +4827,14 @@ int main(void) {
     r = sz_io_unsafe_run(sz_stream_head(sz_stream_nil()));
     assert(!r.ok);
 
+    delay_calls = 0;
+    r = sz_io_unsafe_run(sz_stream_head(sz_stream_concat(
+        sz_stream_eval(sz_io_delay(take_hit, (void *)"a")),
+        sz_stream_eval(sz_io_delay(take_hit, (void *)"b")))));
+    assert(r.ok);
+    assert(strcmp(sz_string_cstr((SzString *)r.value), "a") == 0);
+    assert(delay_calls == 1);
+
     xs = sz_list_cons(sz_string_from_cstr("a"),
                       sz_list_cons(sz_string_from_cstr("b"), sz_list_nil()));
     r = sz_io_unsafe_run(sz_stream_last(sz_stream_emits(xs)));
@@ -4952,6 +5216,22 @@ int main(void) {
       assert(strcmp(sz_string_cstr(right), "axx") == 0);
       assert(strcmp(sz_string_cstr(shortp), "abcd") == 0);
       assert(strcmp(sz_string_cstr(nopad), "a") == 0);
+      {
+        SzString *e = sz_string_from_cstr("\xc3\xa9");
+        SzString *px = sz_string_from_cstr("x");
+        SzString *p3 = sz_string_pad_left(e, 3, px);
+        SzString *a = sz_string_from_cstr("a");
+        SzString *mb = sz_string_pad_left(a, 4, e);
+        assert(strcmp(sz_string_cstr(p3), "xx\xc3\xa9") == 0);
+        assert(sz_string_ulen(p3) == 3);
+        assert(sz_string_ulen(mb) == 4);
+        assert(sz_string_len(mb) == 7);
+        sz_string_free(e);
+        sz_string_free(px);
+        sz_string_free(p3);
+        sz_string_free(a);
+        sz_string_free(mb);
+      }
       assert(sz_string_is_blank(sz_string_from_cstr(" \t\n")) == 1);
       assert(sz_string_is_blank(sz_string_from_cstr(" a")) == 0);
       assert(sz_string_is_blank(NULL) == 1);
@@ -5008,6 +5288,37 @@ int main(void) {
           assert(sz_string_ulen(tr) == 2 && sz_string_uchar_at(tr, 0) == 0xE9);
           assert(strcmp(sz_string_cstr(drr), "a") == 0);
           assert(sz_string_ulen(rv) == 3 && sz_string_uchar_at(rv, 0) == 'z' && sz_string_uchar_at(rv, 1) == 0xE9);
+          {
+            SzString *eonly = sz_string_uslice(u, 1, 2);
+            SzString *mid = sz_string_slice(eonly, 1, 2);
+            assert(sz_string_len(mid) == 1);
+            assert(sz_string_is_empty(mid) == 0);
+            assert(sz_string_ulen(mid) == 1);
+            assert(sz_string_uchar_at(mid, 0) == 0xA9);
+            assert(sz_string_uchar_at(mid, 1) == -1);
+            sz_string_free(mid);
+            sz_string_free(eonly);
+          }
+          {
+            SzString *eonly = sz_string_uslice(u, 1, 2);
+            SzString *px = sz_string_from_cstr("x");
+            SzString *p3 = sz_string_pad_left(eonly, 3, px);
+            SzString *aone = sz_string_uslice(u, 0, 1);
+            SzString *mb = sz_string_pad_left(aone, 4, eonly);
+            assert(sz_string_ulen(p3) == 3);
+            assert(sz_string_uchar_at(p3, 0) == 'x');
+            assert(sz_string_uchar_at(p3, 1) == 'x');
+            assert(sz_string_uchar_at(p3, 2) == 0xE9);
+            assert(sz_string_ulen(mb) == 4);
+            assert(sz_string_len(mb) == 7);
+            assert(sz_string_uchar_at(mb, 0) == 0xE9);
+            assert(sz_string_uchar_at(mb, 3) == 'a');
+            sz_string_free(eonly);
+            sz_string_free(px);
+            sz_string_free(p3);
+            sz_string_free(aone);
+            sz_string_free(mb);
+          }
           {
             /* Sequential walk, then a lower index. Leading non-ASCII must stay O(n). */
             SzString *fwd = sz_string_from_cstr("\xc3\xa9" "abcdefghijklmnopqrstuvwxyz");
@@ -5069,6 +5380,8 @@ int main(void) {
       assert(sz_string_len(tr) == 0);
     }
     assert(strcmp(sz_string_cstr(sz_string_from_int(42)), "42") == 0);
+    assert(strcmp(sz_string_cstr(sz_string_from_bool(1)), "true") == 0);
+    assert(strcmp(sz_string_cstr(sz_string_from_bool(0)), "false") == 0);
     assert(strcmp(sz_string_cstr(sz_string_from_float(1.5)), "1.5") == 0);
     assert(strcmp(sz_string_cstr(sz_string_from_float(2.0)), "2.0") == 0);
     assert(strcmp(sz_string_cstr(sz_string_from_float(-1.5)), "-1.5") == 0);
@@ -5137,7 +5450,7 @@ int main(void) {
     assert(sz_list_len(xs) == 2);
     assert(strcmp(sz_string_cstr((SzString *)sz_list_head(xs)), "a") == 0);
     assert(strcmp(sz_string_cstr((SzString *)sz_list_at(xs, 1)), "b") == 0);
-    SzString *j = sz_list_join(xs, ",");
+    SzString *j = test_list_join(xs, ",");
     assert(strcmp(sz_string_cstr(j), "a,b") == 0);
   }
 
@@ -5413,6 +5726,42 @@ int main(void) {
     sz_error_free(r.error);
     remove("build/test_fs_mkdirs_file");
     remove(path);
+    r = sz_io_unsafe_run(sz_fs_mkdirs(sz_string_from_cstr("")));
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_fs_mkdirs(sz_string_from_cstr(".")));
+    assert(r.ok);
+  }
+
+  /* Live root-delete guard: throwaway dir only. Never delete / or the repo. */
+  {
+    char tmpl[] = "/tmp/scuzz-fs-XXXXXX";
+    char oldcwd[2048];
+    char *tmp;
+    assert(getcwd(oldcwd, sizeof oldcwd) != NULL);
+    tmp = mkdtemp(tmpl);
+    assert(tmp != NULL);
+    assert(chdir(tmp) == 0);
+    r = sz_io_unsafe_run(sz_fs_mkdirs(sz_string_from_cstr("work")));
+    assert(r.ok);
+    r = sz_io_unsafe_run(
+        sz_fs_write(sz_string_from_cstr("canary.txt"), sz_string_from_cstr("x")));
+    assert(r.ok);
+    r = sz_io_unsafe_run(
+        sz_fs_write(sz_string_from_cstr("work/canary.txt"), sz_string_from_cstr("y")));
+    assert(r.ok);
+    assert(chdir("work") == 0);
+    expect_fs_refused_root("./");
+    assert(access("canary.txt", F_OK) == 0);
+    expect_fs_refused_root("/.");
+    expect_fs_refused_root("..");
+    assert(access("canary.txt", F_OK) == 0);
+    assert(access("../canary.txt", F_OK) == 0);
+    r = sz_io_unsafe_run(sz_fs_delete(sz_string_from_cstr("../canary.txt")));
+    assert(r.ok);
+    assert(access("../canary.txt", F_OK) != 0);
+    assert(chdir(oldcwd) == 0);
+    r = sz_io_unsafe_run(sz_fs_delete(sz_string_from_cstr(tmp)));
+    assert(r.ok);
   }
 
   /* TestRuntime: Fs graph built before install still uses mem-FS. */
@@ -5495,7 +5844,32 @@ int main(void) {
 
     r = sz_io_unsafe_run(sz_clock_real_time());
     assert(r.ok);
-    assert(sz_unbox_i64(r.value) == t1);
+    assert(sz_unbox_i64(r.value) == sz_testrt_clock_now_ms());
+
+    /* Parked poller must not freeze fake-clock sleepers. */
+    {
+      int fds[2];
+      struct timespec w0, w1;
+      int64_t ct0, ct1;
+      long wall_ms;
+      assert(pipe(fds) == 0);
+      ct0 = sz_testrt_clock_now_ms();
+      clock_gettime(CLOCK_MONOTONIC, &w0);
+      r = sz_io_unsafe_run(race_drop(
+          sz_io_poll_readable(fds[0]),
+          fm_drop(sz_io_sleep_ms(50), after_sleep_tag,
+                  (void *)(intptr_t)50)));
+      clock_gettime(CLOCK_MONOTONIC, &w1);
+      assert(r.ok);
+      assert((intptr_t)r.value == 50);
+      ct1 = sz_testrt_clock_now_ms();
+      assert(ct1 == ct0 + 50);
+      wall_ms = (long)((w1.tv_sec - w0.tv_sec) * 1000L +
+                       (w1.tv_nsec - w0.tv_nsec) / 1000000L);
+      assert(wall_ms < 25);
+      close(fds[0]);
+      close(fds[1]);
+    }
 
     r = sz_io_unsafe_run(sz_random_next_int(10));
     assert(r.ok);
@@ -5517,6 +5891,44 @@ int main(void) {
       assert(saw_hi);
     }
 
+    {
+      int64_t a[32];
+      int64_t b[32];
+      int i;
+      int alt;
+      sz_testrt_random_install(42);
+      for (i = 0; i < 32; i++) {
+        r = sz_io_unsafe_run(sz_random_next_int(2));
+        assert(r.ok);
+        a[i] = sz_unbox_i64(r.value);
+        assert(a[i] == 0 || a[i] == 1);
+        sz_release(r.value);
+      }
+      alt = 1;
+      for (i = 1; i < 32; i++) {
+        if (a[i] == a[i - 1])
+          alt = 0;
+      }
+      assert(!alt);
+      sz_testrt_random_install(42);
+      for (i = 0; i < 32; i++) {
+        r = sz_io_unsafe_run(sz_random_next_int(2));
+        assert(r.ok);
+        b[i] = sz_unbox_i64(r.value);
+        sz_release(r.value);
+        assert(b[i] == a[i]);
+      }
+    }
+
+    r = sz_io_unsafe_run(sz_random_next_int(0));
+    assert(!r.ok);
+    assert(r.error &&
+           strstr(sz_string_cstr(r.error->message), "bound <= 0") != NULL);
+    sz_error_free(r.error);
+    r = sz_io_unsafe_run(sz_random_next_int(-3));
+    assert(!r.ok);
+    sz_error_free(r.error);
+
     sz_alloc_stats(&base_bytes, &base_count);
     r = sz_io_unsafe_run(sz_random_next_int(10));
     assert(r.ok);
@@ -5660,6 +6072,57 @@ int main(void) {
       assert(r.error &&
              strstr(sz_string_cstr(r.error->message), "path too deep") != NULL);
       sz_error_free(r.error);
+      r = sz_io_unsafe_run(
+          sz_fs_write(sz_string_from_cstr(deep), sz_string_from_cstr("z")));
+      assert(!r.ok);
+      assert(r.error &&
+             strstr(sz_string_cstr(r.error->message), "path too deep") != NULL);
+      sz_error_free(r.error);
+      r = sz_io_unsafe_run(sz_fs_mkdirs(sz_string_from_cstr(deep)));
+      assert(!r.ok);
+      assert(r.error &&
+             strstr(sz_string_cstr(r.error->message), "path too deep") != NULL);
+      sz_error_free(r.error);
+    }
+
+    r = sz_io_unsafe_run(sz_fs_mkdirs(sz_string_from_cstr("")));
+    assert(r.ok);
+    expect_fs_refused_root("./");
+    expect_fs_refused_root("/.");
+    expect_fs_refused_root("..");
+    r = sz_io_unsafe_run(sz_fs_mkdirs(sz_string_from_cstr("a")));
+    assert(r.ok);
+    r = sz_io_unsafe_run(
+        sz_fs_write(sz_string_from_cstr("a/./b.txt"), sz_string_from_cstr("dot")));
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_fs_read(sz_string_from_cstr("a/b.txt")));
+    assert(r.ok);
+    assert(strcmp(sz_string_cstr((SzString *)r.value), "dot") == 0);
+    sz_release(r.value);
+    r = sz_io_unsafe_run(
+        sz_fs_write(sz_string_from_cstr("a/x"), sz_string_from_cstr("up")));
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_fs_read(sz_string_from_cstr("a/../a/x")));
+    assert(r.ok);
+    assert(strcmp(sz_string_cstr((SzString *)r.value), "up") == 0);
+    sz_release(r.value);
+    r = sz_io_unsafe_run(
+        sz_fs_write(sz_string_from_cstr("a/./b"), sz_string_from_cstr("leaf")));
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_fs_list(sz_string_from_cstr("a")));
+    assert(r.ok);
+    {
+      SzList *xs = (SzList *)r.value;
+      int saw_b = 0;
+      while (xs && !sz_list_is_empty(xs)) {
+        SzPair *ent = (SzPair *)sz_list_head(xs);
+        SzString *name = (SzString *)sz_pair_left(ent);
+        if (strcmp(sz_string_cstr(name), "b") == 0)
+          saw_b = 1;
+        xs = sz_list_tail(xs);
+      }
+      assert(saw_b);
+      sz_release(r.value);
     }
 
     r = sz_io_unsafe_run(
@@ -5926,6 +6389,38 @@ int main(void) {
         assert(r.ok);
         assert(strcmp(sz_string_cstr((SzString *)r.value), "hi") == 0);
         sz_release(r.value);
+        {
+          char blob[32];
+          SzString *body32;
+          memset(blob, 'x', 32);
+          body32 = sz_string_from_bytes(blob, 32);
+          r = sz_io_unsafe_run(both_drop(sz_net_tcp_read(a, 8),
+                                        sz_net_tcp_write(b, body32)));
+          sz_release(body32);
+          assert(r.ok);
+          pair = (SzPair *)r.value;
+          assert(sz_string_len((SzString *)pair->left) == 8);
+          sz_pair_free(pair);
+          r = sz_io_unsafe_run(sz_net_tcp_read(a, 24));
+          assert(r.ok);
+          assert(sz_string_len((SzString *)r.value) == 24);
+          sz_release(r.value);
+        }
+        {
+          char *blob = (char *)malloc(10000);
+          SzString *big;
+          assert(blob);
+          memset(blob, 'y', 10000);
+          big = sz_string_from_bytes(blob, 10000);
+          free(blob);
+          r = sz_io_unsafe_run(sz_net_tcp_write(b, big));
+          sz_release(big);
+          assert(r.ok);
+          r = sz_io_unsafe_run(sz_net_tcp_read(a, 10000));
+          assert(r.ok);
+          assert(sz_string_len((SzString *)r.value) == 10000);
+          sz_release(r.value);
+        }
         r = sz_io_unsafe_run(sz_net_tcp_close(a));
         assert(r.ok);
         r = sz_io_unsafe_run(sz_net_tcp_close(b));
@@ -5959,6 +6454,48 @@ int main(void) {
           assert(sz_unbox_i64(inner->left) == 19092);
         }
         sz_pair_free(pair);
+        {
+          SzString *host = sz_string_from_cstr("127.0.0.1");
+          SzString *ma = sz_string_from_cstr("a");
+          SzString *mb = sz_string_from_cstr("b");
+          r = sz_io_unsafe_run(sz_net_udp_send(a, host, 19093, ma));
+          assert(r.ok);
+          r = sz_io_unsafe_run(sz_net_udp_send(a, host, 19093, mb));
+          assert(r.ok);
+          sz_release(ma);
+          sz_release(mb);
+          r = sz_io_unsafe_run(sz_net_udp_recv(b, 32));
+          assert(r.ok);
+          pair = (SzPair *)r.value;
+          assert(strcmp(sz_string_cstr((SzString *)((SzPair *)pair->right)->right),
+                        "a") == 0);
+          sz_pair_free(pair);
+          r = sz_io_unsafe_run(sz_net_udp_recv(b, 32));
+          assert(r.ok);
+          pair = (SzPair *)r.value;
+          assert(strcmp(sz_string_cstr((SzString *)((SzPair *)pair->right)->right),
+                        "b") == 0);
+          sz_pair_free(pair);
+          {
+            SzString *bad = sz_string_from_cstr("nope");
+            SzString *msg = sz_string_from_cstr("x");
+            r = sz_io_unsafe_run(sz_net_udp_send(a, bad, 19093, msg));
+            assert(!r.ok);
+            assert(r.error &&
+                   strstr(sz_string_cstr(r.error->message), "IP literal") != NULL);
+            sz_error_free(r.error);
+            sz_release(bad);
+            bad = sz_string_from_cstr("::1");
+            r = sz_io_unsafe_run(sz_net_udp_send(a, bad, 19093, msg));
+            assert(!r.ok);
+            assert(r.error &&
+                   strstr(sz_string_cstr(r.error->message), "send failed") != NULL);
+            sz_error_free(r.error);
+            sz_release(bad);
+            sz_release(msg);
+          }
+          sz_release(host);
+        }
         r = sz_io_unsafe_run(sz_net_udp_close(a));
         assert(r.ok);
         r = sz_io_unsafe_run(sz_net_udp_close(b));
@@ -6048,6 +6585,50 @@ int main(void) {
       assert(strcmp(sz_string_cstr((SzString *)r.value), "sealed") == 0);
       sz_release(r.value);
 
+      /* Drive.testEnv keys seed the sealed map. Host PATH still does not leak. */
+      {
+        const char *old_serve = getenv("SCUZZ_SERVE");
+        const char *old_kit = getenv("SCUZZ_KIT");
+        char serve_save[64];
+        char kit_save[64];
+        int had_serve = old_serve && old_serve[0];
+        int had_kit = old_kit && old_kit[0];
+        if (had_serve)
+          snprintf(serve_save, sizeof serve_save, "%s", old_serve);
+        if (had_kit)
+          snprintf(kit_save, sizeof kit_save, "%s", old_kit);
+        setenv("SCUZZ_SERVE", "1", 1);
+        setenv("SCUZZ_KIT", "sealed", 1);
+        sz_testrt_install();
+        r = sz_io_unsafe_run(sz_sys_getenv(sz_string_from_cstr("SCUZZ_SERVE")));
+        assert(r.ok);
+        assert(strcmp(sz_string_cstr((SzString *)r.value), "1") == 0);
+        sz_release(r.value);
+        r = sz_io_unsafe_run(sz_sys_getenv(sz_string_from_cstr("SCUZZ_KIT")));
+        assert(r.ok);
+        assert(strcmp(sz_string_cstr((SzString *)r.value), "sealed") == 0);
+        sz_release(r.value);
+        r = sz_io_unsafe_run(sz_sys_getenv(sz_string_from_cstr("PATH")));
+        assert(r.ok);
+        assert(strcmp(sz_string_cstr((SzString *)r.value), "") == 0);
+        sz_release(r.value);
+        unsetenv("SCUZZ_SERVE");
+        unsetenv("SCUZZ_KIT");
+        sz_testrt_install();
+        r = sz_io_unsafe_run(sz_sys_getenv(sz_string_from_cstr("SCUZZ_SERVE")));
+        assert(r.ok);
+        assert(strcmp(sz_string_cstr((SzString *)r.value), "") == 0);
+        sz_release(r.value);
+        if (had_serve)
+          setenv("SCUZZ_SERVE", serve_save, 1);
+        else
+          unsetenv("SCUZZ_SERVE");
+        if (had_kit)
+          setenv("SCUZZ_KIT", kit_save, 1);
+        else
+          unsetenv("SCUZZ_KIT");
+      }
+
       {
         size_t base_bytes = 0, base_count = 0;
         size_t live_bytes = 0, live_count = 0;
@@ -6227,6 +6808,24 @@ int main(void) {
     }
     sz_deferred_free(def);
 
+    /* Two parked gets both wake. Oldest waiter is first in the list. */
+    def = sz_deferred_make();
+    r = sz_io_unsafe_run(both_drop(
+        both_drop(sz_deferred_get(def), sz_deferred_get(def)),
+        sz_deferred_complete_cstr(def, "go")));
+    assert(r.ok);
+    {
+      SzPair *outer = (SzPair *)r.value;
+      SzPair *gets;
+      assert(outer);
+      gets = (SzPair *)outer->left;
+      assert(gets);
+      assert(strcmp(sz_string_cstr((SzString *)gets->left), "go") == 0);
+      assert(strcmp(sz_string_cstr((SzString *)gets->right), "go") == 0);
+      sz_pair_free(outer);
+    }
+    sz_deferred_free(def);
+
     sz_testrt_reset();
   }
 
@@ -6447,6 +7046,42 @@ int main(void) {
     assert(sz_unbox_i64(r.value) == 0);
   }
 
+  /* Sys.kill reaps without Sys.alive. Watch kills then spawns. */
+  {
+    SzIoResult r;
+    SzIoResult sr;
+    int64_t pid;
+    int64_t pid2;
+    int i;
+    int status = 0;
+    int st2 = 0;
+    pid_t w;
+    r = sz_io_unsafe_run(sz_sys_spawn(sz_string_from_cstr("exec sleep 5")));
+    assert(r.ok);
+    pid = sz_unbox_i64(r.value);
+    sz_release(r.value);
+    assert(pid > 0);
+    r = sz_io_unsafe_run(sz_sys_kill(pid));
+    assert(r.ok);
+    for (i = 0; i < 50; i++) {
+      if (pid_is_zombie((pid_t)pid))
+        break;
+      if (kill((pid_t)pid, 0) != 0 && errno == ESRCH)
+        break;
+      sleep_us(20000);
+    }
+    sr = sz_io_unsafe_run(sz_sys_spawn(sz_string_from_cstr("true")));
+    assert(sr.ok);
+    pid2 = sz_unbox_i64(sr.value);
+    sz_release(sr.value);
+    assert(waitpid((pid_t)pid2, &st2, 0) == (pid_t)pid2);
+    assert(!pid_is_zombie((pid_t)pid));
+    w = waitpid((pid_t)pid, &status, WNOHANG);
+    assert(w == (pid_t)pid || (w < 0 && errno == ECHILD));
+    (void)sz_io_unsafe_run(sz_sys_alive(pid2));
+    (void)sz_io_unsafe_run(sz_sys_alive(pid));
+  }
+
   /* Sys.spawn pipes: write stdin, read stdout (dd copies five bytes). */
   {
     SzIoResult pr;
@@ -6496,21 +7131,26 @@ int main(void) {
     assert(pr.ok);
     pr = sz_io_unsafe_run(sz_sys_child_close(pid));
     assert(pr.ok);
-    pr = sz_io_unsafe_run(sz_sys_child_read(pid, 2));
+    pr = sz_io_unsafe_run(sz_sys_child_read(pid, 3));
     assert(pr.ok);
     got = (SzString *)pr.value;
     assert(got && got->len == 2);
     assert(memcmp(sz_string_cstr(got), "xy", 2) == 0);
     sz_release(got);
-    pr = sz_io_unsafe_run(sz_sys_child_read(pid, 1));
-    assert(pr.ok);
-    got = (SzString *)pr.value;
-    assert(got && got->len == 0);
-    sz_release(got);
     pr = sz_io_unsafe_run(sz_sys_kill(pid));
     assert(pr.ok);
   }
 
+  /* Sys.childRead on an unknown pid fails like Sys.childWrite. */
+  {
+    SzIoResult pr;
+    pr = sz_io_unsafe_run(sz_sys_child_read(999999, 1));
+    assert(!pr.ok);
+    assert(pr.error &&
+           strstr(sz_string_cstr(pr.error->message), "unknown pid") != NULL);
+    sz_error_free(pr.error);
+  }
+
   /* Child read parks; a peer fiber writes before the copy finishes. */
   {
     SzIoResult pr;
@@ -6590,6 +7230,7 @@ int main(void) {
     size_t base_bytes = 0, base_count = 0;
     size_t live_bytes = 0, live_count = 0;
     int status = 0;
+    (void)sz_io_unsafe_run(sz_sys_alive(0));
     sz_alloc_stats(&base_bytes, &base_count);
     {
       SzString *cmd = sz_string_from_cstr("true");
@@ -6693,6 +7334,35 @@ int main(void) {
     assert(g_peer_flag == 1);
   }
 
+  /* Cancel of a long child reaps it. */
+  {
+    SzString *cmd = sz_string_from_cstr("exec sleep 30");
+    r = sz_io_unsafe_run(race_drop(
+        sz_sys_exec (cmd),
+        sz_io_sleep_ms(1000)));
+    sz_release(cmd);
+    assert(r.ok);
+    if (r.value)
+      sz_release(r.value);
+#ifdef __linux__
+    {
+      int leftover = kill_reap_sleep_children();
+      assert(leftover == 0);
+    }
+#endif
+  }
+
+  /* Capture over 1 MiB fails. */
+  {
+    SzString *cmd = sz_string_from_cstr("dd if=/dev/zero bs=1024 count=2048 2>/dev/null");
+    r = sz_io_unsafe_run(sz_sys_exec (cmd));
+    sz_release(cmd);
+    assert(!r.ok);
+    assert(r.error &&
+           strstr(sz_string_cstr(r.error->message), "1 MiB") != NULL);
+    sz_error_free(r.error);
+  }
+
   /* Live Net.serveOnce: client thread GET while this fiber accepts. */
   {
     pthread_t th;
@@ -6733,6 +7403,91 @@ int main(void) {
     sz_error_free(r.error);
   }
 
+  /* Live TCP echo and a 10000-byte read (drain until n, not a 4096 cap). */
+  {
+    SzNetSock *ln;
+    SzNetSock *a;
+    SzNetSock *b;
+    SzPair *pair;
+    SzString *host = sz_string_from_cstr("127.0.0.1");
+    SzString *hi = sz_string_from_cstr("hello");
+    r = sz_io_unsafe_run(sz_net_tcp_listen(19111));
+    assert(r.ok);
+    ln = (SzNetSock *)r.value;
+    r = sz_io_unsafe_run(both_drop(sz_net_tcp_accept(ln),
+                                  sz_net_tcp_connect(host, 19111)));
+    sz_release(host);
+    assert(r.ok);
+    pair = (SzPair *)r.value;
+    a = (SzNetSock *)pair->left;
+    b = (SzNetSock *)pair->right;
+    sz_retain(a);
+    sz_retain(b);
+    sz_pair_free(pair);
+    r = sz_io_unsafe_run(sz_net_tcp_write(b, hi));
+    sz_release(hi);
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_net_tcp_read(a, 16));
+    assert(r.ok);
+    assert(strcmp(sz_string_cstr((SzString *)r.value), "hello") == 0);
+    sz_release(r.value);
+    {
+      char *blob = (char *)malloc(10000);
+      SzString *big;
+      assert(blob);
+      memset(blob, 'z', 10000);
+      big = sz_string_from_bytes(blob, 10000);
+      free(blob);
+      r = sz_io_unsafe_run(sz_net_tcp_write(b, big));
+      sz_release(big);
+      assert(r.ok);
+      r = sz_io_unsafe_run(sz_net_tcp_read(a, 10000));
+      assert(r.ok);
+      assert(sz_string_len((SzString *)r.value) == 10000);
+      sz_release(r.value);
+    }
+    r = sz_io_unsafe_run(sz_net_tcp_close(a));
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_net_tcp_close(b));
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_net_tcp_close(ln));
+    assert(r.ok);
+    sz_release(a);
+    sz_release(b);
+    sz_release(ln);
+  }
+
+  /* Live UDP ping on IPv4 localhost. */
+  {
+    SzNetSock *a;
+    SzNetSock *b;
+    SzPair *pair;
+    SzString *host = sz_string_from_cstr("127.0.0.1");
+    SzString *msg = sz_string_from_cstr("ping");
+    r = sz_io_unsafe_run(sz_net_udp_bind(19112));
+    assert(r.ok);
+    a = (SzNetSock *)r.value;
+    r = sz_io_unsafe_run(sz_net_udp_bind(19113));
+    assert(r.ok);
+    b = (SzNetSock *)r.value;
+    r = sz_io_unsafe_run(sz_net_udp_send(a, host, 19113, msg));
+    sz_release(host);
+    sz_release(msg);
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_net_udp_recv(b, 32));
+    assert(r.ok);
+    pair = (SzPair *)r.value;
+    assert(strcmp(sz_string_cstr((SzString *)((SzPair *)pair->right)->right),
+                  "ping") == 0);
+    sz_pair_free(pair);
+    r = sz_io_unsafe_run(sz_net_udp_close(a));
+    assert(r.ok);
+    r = sz_io_unsafe_run(sz_net_udp_close(b));
+    assert(r.ok);
+    sz_release(a);
+    sz_release(b);
+  }
+
   /* Client connects and never sends GET: serve fails in ~1s instead of hanging. */
   {
     pthread_t th;
@@ -9096,8 +9851,15 @@ int main(void) {
     assert(sz_unbox_i64(sz_list_at(out, 1)) == 2);
     assert(sz_unbox_i64(sz_list_at(out, 2)) == 3);
     sz_list_free(out);
+    out = sz_list_sort(ns, 0);
+    assert(sz_unbox_i64(sz_list_head(out)) == 1);
+    assert(sz_unbox_i64(sz_list_at(out, 1)) == 2);
+    assert(sz_unbox_i64(sz_list_at(out, 2)) == 3);
+    sz_list_free(out);
     assert(sz_unbox_i64(sz_list_max(ns, 1)) == 3);
     assert(sz_unbox_i64(sz_list_min(ns, 1)) == 1);
+    assert(sz_unbox_i64(sz_list_max(ns, 0)) == 3);
+    assert(sz_unbox_i64(sz_list_min(ns, 0)) == 1);
     sz_list_free(ns);
     sz_release(n1);
     sz_release(n2);
@@ -9579,17 +10341,37 @@ int main(void) {
     assert(sz_map_contains(m1, kb) == 0);
     assert(strcmp(sz_string_cstr((SzString *)sz_map_get_or(m2, ka, NULL)), "1") == 0);
     {
-      SzList *hit = sz_map_get(m2, ka);
-      SzList *miss = sz_map_get(m1, kb);
+      SzAdt *hit = (SzAdt *)sz_map_get(m2, ka);
+      SzAdt *miss = (SzAdt *)sz_map_get(m1, kb);
       SzString *kz = sz_string_from_cstr("z");
-      SzList *absent = sz_map_get(m2, kz);
-      assert(sz_list_len(hit) == 1);
-      assert(strcmp(sz_string_cstr((SzString *)hit->head), "1") == 0);
-      assert(sz_list_is_empty(miss));
-      assert(sz_list_is_empty(absent));
-      sz_list_free(hit);
+      SzAdt *absent = (SzAdt *)sz_map_get(m2, kz);
+      assert(sz_adt_tag(hit) == 1);
+      assert(strcmp(sz_string_cstr((SzString *)sz_adt_payload(hit)), "1") == 0);
+      assert(sz_adt_tag(miss) == 0);
+      assert(sz_adt_tag(absent) == 0);
+      sz_release(hit);
+      sz_release(miss);
+      sz_release(absent);
       sz_string_free(kz);
     }
+    {
+      SzString *ke = sz_string_from_cstr("e");
+      SzMap *empty = sz_map_set(NULL, ke, NULL, 1);
+      SzAdt *some;
+      SzString *kz = sz_string_from_cstr("z");
+      SzAdt *none;
+      assert(sz_map_contains(empty, ke) == 1);
+      some = (SzAdt *)sz_map_get(empty, ke);
+      none = (SzAdt *)sz_map_get(empty, kz);
+      assert(sz_adt_tag(some) == 1);
+      assert(sz_adt_payload(some) == NULL);
+      assert(sz_adt_tag(none) == 0);
+      sz_release(some);
+      sz_release(none);
+      sz_string_free(kz);
+      sz_release(empty);
+      sz_string_free(ke);
+    }
     sz_release(m2);
     sz_release(m1);
     sz_string_free(ka);
@@ -10787,6 +11569,37 @@ int main(void) {
     assert(sz_timeline_a11y_has(tl, 0, needle) == 1);
     sz_release(needle);
     sz_timeline_free(tl);
+    write_text(path, "# timeline v=2 n=1\n--- 0\nlast_hit:\n\ndrive:\n\n"
+                     "signals:\nlist[1] q = [\"a\\\"b\", \"a\\nb\"]\n"
+                     "str[2] draft = \"a\\\"b\"\na11y:\n\n");
+    tl = sz_timeline_load(path);
+    assert(tl);
+    needle = sz_string_from_cstr("q");
+    assert(sz_timeline_signal_list_len(tl, 0, needle) == 2);
+    sz_release(needle);
+    needle = sz_string_from_cstr("draft");
+    {
+      SzString *want = sz_string_from_cstr("a\"b");
+      assert(sz_timeline_signal_str_has(tl, 0, needle, want) == 1);
+      sz_release(want);
+    }
+    sz_release(needle);
+    sz_timeline_free(tl);
+    write_text(path, "# timeline v=2 n=1\n--- 0\nlast_hit:\n\ndrive:\n\n"
+                     "signals:\nstr[2] draft = \"\"\na11y:\n\n");
+    tl = sz_timeline_load(path);
+    assert(tl);
+    needle = sz_string_from_cstr("draft");
+    {
+      SzString *want = sz_string_from_cstr("");
+      assert(sz_timeline_signal_str_has(tl, 0, needle, want) == 1);
+      sz_release(want);
+      want = sz_string_from_cstr("x");
+      assert(sz_timeline_signal_str_has(tl, 0, needle, want) == 0);
+      sz_release(want);
+    }
+    sz_release(needle);
+    sz_timeline_free(tl);
     write_text(path, "# timeline v=3 n=0\n");
     assert(sz_timeline_load(path) == NULL);
     write_text(path, "nonsense\n");
diff --git a/crates/runtime/tests/test_ui.c b/crates/runtime/tests/test_ui.c
index aa497f65..80ea22b3 100644
--- a/crates/runtime/tests/test_ui.c
+++ b/crates/runtime/tests/test_ui.c
@@ -11,6 +11,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
+#include <unistd.h>
 
 int sz_view_paint(SzView *root, SkCanvas *canvas, int width, int height,
                   const SzTheme *theme);
@@ -1003,6 +1004,56 @@ static void test_session_inject_script(void) {
   remove(path);
 }
 
+static void test_session_inject_grows_past_4k(void) {
+  SzUiConfig cfg;
+  SzUiSession *session;
+  SzView *root, *btn;
+  SzSignalInt *count;
+  const char *path = "/tmp/scuzz_ui_inject_4k.script";
+  FILE *f;
+  int i;
+
+  remove(path);
+  count = sz_signal_int(0);
+  root = sz_view_column();
+  btn = sz_view_button("+", counter_tap, count);
+  sz_view_add_child(root, btn);
+
+  memset(&cfg, 0, sizeof(cfg));
+  cfg.kind = SZ_UI_RUNTIME_HEADLESS;
+  cfg.width = 200;
+  cfg.height = 100;
+  cfg.scale = 1.0;
+  session = sz_ui_mount(&cfg, root);
+  assert(session);
+  sz_ui_session_take_root(session);
+  assert(sz_ui_session_set_inject(session, path));
+  assert(sz_ui_pump_sync(session));
+  assert(sz_signal_int_get(count) == 0);
+
+  f = fopen(path, "w");
+  assert(f);
+  fputc('#', f);
+  for (i = 0; i < 4200; i++)
+    fputc('x', f);
+  fputc('\n', f);
+  fputs("tap 0\n", f);
+  fclose(f);
+  assert(sz_ui_pump_sync(session));
+  assert(sz_signal_int_get(count) == 1);
+
+  f = fopen(path, "a");
+  assert(f);
+  fputs("tap 0\n", f);
+  fclose(f);
+  assert(sz_ui_pump_sync(session));
+  assert(sz_signal_int_get(count) == 2);
+
+  sz_ui_unmount(session);
+  sz_signal_int_free(count);
+  remove(path);
+}
+
 static void test_session_inject_control(void) {
   SzUiConfig cfg;
   SzUiSession *session;
@@ -1295,6 +1346,10 @@ static void test_session_inject_type(void) {
   assert(sz_ui_pump_sync(session));
   assert(strcmp(sz_signal_str_get(draft), "abc") == 0);
 
+  write_stamp(path, "text x\ntype a\\nb\n");
+  assert(sz_ui_pump_sync(session));
+  assert(strcmp(sz_signal_str_get(draft), "xa\nb") == 0);
+
   sz_ui_unmount(session);
   sz_signal_str_free(draft);
   remove(path);
@@ -1444,6 +1499,46 @@ static void test_record_live_key(void) {
   remove(record);
 }
 
+static void test_record_type_escapes(void) {
+  SzUiConfig cfg;
+  SzUiSession *session;
+  SzView *root, *field;
+  SzSignalStr *draft;
+  SzInputEvent ev;
+  const char *record = "/tmp/scuzz_ui_record_type_esc.script";
+  char *body;
+
+  remove(record);
+  draft = sz_signal_str("");
+  root = sz_view_column();
+  field = sz_view_text_field(draft, "item");
+  sz_view_add_child(root, field);
+
+  memset(&cfg, 0, sizeof(cfg));
+  cfg.kind = SZ_UI_RUNTIME_HEADLESS;
+  cfg.width = 200;
+  cfg.height = 80;
+  cfg.scale = 1.0;
+  session = sz_ui_mount(&cfg, root);
+  assert(session);
+  sz_ui_session_take_root(session);
+  assert(sz_ui_session_set_record(session, record));
+  assert(sz_ui_pump_sync(session));
+
+  memset(&ev, 0, sizeof(ev));
+  ev.kind = SZ_INPUT_TEXT_EDIT;
+  ev.text = "a\nb";
+  assert(sz_ui_session_live_inject(session, &ev));
+  body = slurp_cstr(record);
+  assert(strstr(body, "type a\\nb") != NULL);
+  free(body);
+  assert(strcmp(sz_signal_str_get(draft), "a\nb") == 0);
+
+  sz_ui_unmount(session);
+  sz_signal_str_free(draft);
+  remove(record);
+}
+
 static void test_session_inject_key_repeat(void) {
   SzUiConfig cfg;
   SzUiSession *session;
@@ -2660,47 +2755,11 @@ static void test_clip_sizes_to_child(void) {
   sz_view_free(clip);
 }
 
-/* Skia N32 peek is RGBA on Darwin and BGRA on Linux. Map R/B once. */
-static int g_px_r = 0;
-static int g_px_b = 2;
-static int g_px_mapped;
-
-static void px_map_channels(void) {
-  SkSurface *surf;
-  SkCanvas *canvas;
-  SkPaint *paint;
-  const uint8_t *px;
-  size_t n = 0;
-  if (g_px_mapped)
-    return;
-  g_px_mapped = 1;
-  surf = sk_surface_make_raster_n32_premul(4, 4);
-  if (!surf)
-    return;
-  canvas = sk_surface_get_canvas(surf);
-  paint = sk_paint_new();
-  if (!canvas || !paint) {
-    if (paint)
-      sk_paint_delete(paint);
-    sk_surface_unref(surf);
-    return;
-  }
-  sk_paint_set_color(paint, sk_color_rgba(255, 0, 0, 255));
-  sk_canvas_draw_rect(canvas, 0, 0, 4, 4, paint);
-  px = sk_surface_peek_pixels(surf, &n);
-  if (px && n >= 4 && px[2] > 200 && px[0] < 50) {
-    g_px_r = 2;
-    g_px_b = 0;
-  }
-  sk_paint_delete(paint);
-  sk_surface_unref(surf);
-}
-
+/* Peek is row-major RGBA. */
 static int px_rgb(const uint8_t *px, int w, int x, int y, uint8_t r, uint8_t g,
                   uint8_t b) {
   const uint8_t *p = px + ((size_t)y * (size_t)w + (size_t)x) * 4;
-  px_map_channels();
-  return p[g_px_r] == r && p[1] == g && p[g_px_b] == b;
+  return p[0] == r && p[1] == g && p[2] == b;
 }
 
 static void test_clip_paint_contains_overflow(void) {
@@ -4434,10 +4493,9 @@ static void test_text_color_keeps_a11y(void) {
 
 static int row_has_red(const uint8_t *px, int w, int y, int x0, int x1) {
   int x;
-  px_map_channels();
   for (x = x0; x < x1; x++) {
     const uint8_t *p = px + ((size_t)y * (size_t)w + (size_t)x) * 4;
-    if (p[g_px_r] > 180 && p[1] < 80 && p[g_px_b] < 80)
+    if (p[0] > 180 && p[1] < 80 && p[2] < 80)
       return 1;
   }
   return 0;
@@ -4445,10 +4503,9 @@ static int row_has_red(const uint8_t *px, int w, int y, int x0, int x1) {
 
 static int row_has_blue(const uint8_t *px, int w, int y, int x0, int x1) {
   int x;
-  px_map_channels();
   for (x = x0; x < x1; x++) {
     const uint8_t *p = px + ((size_t)y * (size_t)w + (size_t)x) * 4;
-    if (p[g_px_b] > 180 && p[g_px_r] < 80 && p[1] < 80)
+    if (p[2] > 180 && p[0] < 80 && p[1] < 80)
       return 1;
   }
   return 0;
@@ -12318,6 +12375,49 @@ static void test_slider_pointer_drag(void) {
   sz_signal_int_free(sig);
 }
 
+static void test_replace_root_drops_pointer(void) {
+  SzUiConfig cfg;
+  SzUiSession *session;
+  SzView *root1, *root2, *sl;
+  SzSignalInt *sig;
+  SzInputEvent ev;
+  const SzTheme *theme = sz_theme_default();
+  SzRect f;
+  int64_t v0;
+
+  sig = sz_signal_int(0);
+  sl = sz_view_slider(sig);
+  root1 = sz_view_column();
+  sz_view_add_child(root1, sl);
+  memset(&cfg, 0, sizeof(cfg));
+  cfg.kind = SZ_UI_RUNTIME_HEADLESS;
+  cfg.width = 200;
+  cfg.height = 80;
+  cfg.scale = 1.0;
+  session = sz_ui_mount(&cfg, root1);
+  assert(session);
+  sz_ui_session_take_root(session);
+  assert(sz_ui_pump_sync(session));
+  sz_view_layout(root1, 200.f, 80.f, theme);
+  f = sz_view_frame(sl);
+  memset(&ev, 0, sizeof(ev));
+  ev.kind = SZ_INPUT_POINTER;
+  ev.pointer_phase = SZ_POINTER_DOWN;
+  ev.x = f.x + 4.f;
+  ev.y = f.y + f.h * 0.5f;
+  assert(sz_ui_inject_sync(session, &ev));
+  v0 = sz_signal_int_get(sig);
+  root2 = sz_view_column();
+  sz_view_add_child(root2, sz_view_text("after"));
+  assert(sz_ui_session_replace_root(session, root2));
+  ev.pointer_phase = SZ_POINTER_MOVE;
+  ev.x = f.x + f.w * 0.8f;
+  (void)sz_ui_inject_sync(session, &ev);
+  assert(sz_signal_int_get(sig) == v0);
+  sz_ui_unmount(session);
+  sz_signal_int_free(sig);
+}
+
 static void test_slider_live_records_xy(void) {
   SzUiConfig cfg;
   SzUiSession *session;
@@ -12845,6 +12945,28 @@ static void test_a11y(void) {
   }
 }
 
+static void test_a11y_dump_grows_past_4k(void) {
+  SzView *col;
+  SzString *dump;
+  char lab[64];
+  int i;
+  const char *s;
+
+  col = sz_view_column();
+  for (i = 0; i < 80; i++) {
+    snprintf(lab, sizeof lab, "L%02d-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+             i);
+    sz_view_add_child(col, sz_view_button(lab, NULL, NULL));
+  }
+  sz_view_add_child(col, sz_view_button("TAIL", NULL, NULL));
+  dump = sz_view_a11y_dump(col);
+  s = sz_string_cstr(dump);
+  assert(strlen(s) > 4096);
+  assert(strstr(s, "button:TAIL") != NULL);
+  sz_string_free(dump);
+  sz_view_free(col);
+}
+
 static void test_clear_children(void) {
   SzView *list;
   SzString *dump;
@@ -12893,6 +13015,39 @@ static void test_view_each(void) {
   sz_signal_list_free(items);
 }
 
+static void test_view_each_setlist_rebuilds(void) {
+  SzSignalList *items;
+  SzView *list;
+  const SzTheme *theme = sz_theme_default();
+  SzList *xs;
+  SzString *dump;
+  int i;
+
+  xs = sz_list_cons(sz_string_from_cstr("old"), sz_list_nil());
+  items = sz_signal_list(xs);
+  sz_release(xs);
+  list = sz_view_each(items);
+  sz_view_layout(list, 200.f, 120.f, theme);
+  dump = sz_view_a11y_dump(list);
+  assert(strstr(sz_string_cstr(dump), "text:- old") != NULL);
+  sz_string_free(dump);
+
+  xs = sz_list_cons(sz_string_from_cstr("new"), sz_list_nil());
+  sz_signal_list_set(items, xs);
+  sz_release(xs);
+  for (i = 0; i < 64; i++) {
+    SzList *t = sz_list_cons(sz_string_from_cstr("churn"), sz_list_nil());
+    sz_release(t);
+  }
+  sz_view_layout(list, 200.f, 120.f, theme);
+  dump = sz_view_a11y_dump(list);
+  assert(strstr(sz_string_cstr(dump), "text:- new") != NULL);
+  assert(strstr(sz_string_cstr(dump), "text:- old") == NULL);
+  sz_string_free(dump);
+  sz_view_free(list);
+  sz_signal_list_free(items);
+}
+
 static SzView *each_map_text(SzString *item, void *env) {
   (void)env;
   return sz_view_text(item ? sz_string_cstr(item) : "");
@@ -13186,6 +13341,119 @@ static void test_property_signal_str(void) {
   sz_signal_str_free(draft);
 }
 
+static void test_signal_dump_escapes(void) {
+  SzSignalStr *s;
+  SzSignalList *items;
+  SzList *xs;
+  SzString *dump;
+  SzString *name;
+  SzString *got;
+  const char *d;
+  char big[2001];
+  int i;
+
+  s = sz_signal_str("a\"b");
+  sz_signal_name(s, "q");
+  dump = sz_signal_dump();
+  d = sz_string_cstr(dump);
+  assert(strstr(d, "a\\\"b") != NULL);
+  sz_string_free(dump);
+
+  sz_signal_str_set(s, "a\nb");
+  dump = sz_signal_dump();
+  d = sz_string_cstr(dump);
+  assert(strstr(d, "a\\nb") != NULL);
+  sz_string_free(dump);
+
+  for (i = 0; i < 2000; i++)
+    big[i] = 'x';
+  big[2000] = '\0';
+  sz_signal_str_set(s, big);
+  dump = sz_signal_dump();
+  d = sz_string_cstr(dump);
+  assert(strlen(d) > 2000);
+  assert(strstr(d, big) != NULL);
+  sz_string_free(dump);
+  sz_signal_str_free(s);
+
+  xs = sz_list_cons(sz_string_from_cstr("a\"b"),
+                    sz_list_cons(sz_string_from_cstr("a\nb"), sz_list_nil()));
+  items = sz_signal_list(xs);
+  sz_signal_name(items, "xs");
+  dump = sz_signal_dump();
+  d = sz_string_cstr(dump);
+  assert(strstr(d, "a\\\"b") != NULL);
+  assert(strstr(d, "a\\nb") != NULL);
+  name = sz_string_from_cstr("xs");
+  assert(sz_property_signal_list_len(name) == 2);
+  got = sz_property_signal_list_at(name, 0);
+  assert(strcmp(sz_string_cstr(got), "a\"b") == 0);
+  sz_string_free(got);
+  got = sz_property_signal_list_at(name, 1);
+  assert(strcmp(sz_string_cstr(got), "a\nb") == 0);
+  sz_string_free(got);
+  sz_release(name);
+  sz_string_free(dump);
+  sz_signal_list_free(items);
+}
+
+static void test_signal_name_last_wins(void) {
+  SzSignalInt *a;
+  SzSignalInt *b;
+  SzString *name;
+
+  a = sz_signal_int(1);
+  b = sz_signal_int(2);
+  sz_signal_name(a, "n");
+  sz_signal_name(b, "n");
+  name = sz_string_from_cstr("n");
+  assert(sz_property_signal_int(name) == 2);
+  sz_release(name);
+  sz_signal_int_free(a);
+  sz_signal_int_free(b);
+}
+
+static void test_property_replay_str_list(void) {
+  SzSignalStr *draft;
+  SzSignalList *items;
+  SzList *xs;
+  SzString *name;
+  SzString *got;
+
+  setenv("SCUZZ_TESTRT", "1", 1);
+  sz_property_session_reset();
+  draft = sz_signal_str("old");
+  sz_signal_name(draft, "draft");
+  xs = sz_list_cons(sz_string_from_cstr("a"),
+                    sz_list_cons(sz_string_from_cstr("b"), sz_list_nil()));
+  items = sz_signal_list(xs);
+  sz_signal_name(items, "items");
+  sz_property_session_step();
+  sz_signal_str_set(draft, "new");
+  sz_signal_list_set(items, sz_list_nil());
+  name = sz_string_from_cstr("draft");
+  got = sz_property_signal_str(name);
+  assert(strcmp(sz_string_cstr(got), "new") == 0);
+  sz_string_free(got);
+  sz_timeline_replay_from(0);
+  got = sz_property_signal_str(name);
+  assert(strcmp(sz_string_cstr(got), "old") == 0);
+  sz_string_free(got);
+  sz_release(name);
+  name = sz_string_from_cstr("items");
+  assert(sz_property_signal_list_len(name) == 2);
+  got = sz_property_signal_list_at(name, 1);
+  assert(strcmp(sz_string_cstr(got), "b") == 0);
+  sz_string_free(got);
+  sz_timeline_replay_from(-1);
+  assert(sz_property_signal_list_len(name) == 0);
+  sz_release(name);
+  sz_property_session_reset();
+  unsetenv("SCUZZ_TESTRT");
+  sz_signal_str_free(draft);
+  sz_signal_list_free(items);
+}
+
 static void test_signal_list_spine_collect(void) {
   SzSignalList *items;
   SzList *xs;
@@ -14428,6 +14696,13 @@ static void test_session_load_code(void) {
   sz_ui_session_take_root(session);
   sz_ui_session_set_rebuild(session, NULL, count);
   assert(sz_ui_session_load_code(session, RELOAD_A));
+  {
+    char staged[128];
+    FILE *st;
+    snprintf(staged, sizeof staged, "%s.load-1", RELOAD_A);
+    st = fopen(staged, "rb");
+    assert(st == NULL);
+  }
   assert(sz_ui_session_reload(session));
   a11y = sz_view_a11y_dump(sz_ui_session_root(session));
   assert(strstr(sz_string_cstr(a11y), "text:A") != NULL);
@@ -14541,6 +14816,7 @@ int main(void) {
   test_record_live_scroll();
   test_studio_shaped_xy();
   test_session_inject_script();
+  test_session_inject_grows_past_4k();
   test_session_inject_control();
   test_session_dump_now_needs_path();
   test_session_inject_scroll();
@@ -14549,6 +14825,7 @@ int main(void) {
   test_session_inject_key();
   test_session_inject_key_utf8_backspace();
   test_record_live_key();
+  test_record_type_escapes();
   test_session_inject_key_repeat();
   test_session_inject_compose();
   test_record_live_hover_secondary();
@@ -15035,6 +15312,7 @@ int main(void) {
   test_slider_paint_fill();
   test_slider_in_taps_dump();
   test_slider_pointer_drag();
+  test_replace_root_drops_pointer();
   test_slider_live_records_xy();
   test_progress_sizes();
   test_progress_unbounded_width();
@@ -15060,8 +15338,10 @@ int main(void) {
   test_button_does_not_wrap();
   test_text_blank_line_from_newline();
   test_a11y();
+  test_a11y_dump_grows_past_4k();
   test_clear_children();
   test_view_each();
+  test_view_each_setlist_rebuilds();
   test_view_each_map_text();
   test_view_each_map_button();
   test_each_expanded_row_in_scroll();
@@ -15071,6 +15351,9 @@ int main(void) {
   test_property_signal_int();
   test_signal_list_record_dump();
   test_property_signal_str();
+  test_signal_dump_escapes();
+  test_signal_name_last_wins();
+  test_property_replay_str_list();
   test_text_field_edit();
   test_view_editor();
   test_view_editor_viewport();
diff --git a/docs/gaps.md b/docs/gaps.md
index 7ac1d9c1..07128fe2 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -35,9 +35,9 @@ These gaps keep the distinctive claims kernel-shaped. Close them in this order.
 
 1. **`Signal[T]` and `View.each` over records** — In: `Signal.list` holds `List[T]` over records and enums; `View.each` binds the element type; studio keeps tasks as `List[Item]`; a record list dumps `list[N] name = <count>`. Open: one generic cell — `Signal.map` stays `Int => String` and there is no non-list `Signal[T]` cell. Direction: one generic cell and `View.each` over the element type.
 
-2. **UTF-8 `String`** — In: `Str.*` indexes code points; `Str.byteLen` / `Str.byteSlice` keep bytes for framing; the kernel `utf8Ops` drive oracle proves multibyte ops. Case maps stay ASCII by design. Caret offsets in TextField/editor stay bytes. The editor and toolchain LSP framing uses `Str.byteLen` / `Str.byteSlice`. LLVM `[N x i8]` string sizing uses `Str.byteLen`.
+2. **UTF-8 `String`** — In: `Str.*` indexes code points; an isolated continuation byte counts as one code point; `Str.byteLen` / `Str.byteSlice` keep bytes for framing; pad cycles complete code points; the `Str` kit is closed; the kernel `utf8Ops` drive oracle proves multibyte ops. Case maps stay ASCII by design. Caret offsets in TextField/editor stay bytes. The editor and toolchain LSP framing uses `Str.byteLen` / `Str.byteSlice`. LLVM `[N x i8]` string sizing uses `Str.byteLen`.
 
-3. **Scuzz spans on panic and LSP** — In: `check` JSON diagnostics use recorded file stem, line, and column. No substring search. No hardcoded file. Product `scuzz lsp` is a stdio JSON-RPC server. It wraps `check`. JSON diagnostics stay the single schema. Goto-def uses `Fun.off`. Rename replaces lexer ident tokens. Hover names the ident under the caret. Completion filters by the caret prefix. Semantic tokens come from the lexer. Panic prints `scuzz panic: Main.scuzz:2:14: <msg>` from that def's file, line, and column. The dogfood IDE consumes that schema. It does not replace it.
+3. **Scuzz spans on panic and LSP** — In: `check` JSON diagnostics use recorded file stem, line, and column. No substring search. No hardcoded file. Product `scuzz lsp` is a stdio JSON-RPC server. It wraps `check`. JSON diagnostics stay the single schema. Overlay presence is a list entry. didChange reads full-sync `contentChanges`. Rename returns a WorkspaceEdit. Diagnostics run the check file list with overlays. Goto-def uses `Fun.off`. Rename replaces lexer ident tokens. Hover names the ident under the caret. Completion filters by the caret prefix from kit names and local defs. Semantic tokens come from the lexer. Panic prints `scuzz panic: Main.scuzz:2:14: <msg>` from that def's file, line, and column. The dogfood IDE consumes that schema. It does not replace it.
 
 4. **Typed fail `E`** — In: check encodes `IO[E, A]`. `IO[A]` means `IO[String, A]`. `IO.fail(e)` takes `E`. `handleErrorWith` binds `E`. `flatMap` keeps one `E`. Kits still fail with `String`. Open: the C `SzError` wire is still a string. Do not add `ZIO[R, E, A]`. Do not add user `IO.delay`.
 
@@ -62,7 +62,7 @@ Do not start these before thesis-critical gaps close.
 
 - **Stable inject keys** — `tap N` / `scroll N` follow a11y preorder. A refactor can miss a stored corpus entry. Named control keys for inject stay after named claim observations.
 - **Simulation world** — TestRuntime seals the wire (no live sockets; Nth Fs / Net / Queue fault; PCT on fibers; Clock and Fs fakes). Clock skew, partitions, and a model to relate against stay later.
-- **Mutation depth** — Mutation flips ops, swaps `if` arms, and replaces an ADT construct with a sibling. Inert mutants stay unreported. Semantic mutants stay later.
+- **Mutation depth** — Mutation flips ops, swaps `if` arms, swaps tap handler bodies, and walks impl methods. Inert mutants stay unreported. Semantic mutants stay later.
 - **Memory** — Last-use retain/release is locked in [`vision.md`](vision.md) GC. Values with no last-use stay allocated until panic sweep or process exit. No cycle collector.
 - **Dependency forms beyond `path`** — Path deps only (`Manifest.scuzz`). Git, versioned, and hosted artifacts are direction. There is no registry. Revisit after path deps and file-as-module stay the reuse story. A lockfile identity can land before a registry.
 - **Windows desktop embedder** — same session protocol as X11/Cocoa. Secondary platform.
diff --git a/docs/guide.md b/docs/guide.md
index 32174f7a..a504147f 100644
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -19,13 +19,13 @@ scuzz ide --headless .       # bundled editor; Desktop without --headless
 scuzz fmt                    # rewrite src/ (check already verifies format)
 ```
 
-Default `[ui]` link uses the pinned Skia CPU prebuilt (`third_party/skia/PIN`). Checkout builds fetch it on first `ffi-skia` make. Opt out with `SCUZZ_SKIA=sk_sw`. `SCUZZ_SKIA=gpu` presents through OpenGL. Missing OpenGL fails with one install line.
+Default `[ui]` link uses the pinned Skia CPU prebuilt (`third_party/skia/PIN`). Checkout builds fetch it on first `ffi-skia` make and compile the in-tree shim into that archive. Opt out with `SCUZZ_SKIA=sk_sw`. `SCUZZ_SKIA=gpu` presents through OpenGL. Missing OpenGL fails with one install line.
 
 From a prebuilt tarball (no checkout build): `RELEASE_TGZ=scuzz-<triple>.tar.gz ./scripts/install.sh`. Produce one with `./scripts/package_release.sh`. That script compiles `examples/cli` with the newest GitHub `v*` bootstrap. Override with `SCUZZ_BOOTSTRAP_TAG` or `SCUZZ_BOOTSTRAP`. `install.sh --help` lists flags and the `curl | sh` invocation.
 
 `scuzz new --ui` scaffolds `scuzz.toml` with `[ui]`, a Counter-shaped `src/Main.scuzz`, and Headless-friendly defaults.
 
-`scuzz ide [path]` launches the bundled `[ui]` editor (`examples/editor` in a checkout; `SCUZZ_HOME/ide` from a release). Desktop is the default. `--headless` stays a peer. Pass a file or a project directory. A directory lists as the tree root and opens `src/Main.scuzz` when that file exists, else the first `.scuzz` file in `src/` or in the directory. A dir tap expands or collapses children in place. Nested rows indent. The toolbar wraps. Tabs list each open file. Save all writes dirty tabs. Run and Fuzz append captured text to the output list. Palette lists Save, Check, Find, Complete, Hover, Format, Def, Rename, Fix, Save all, Run, and Fuzz. A tap on a tree or diagnostic row focuses that list. ArrowUp / ArrowDown move among sibling rows when no overlay is open. Enter / Space activate. There is no `scuzz-ide` binary.
+`scuzz ide [path]` launches the bundled `[ui]` editor (`SCUZZ_IDE` if set, else `SCUZZ_HOME/ide` from a release, else `examples/editor` in a checkout). Desktop is the default. `--headless` stays a peer. Pass a file or a project directory. A directory lists as the tree root and opens `src/Main.scuzz` when that file exists, else the first `.scuzz` file in `src/` or in the directory. A dir tap expands or collapses children in place. Nested rows indent. The toolbar wraps. Tabs list each open file. Save all writes dirty tabs. Run and Fuzz append captured text to the output list. Palette lists Save, Check, Find, Complete, Hover, Format, Def, Rename, Fix, Save all, Run, and Fuzz. A tap on a tree or diagnostic row focuses that list. ArrowUp / ArrowDown move among sibling rows when no overlay is open. Enter / Space activate. There is no `scuzz-ide` binary.
 
 `scuzz package --target host` writes a Mobile host shell under `build/package/host`. `scuzz package --target android` packs a debug APK (needs the NDK and the Android SDK) into `build/package/android/`. When adb lists a device, the same command installs the APK. A USB serial wins over an emulator. No device is not a failure. Missing NDK or SDK fails with one install line. `scuzz package --target ios` builds a signed iOS simulator `.app` (needs Xcode) into `build/package/ios/`. Missing Xcode fails with one install line. A package that calls Net fails: mobile shells do not link OpenSSL. `[ui].bundle_id` is the Android package and iOS bundle id. The iOS and Android shells send typed text to TextField. SurfaceView taps on Android enter the same pump as iOS touches.
 
@@ -38,23 +38,23 @@ scuzz test                   # compile + SCUZZ_TESTRT=1 exit-0 smoke
 scuzz run
 ```
 
-Console kit: `Sys.args(): IO[List[String]]`, `Sys.readLine(): IO[String]` (EOF → `""`; live parks on poll), `Sys.read(n): IO[String]` (n stdin bytes; fewer at EOF), `Sys.write(s): IO[Unit]` (stdout, no newline), `Sys.exec(cmd): IO[(Int, String, String)]` (exit code plus captured stdout and stderr; live parks on poll; fails under TestRuntime), `Sys.spawn(cmd): IO[Int]` (pid plus stdin/stdout pipes; fails under TestRuntime), `Sys.childWrite(pid, s): IO[Unit]`, `Sys.childRead(pid, n): IO[String]` (n child-stdout bytes; fewer at EOF; parks on poll), `Sys.childClose(pid): IO[Unit]` (close child stdin), `Sys.alive(pid): IO[Int]`, `Sys.kill(pid): IO[Unit]` (SIGTERM live; fake table under TestRuntime), `IO.println`. Watch files with `IO.sleep` / `Clock.monotonic` plus `Fs.read` / `Fs.exists` / `Fs.list`. There is no `Fs.watch`. TestRuntime fakes Clock and Fs so the same poll loop runs under Headless. Under `SCUZZ_TESTRT=1`, TestRuntime scripts stdin (`SCUZZ_TESTRT_STDIN` or `sz_testrt_stdin_feed`), optionally overrides argv, and captures println (still echoes to live stdout). `Sys.write` captures and does not write live stdout. `Sys.getenv` reads a sealed map (empty unless `SCUZZ_TESTRT_ENV` injects keys). `Sys.alive` / `Sys.kill` use a fake process table (no host `waitpid` / `kill`). Net uses stubs, injected serve paths, and a virtual loopback mailbox (no live sockets). See `examples/io` and `examples/hello`.
+Console kit: `Sys.args(): IO[List[String]]`, `Sys.readLine(): IO[String]` (EOF → `""`; live parks on poll), `Sys.read(n): IO[String]` (n stdin bytes; fewer at EOF), `Sys.write(s): IO[Unit]` (stdout, no newline), `Sys.exec(cmd): IO[(Int, String, String)]` (exit code plus captured stdout and stderr; live parks on poll; 1 MiB cap fails; cancel reaps the child; fails under TestRuntime), `Sys.spawn(cmd): IO[Int]` (pid plus stdin/stdout pipes; stderr stays the parent stderr; fails under TestRuntime), `Sys.childWrite(pid, s): IO[Unit]`, `Sys.childRead(pid, n): IO[String]` (n child-stdout bytes; fewer at EOF; unknown pid fails; parks on poll), `Sys.childClose(pid): IO[Unit]` (close child stdin), `Sys.alive(pid): IO[Int]`, `Sys.kill(pid): IO[Unit]` (SIGTERM live; waitpid WNOHANG; slot stays until reaped; fake table under TestRuntime), `IO.println`. Watch files with `IO.sleep` / `Clock.monotonic` plus `Fs.read` / `Fs.exists` / `Fs.list`. There is no `Fs.watch`. `Fs.delete` removes a file or a directory tree. It refuses `/` and `.` after canonicalization. TestRuntime fakes Clock and Fs so the same poll loop runs under Headless. Under `SCUZZ_TESTRT=1`, TestRuntime scripts stdin (`SCUZZ_TESTRT_STDIN` or `sz_testrt_stdin_feed`), optionally overrides argv, and captures println (still echoes to live stdout). `Sys.write` captures and does not write live stdout. `Sys.getenv` reads a sealed map (empty unless `SCUZZ_TESTRT_ENV` injects keys). `Sys.alive` / `Sys.kill` use a fake process table (no host `waitpid` / `kill`). Net uses stubs, injected serve paths, and a virtual loopback mailbox (no live sockets). See `examples/io` and `examples/hello`.
 
 ## Kernel language (what you write)
 
 - `@main def main: IO[Unit] = …` entry; top-level `def` helpers
 - **`for { x = e; y <- io; if pred } yield r`** as the primary binder (pure `=`, effect `<-`). `(a, b) = e` / `(a, b, c) = e` and `(a, b) <- e` unpack a tuple of 2 through 8 slots. `Point(x, y) = p`, `Opt.Some(n) <- e`, and `h :: t = xs` unpack the same way. A miss panics. `if pred` keeps the rest when `pred` is true (`pred` is Bool). A miss is `IO.fail`. The `for` needs a `<-` binder. Nested `for` in `if` / lambda arms when multi-bind is needed.
 - No `val` / statement blocks. `{ case … }` is a lambda, not a block.
-- Literals: ints, floats (`1.5`, `1.5e-3`, `1e10`), hex (`0xFF`), binary (`0b1010`), digit separators (`1_000`, `0xFF_00`), `true` / `false`, strings, triple-quoted strings (`"""…"""` / `s"""…$x…"""`), `()`, `s"…$x…"`, list literals `[a, b]`, cons `h :: t` (`List.cons`), tuple of 2 through 8 slots `(a, b)`
-- Types: `Unit`, `Int`, `Float`, `String`, `Bool`, `Builder`, `List[T]`, `Option[T]`, `Map[K, V]`, `Set[T]`, `(A, B, …)`, `IO[T]`, `IO[E, A]`, `A => B`, `Fiber[A]` / `Ref[A]` / `Queue[A]` / `Deferred[A]` / `Resource[A]` / `Stream[A]`, nominal enums. `true` / `false` are `Bool`. `Bool` is not `Int`. `if` needs `Bool`. An `if` may omit `else` when the then arm is `Unit` or `IO[Unit]` (`if (ok) IO.println("y")`). Comparisons and `&&` / `||` return `Bool`. `==` / `!=` on String, List, Map, Set, tuples, enums, and records compare by value. Blessed handles compare by identity. Unary `!` is Bool. Unary `-` is Int or Float. Unary `~` and bitwise `&` / `|` / `^` / `<<` / `>>` are Int. Hex (`0xFF`) and binary (`0b1010`) are Int literals. Underscore may separate digits (`1_000`, `0xFF_00`). Scientific notation is a Float (`1.5e-3`, `1e10`). Triple-quoted strings (`"""…"""` / `s"""…$x…"""`) keep newlines. Identifiers may start with `_` (`_n`). Lone `_` discards. Call arguments may use `name = expr` (`add(m = 2, n = 1)`, `Point(y = 4, x = 3)`). Positionals come first. Named arguments fill remaining parameters by name. A `def` parameter may have a default (`add(n: Int, m: Int = 1)`, `greet(name: String, punct: String = "!")`). Omitted trailing arguments use the default. Named calls may omit any parameter that has a default. Defaults are closed expressions (no parameter names). Properties, traits, and methods do not take defaults. A call may end with a comma. An expression may pin its type with `e: T` (`Opt.None: Opt[Int]`, `[]: List[Int]`, `1 + 2: Int`). The checker uses `T` as the expected type. A typed position may construct with a bare uppercase case name (`None: Option[Int]`, `Some(1)`, `if (ok) Some(n) else None`). A lambda may pin its parameter with `(x: T) =>` (`List.map(xs, (n: Int) => Str.fromInt(n))`). The annotation must match the expected kit or `A => B` parameter type. A lambda may unpack a tuple of 2 through 8 slots with `(a, b) =>`. A kit or `A => B` argument may use one `_` hole (`List.map(xs, _ + 1)`, `List.map(xs, Str.fromInt(_))`, `List.filter(xs, _ != "b")`). `_ + _` is rejected. `_ =>` still discards. A kit or `A => B` argument may be a case lambda (`{ case Opt.Some(n) => n case Opt.None => 0 }`, `{ case Some(n) => n case None => 0 }`, `io.map({ case 0 => "z" case _ => "n" })`). It matches the bound value. Exhaustiveness is the same as match. A kit or `A => B` argument may be a unary def (`List.map(xs, Str.fromInt)`, `apply(id, 3)`). A def with 2 through 8 params eta-expands as `(A, B, …) => R` (`List.foldLeft(xs, 0, add)`, `applyPair(add, 2, 3)`). A `for` binder or def may name an `A => B` value (`inc = (_ + 1): Int => Int`, `typed = (n: Int) => n + 1`, `def addN(n: Int): Int => Int = (m: Int) => n + m`). `f(x)` applies that value. `f(x, y)` applies `(A, B) => C`. An `A => B` expression applies with `e(x)` on one line (`plusOne()(5)`, `addN(3)(4)`, `((n: Int) => n + 1)(6)`). An `(A, B) => C` expression applies with `e(x, y)` (`((a, b) => a + b)(2, 3)`). Pass a named Fun to a kit or `A => B` parameter (`List.map(xs, eta)`, `apply(inc, 5)`, `apply(plusOne(), 6)`). `{ … }` without `case` is illegal. `Option[T]` is `None` or `Some(x)` (`enum Option[T]: None | Some(x: T)`). `attempt` returns `IO[Result[A]]` (`enum Result[T]: Err(msg: String) | Ok(value: T)`). `handleErrorWith(err => …)` binds `err` as `String`. `IO.fail(e)` takes `E`. `IO[A]` means `IO[String, A]`. An `if` or match arm may be `IO.fail` next to another `IO[T]`. `io.map(f)` maps a success (`IO.pure(1).map(n => n + 1)`). The body is pure `B`. The result is `IO[B]`. `Float.fromInt(n)` and `Float.toInt(x)` convert (truncate toward zero). `s"$x"` interpolates `String`, `Int`, and `Float`. `Map.set` / `Map.get` / `Map.getOrElse` / `Map.contains` / `Map.remove` / `Map.keys` / `Map.values` / `Map.size` / `Map.isEmpty` / `Map.nonEmpty` / `Map.union` / `Map.intersect` / `Map.diff` / `Map.filter` / `Map.mapValues` / `Map.exists` / `Map.forall` and `Set.add` / `Set.contains` / `Set.remove` / `Set.toList` / `Set.size` / `Set.isEmpty` / `Set.nonEmpty` / `Set.union` / `Set.intersect` / `Set.diff` / `Set.isSubset` / `Set.isDisjoint` / `Set.filter` / `Set.map` / `Set.exists` / `Set.forall` are persistent (keys `Int` or `String`). `Builder.empty` / `Builder.append` / `Builder.result` assemble a string in linear time (`append` is pure copy-on-write). `Oracle.sumTo(n)` is a closed-form Int (`n*(n+1)/2` for `n >= 0`). A drive oracle may compare a Scuzz loop to that kit. The compare stays in-process. It does not use `Sys.exec`. `Map.get` is a list of the value, or empty. `Set.union` keeps keys from both sets. `Set.intersect` keeps keys in both. `Set.diff` keeps keys in the first set that are missing from the second. `Set.isSubset(a, b)` is true when every key of `a` is in `b`. Empty `a` is a subset. `Set.isDisjoint(a, b)` is true when `a` and `b` share no key. Empty is disjoint. `Map.union` keeps keys from both maps and takes values from the second map. `Map.intersect` keeps keys in both and takes values from the first map. `Map.diff` keeps keys in the first map that are missing from the second. `Map.filter(m, pred)` keeps entries whose value matches `pred`. Empty stays empty. `Map.mapValues(m, f)` maps each value. `Map.exists` / `Map.forall` test values (empty exists is false; empty forall is true). `Set.filter(s, pred)` keeps keys that match `pred`. `Set.map(s, f)` maps each key (`Int` or `String`; duplicates collapse). `Set.exists` / `Set.forall` test keys.
-- Enums + **`record Name(f1: T1, …)`** (construct `Name(…)`, match `case Name(…)`, field `p.x`, update `p.copy(y = 9)` — see `examples/kernel`). `.copy` rebuilds the record. Named overrides select fields. Positionals fill fields in order. Omitted fields keep the receiver values. Matching an enum or record must cover every case or include `_`. `case Pat if pred =>` keeps the arm only when `pred` is true. `pred` is `Bool`. A guarded arm does not cover the pattern. Match may use a literal pattern (`case 0 =>`, `case "ok" =>`, `case true =>`). `true` and `false` together cover Bool. Int, Float, and String literals do not cover the type. Include `_` or a name bind. Match may use an or-pattern (`case Color.Red | Color.Blue =>`). Nested or in a payload works (`case Opt.Some(0 | 1)`). The body must typecheck for every alternative. Match may use an as-pattern (`case n @ Opt.Some(_)`). `n` binds the whole value. Nested as in a payload works (`case Opt.Some(n @ 0)`). `n @ A | B` binds `n` for every alternative. Match may use a list pattern (`case [] =>`, `case x :: xs =>`, `case [a, b] =>`). `[]` and `_ :: _` together cover `List`. Match may use a tuple of 2 through 8 slots pattern (`case (a, b)`). `(A, B, …)` is exhaustive. `p._1` … `p._N` project slots. A `for` binder and a lambda may unpack (`(a, b) = e`, `(a, b) <- e`, `(a, b) =>`, `Point(x, y) = p`, `Opt.Some(n) <- e`, `h :: t = xs`, `(Opt.Some(n)) =>`). Nested tuples are allowed. A miss panics. `IO.both` is `IO[(A, B)]`. `IO.race` needs matching `IO[T]` arms. `IO.fail` may fill one arm. Match may use a named field pattern (`case Point(x = n)`, `case Opt.Some(x = n)`). Omitted fields are `_`. Positionals come first. A named field after a positional is allowed (`case Point(n, y = 0)`). Match may use a bare constructor name that starts with an uppercase letter (`case None`, `case Some(n)`, `case Red | Blue`). The scrutinee type selects the case. A lowercase name still binds. `check` reports `non-exhaustive match: missing Color.Blue`. Nested payload patterns work (`case Wrap.Box(Color.Red)` / `case Opt.Some(0)`). A specialized nested case without a catch-all is non-exhaustive (`missing Wrap.Box(Color.Blue)`).
+- Literals: ints, floats (`1.5`, `1.5e-3`, `1e10`), hex (`0xFF`), binary (`0b1010`), digit separators (`1_000`, `0xFF_00`), `true` / `false`, strings, triple-quoted strings (`"""…"""`), `()`, `s"…$x…"`, list literals `[a, b]`, cons `h :: t` (`List.cons`), tuple of 2 through 8 slots `(a, b)`
+- Types: `Unit`, `Int`, `Float`, `String`, `Bool`, `Builder`, `List[T]`, `Option[T]`, `Map[K, V]`, `Set[T]`, `(A, B, …)`, `IO[T]`, `IO[E, A]`, `A => B`, `Fiber[A]` / `Ref[A]` / `Queue[A]` / `Deferred[A]` / `Resource[A]` / `Stream[A]`, nominal enums. `true` / `false` are `Bool`. `Bool` is not `Int`. `if` needs `Bool`. An `if` may omit `else` when the then arm is `Unit` or `IO[Unit]` (`if (ok) IO.println("y")`). Comparisons and `&&` / `||` return `Bool`. `==` / `!=` on String, List, Map, Set, tuples, enums, and records compare by value. Blessed handles compare by identity. Unary `!` is Bool. Unary `-` is Int or Float. Unary `~` and bitwise `&` / `|` / `^` / `<<` / `>>` are Int. Hex (`0xFF`) and binary (`0b1010`) are Int literals. Underscore may separate digits (`1_000`, `0xFF_00`). Scientific notation is a Float (`1.5e-3`, `1e10`). Triple-quoted strings (`"""…"""`) keep newlines. Use `s"…$x…"` for interpolation. The dialect has no line comments. Identifiers may start with `_` (`_n`). Lone `_` discards. Call arguments may use `name = expr` (`add(m = 2, n = 1)`, `Point(y = 4, x = 3)`). Positionals come first. Named arguments fill remaining parameters by name. A `def` parameter may have a default (`add(n: Int, m: Int = 1)`, `greet(name: String, punct: String = "!")`). Omitted trailing arguments use the default. Named calls may omit any parameter that has a default. Defaults are closed expressions (no parameter names). Properties, traits, and methods do not take defaults. A call may end with a comma. An expression may pin its type with `e: T` (`Opt.None: Opt[Int]`, `[]: List[Int]`, `1 + 2: Int`). The checker uses `T` as the expected type. A typed position may construct with a bare uppercase case name (`None: Option[Int]`, `Some(1)`, `if (ok) Some(n) else None`). A lambda may pin its parameter with `(x: T) =>` (`List.map(xs, (n: Int) => Str.fromInt(n))`). The annotation must match the expected kit or `A => B` parameter type. A lambda may unpack a tuple of 2 through 8 slots with `(a, b) =>`. A kit or `A => B` argument may use one `_` hole (`List.map(xs, _ + 1)`, `List.map(xs, Str.fromInt(_))`, `List.filter(xs, _ != "b")`). `_ + _` is rejected. `_ =>` still discards. A kit or `A => B` argument may be a case lambda (`{ case Opt.Some(n) => n case Opt.None => 0 }`, `{ case Some(n) => n case None => 0 }`, `io.map({ case 0 => "z" case _ => "n" })`). It matches the bound value. Exhaustiveness is the same as match. A kit or `A => B` argument may be a unary def (`List.map(xs, Str.fromInt)`, `apply(id, 3)`). A def with 2 through 8 params eta-expands as `(A, B, …) => R` (`List.foldLeft(xs, 0, add)`, `applyPair(add, 2, 3)`). A `for` binder or def may name an `A => B` value (`inc = (_ + 1): Int => Int`, `typed = (n: Int) => n + 1`, `def addN(n: Int): Int => Int = (m: Int) => n + m`). `f(x)` applies that value. `f(x, y)` applies `(A, B) => C`. An `A => B` expression applies with `e(x)` on one line (`plusOne()(5)`, `addN(3)(4)`, `((n: Int) => n + 1)(6)`). An `(A, B) => C` expression applies with `e(x, y)` (`((a, b) => a + b)(2, 3)`). Pass a named Fun to a kit or `A => B` parameter (`List.map(xs, eta)`, `apply(inc, 5)`, `apply(plusOne(), 6)`). `{ … }` without `case` is illegal. `Option[T]` is `None` or `Some(x)` (`enum Option[T]: None | Some(x: T)`). `attempt` returns `IO[Result[A]]` (`enum Result[T]: Err(msg: String) | Ok(value: T)`). `handleErrorWith(err => …)` binds `err` as `String`. `IO.fail(e)` takes `E`. `IO[A]` means `IO[String, A]`. An `if` or match arm may be `IO.fail` next to another `IO[T]`. `io.map(f)` maps a success (`IO.pure(1).map(n => n + 1)`). The body is pure `B`. The result is `IO[B]`. `Float.fromInt(n)` and `Float.toInt(x)` convert (truncate toward zero). `s"$x"` interpolates `String`, `Int`, and `Float`. `Map.set` / `Map.get` / `Map.getOrElse` / `Map.contains` / `Map.remove` / `Map.keys` / `Map.values` / `Map.size` / `Map.isEmpty` / `Map.nonEmpty` / `Map.union` / `Map.intersect` / `Map.diff` / `Map.filter` / `Map.mapValues` / `Map.exists` / `Map.forall` and `Set.add` / `Set.contains` / `Set.remove` / `Set.toList` / `Set.size` / `Set.isEmpty` / `Set.nonEmpty` / `Set.union` / `Set.intersect` / `Set.diff` / `Set.isSubset` / `Set.isDisjoint` / `Set.filter` / `Set.map` / `Set.exists` / `Set.forall` are persistent (keys `Int` or `String`). `Builder.empty` / `Builder.append` / `Builder.result` assemble a string in linear time (`append` is pure copy-on-write). `Oracle.sumTo(n)` is a closed-form Int (`n*(n+1)/2` for `n >= 0`). A drive oracle may compare a Scuzz loop to that kit. The compare stays in-process. It does not use `Sys.exec`. `Map.get` is `Option[V]`. A miss is `None`. A stored empty list is `Some`. `Set.union` keeps keys from both sets. `Set.intersect` keeps keys in both. `Set.diff` keeps keys in the first set that are missing from the second. `Set.isSubset(a, b)` is true when every key of `a` is in `b`. Empty `a` is a subset. `Set.isDisjoint(a, b)` is true when `a` and `b` share no key. Empty is disjoint. `Map.union` keeps keys from both maps and takes values from the second map. `Map.intersect` keeps keys in both and takes values from the first map. `Map.diff` keeps keys in the first map that are missing from the second. `Map.filter(m, pred)` keeps entries whose value matches `pred`. Empty stays empty. `Map.mapValues(m, f)` maps each value. `Map.exists` / `Map.forall` test values (empty exists is false; empty forall is true). `Set.filter(s, pred)` keeps keys that match `pred`. `Set.map(s, f)` maps each key (`Int` or `String`; duplicates collapse). The output key kind comes from the mapped key. `Set.exists` / `Set.forall` test keys.
+- Enums + **`record Name(f1: T1, …)`** (construct `Name(…)`, match `case Name(…)`, field `p.x`, update `p.copy(y = 9)` — see `examples/kernel`). `.copy` rebuilds the record. Named overrides select fields. Positionals fill fields in order. Omitted fields keep the receiver values. Matching an enum or record must cover every case or include `_`. `case Pat if pred =>` keeps the arm only when `pred` is true. `pred` is `Bool`. A guarded arm does not cover the pattern. Match may use a literal pattern (`case 0 =>`, `case "ok" =>`, `case true =>`). `true` and `false` together cover Bool. Int, Float, and String literals do not cover the type. Include `_` or a name bind. Match may use an or-pattern (`case Color.Red | Color.Blue =>`). Nested or in a payload works (`case Opt.Some(0 | 1)`). The body must typecheck for every alternative. Match may use an as-pattern (`case n @ Opt.Some(_)`). `n` binds the whole value. Nested as in a payload works (`case Opt.Some(n @ 0)`). `n @ A | B` binds `n` for every alternative. Match may use a list pattern (`case [] =>`, `case x :: xs =>`, `case [a, b] =>`). `[]` and `_ :: _` together cover `List`. Match may use a tuple of 2 through 8 slots pattern (`case (a, b)`). `(A, B, …)` is exhaustive. `e._1` … `e._N` project slots of any tuple expression. A `for` binder and a lambda may unpack (`(a, b) = e`, `(a, b) <- e`, `(a, b) =>`, `Point(x, y) = p`, `Opt.Some(n) <- e`, `h :: t = xs`, `(Opt.Some(n)) =>`). Nested tuples are allowed. A miss panics. `IO.both` is `IO[(A, B)]`. `IO.race` needs matching `IO[T]` arms. `IO.fail` may fill one arm. Match may use a named field pattern (`case Point(x = n)`, `case Opt.Some(x = n)`). Omitted fields are `_`. Positionals come first. A named field after a positional is allowed (`case Point(n, y = 0)`). Match may use a bare constructor name that starts with an uppercase letter (`case None`, `case Some(n)`, `case Red | Blue`). The scrutinee type selects the case. A lowercase name still binds. `check` reports `non-exhaustive match: missing Color.Blue`. Nested payload patterns work (`case Wrap.Box(Color.Red)` / `case Opt.Some(0)`). A specialized nested case without a catch-all is non-exhaustive (`missing Wrap.Box(Color.Blue)`).
 - Thin **traits** / `impl` with static dispatch (`p.show()` / `p.getOrElse(0)` — including `impl Get[Int] for Point` and `impl Get[T] for Opt`; see `examples/kernel`)
 - Thin **generics**: `def id[T](x: T): T = x` monomorphized at call sites (`examples/kernel`); generic enums/records too — `enum Opt[T]:` with `o.getOrElse(0)` / `record Box[T](x: T): def get(): T = self.x` (type methods are indented `def`s after cases or after record `:`, same shape as `impl`). Instantiation inferred from ctor args, the expected type, or `e: T` (`examples/kernel`).
 - **Type aliases**: `type UserId = Int` / `type BoxList[T] = List[T]`. The checker expands the name in params, returns, and `e: T`. `import Module.UserId` binds the alias.
-- Blessed impurity only: `IO.println` / `sleep` / `fail` / `pure` / `race` / `both` / `ensure` / `timeout` / `forever` / `repeatN` / `retryN` / `foreach` / `foreachDiscard` / `when` / `unless`, `.map` / `.flatMap` / `.handleErrorWith` / `.attempt`, `Fiber.fork` / `join` / `interrupt`, `Ref.*` / `Queue.*` / `Deferred.*` (`Ref.of` infers `A`; pin `Queue[Int]` / `Deferred[Int]` with `: IO[Queue[Int]]`; `Ref.update` / `Ref.updateAndGet`), `Resource.make` / `Resource.use` (`Resource[A]` from acquire `IO[A]`; release on success, failure, and cancel), `Stream.emit` / `emits` / `eval` / `concat` / `map` / `evalMap` / `evalTap` / `filter` / `filterNot` / `take` / `takeWhile` / `drop` / `dropWhile` / `find` / `findLast` / `exists` / `forall` / `none` / `range` / `repeatN` / `zip` / `zipWith` / `zipAll` / `zipWithIndex` / `interleave` / `intersperse` / `grouped` / `sliding` / `takeRight` / `dropRight` / `flatten` / `flatMap` / `mapConcat` / `scan` / `fold` / `changes` / `orElse` / `iterate` / `unfold` / `head` / `last` / `count` / `compileToList` / `drain` (`Stream[A]` from emit/emits/eval/range/iterate/unfold; `exists` / `forall` / `none` are `IO[Bool]`; `fold` is `IO[Z]`; `head` / `last` are `IO[A]` and fail when empty; `count` is `IO[Int]`; `zip` / `zipAll` are `Stream[(A, B)]`; `interleave` is `Stream[A]`; `grouped` / `sliding` are `Stream[List[A]]`), `Fs.*`, `Json.parse` / `Json.stringify` (enum `Json`: `Null|Bool|Int|Float|Str|Arr|Obj`; `parse` is `Result[Json]`; `stringify` is `Result[String]`; query: `get` / `keys` / `arr` / `at` / `has` / `pairs` / `is*` / `as*` / `*Or` / `getBool` / `getInt` / `getStr` / `getFloat` / `merge`; write: `set` / `remove` / `append` / `prepend` / `setAt` / `dropAt`; a miss is an empty list; `set` on a non-Obj is a one-key Obj; `append` / `prepend` on a non-Arr is a one-cell Arr), `Sys.args` / `Sys.readLine` / `Sys.read` / `Sys.write` / `Sys.exec` / `Sys.spawn` / `Sys.childWrite` / `Sys.childRead` / `Sys.childClose` / `Sys.alive` / `Sys.kill` / `Sys.getenv`, `Clock.*`, `Random.nextInt` (`IO[Int]` in `[0, bound)`), `Net.httpGet` / `Net.httpPost` / `Net.httpPut` / `Net.httpPatch` / `Net.httpDelete` / `Net.httpHead` / `Net.serveOnce` / `Net.serve` (handler receives `(path, method, body)` and returns the response body as `IO[String]`) / `Net.tcpConnect` / `Net.tcpListen` / `Net.tcpAccept` / `Net.tcpRead` / `Net.tcpWrite` / `Net.tcpClose` / `Net.udpBind` / `Net.udpSend` / `Net.udpRecv` / `Net.udpClose`
+- Blessed impurity only: `IO.println` / `sleep` / `fail` / `pure` / `race` / `both` / `ensure` / `timeout` / `forever` / `repeatN` / `retryN` / `foreach` / `foreachDiscard` / `when` / `unless`, `.map` / `.flatMap` / `.handleErrorWith` / `.attempt`, `Fiber.fork` / `join` / `interrupt`, `Ref.*` / `Queue.*` (`Ref.of` infers `A`; pin `Queue[Int]` with `: IO[Queue[Int]]`; `Ref.update` / `Ref.updateAndGet`), `Deferred.empty` / `get` / `complete` / `fail` (`Deferred.get` returns `IO[A]` when the handle is `Deferred[A]`; pin with `: IO[Deferred[Int]]`; `fail` takes a `String` message), `Resource.make` / `Resource.use` (`Resource[A]` from acquire `IO[A]`; release on success, failure, and cancel), `Stream.emit` / `emits` / `eval` / `concat` / `map` / `evalMap` / `evalTap` / `filter` / `filterNot` / `take` / `takeWhile` / `drop` / `dropWhile` / `find` / `findLast` / `exists` / `forall` / `none` / `range` / `repeatN` / `zip` / `zipWith` / `zipAll` / `zipWithIndex` / `interleave` / `intersperse` / `grouped` / `sliding` / `takeRight` / `dropRight` / `flatten` / `flatMap` / `mapConcat` / `scan` / `fold` / `changes` / `orElse` / `iterate` / `unfold` / `head` / `last` / `count` / `compileToList` / `drain` (`Stream[A]` from emit/emits/eval/range/iterate/unfold; bind a Stream with `=`; `<-` needs IO; `take` pulls until n outputs; range / iterate / unfold allocate on pull; unfold cap is 65536 pulled steps; `exists` / `forall` / `none` are `IO[Bool]`; `fold` is `IO[Z]`; `head` / `last` are `IO[A]` and fail when empty; `count` is `IO[Int]`; `zip` / `zipAll` are `Stream[(A, B)]`; `interleave` is `Stream[A]`; `grouped` / `sliding` are `Stream[List[A]]`), `Fs.*`, `Json.parse` / `Json.stringify` (enum `Json`: `Null|Bool|Int|Float|Str|Arr|Obj`; `parse` is `Result[Json]`; `stringify` is `Result[String]`; query: `get` / `keys` / `arr` / `at` / `has` / `pairs` / `is*` / `as*` / `*Or` / `getBool` / `getInt` / `getStr` / `getFloat` / `merge`; write: `set` / `remove` / `append` / `prepend` / `setAt` / `dropAt`; a miss is an empty list; `set` on a non-Obj is a one-key Obj; `append` / `prepend` on a non-Arr is a one-cell Arr), `Sys.args` / `Sys.readLine` / `Sys.read` / `Sys.write` / `Sys.exec` / `Sys.spawn` / `Sys.childWrite` / `Sys.childRead` / `Sys.childClose` / `Sys.alive` / `Sys.kill` / `Sys.getenv`, `Clock.*`, `Random.nextInt` (`IO[Int]` in `[0, bound)`; bound <= 0 is `IO.fail`), `Net.httpGet` / `Net.httpPost` / `Net.httpPut` / `Net.httpPatch` / `Net.httpDelete` / `Net.httpHead` / `Net.serveOnce` / `Net.serve` (handler receives `(path, method, body)` and returns the response body as `IO[String]`) / `Net.tcpConnect` / `Net.tcpListen` / `Net.tcpAccept` / `Net.tcpRead` / `Net.tcpWrite` / `Net.tcpClose` / `Net.udpBind` / `Net.udpSend` / `Net.udpRecv` / `Net.udpClose`
 - No raw side effects in View build. Taps may run `IO` through `sz_io_unsafe_run`. The tap drops a leftover owned value or the run result.
 
-The product CLI is Scuzz (`examples/cli`). `scuzz --help` and `scuzz <command> --help` list flags and examples. `scuzz check` is the linter (format-verify + typecheck). `scuzz fmt` rewrites. `scuzz watch` rebuilds on source change. It does not reload a running process. `[ui]` `scuzz run --watch` is hot reload: it keeps the process and stamp-reloads the View tree (Signals stay). IO-only `scuzz run --watch` kills and reruns the process on source change. `[ui]` build emits `build/reload.dylib`. On source change, watch recompiles it then stamps so the session `dlopen`s new machine code (`SCUZZ_UI_RELOAD_CODE`). The process rewrites `build/debug.dump` (signal store + a11y including live `View.bindText` + `[taps]` with frames / `[fields]` plus `caret=B sel=A:C` (and `preedit=` when compose is set) / `[editor]` buffer plus `caret=B sel=A:C sx=X sy=Y lines=L` when a `View.editor` is present (plus `diag=` / `tok=` / `inlay=` / `fold=` / `preedit=` when set) / `[scrolls]` inject indices, same format as `scuzz test` goldens; `[last_hit]` after a TAP; `[hover]` after a no-button MOVE; `[last_secondary]` after a button-3 click; `[session]` kind/size/title/focus/lifecycle/pumps; `[splits]` / `[overlays]` when present; `[heap]` alloc stats with kind census, delta, and `[live]` remaining blocks) on dirty pumps so agents can read live UI state, `tap N` without guessing coordinates, and see which TextField `text` / `type` / `key` / `compose` / `caret` / `select` / `backspace` hit (`N* placeholder="live" caret=B sel=A:C`). A `View.editor` dumps under `[editor]` (`N* caret=B sel=A:C sx=X sy=Y lines=L "buffer"`). Newlines stay as `\n`. Diagnostic marks append `diag=P:S`. LSP span counts append `tok=N` / `inlay=N` / `fold=N` when non-zero. Compose appends `preedit="…"` when the preview is non-empty. Append `tap` / `xy` / `text` / `type` / `key` / `compose` / `commit` / `caret` / `select` / `copy` / `cut` / `paste` / `drag` / `hover` / `secondary` / `pump` / `scroll` / `backspace` / `dump` / `reload` / `quit` / `resetpeak` lines to `build/inject.script` to drive the session (rewrite plays the whole file). `dump` rewrites the debug dump now. `reload` rebuilds the View factory. `quit` stops the live session. Desktop quit is window close. `resetpeak` sets peak bytes to live and marks the heap delta. Panic prints remaining `[heap]` and `[live]`, writes `build/debug.dump.panic` when a live dump path is set, then frees remaining live blocks and abort. `text N s` / `type N s` / `backspace N k` / `caret N b` / `select N a c` / `scroll N dy` target dump index N. `key <name>[+shift|+ctrl|+cmd|+alt|+repeat] [text]` uses the starred field or focused editor (`Enter`, `Backspace`, `ArrowLeft`, `a`). `+repeat` is a held-key auto-repeat (same insert / move / delete as a discrete key). `compose <text>` sets IME preedit (underlined preview; not in the committed buffer). `compose` with no text, or `commit`, inserts the preedit at the caret. `key Escape` cancels preedit. `caret <n>` sets the starred-field or focused-editor caret byte offset. `caret N b` targets dump index N. `select <a> <c>` sets the starred-field selection. `copy` / `cut` / `paste` / `paste <s>` drive the session clipboard. Headless `paste` is first-class. Desktop/Mobile pull the OS pasteboard on paste when present. `drag x1 y1 x2 y2` is pointer-drag select. Live OS keys record as `key`, not `type`. Live OS auto-repeat records `key a+repeat`. Live OS copy/cut/paste and Shift+arrows record those verbs. One-token forms (`text s`, `backspace k`, `scroll 40`) still use the starred field or first Scroll. `text 0` remains payload `"0"`. `xy x y` injects a TAP at a logical point; a miss does not panic. `hover x y` injects a pointer MOVE with no button and shows `View.tooltip`. `secondary N` / `secondary x y` is a button-3 click; it does not fire the primary tap. Live OS hover and right-click record as `hover` / `secondary`. Desktop/Mobile `scuzz run` records live OS clicks and keys to `build/record.script` (not `inject.script`) and writes `build/debug.dump`. Replay with `scuzz run --headless --script build/record.script --dump build/debug.dump`. `--message-format=json` applies to `check` only. That JSON is the editor protocol.
+The product CLI is Scuzz (`examples/cli`). `scuzz --help` and `scuzz <command> --help` list flags and examples. `scuzz check` is the linter (format-verify + typecheck). `scuzz fmt` rewrites. `scuzz watch` rebuilds on source change. It does not reload a running process. `[ui]` `scuzz run --watch` is hot reload: it keeps the process and stamp-reloads the View tree (Signals stay). IO-only `scuzz run --watch` kills and reruns the process on source change. `[ui]` build emits `build/reload.dylib`. On source change, watch recompiles it then stamps so the session `dlopen`s new machine code (`SCUZZ_UI_RELOAD_CODE`). The process rewrites `build/debug.dump` (signal store + a11y including live `View.bindText` + `[taps]` with frames / `[fields]` plus `caret=B sel=A:C` (and `preedit=` when compose is set) / `[editor]` buffer plus `caret=B sel=A:C sx=X sy=Y lines=L` when a `View.editor` is present (plus `diag=` / `tok=` / `inlay=` / `fold=` / `preedit=` when set) / `[scrolls]` inject indices, same format as `scuzz test` goldens; `[last_hit]` after a TAP; `[hover]` after a no-button MOVE; `[last_secondary]` after a button-3 click; `[session]` kind/size/title/focus/lifecycle/pumps; `[splits]` / `[overlays]` when present; `[heap]` alloc stats with kind census, delta, and `[live]` remaining blocks) on dirty pumps so agents can read live UI state, `tap N` without guessing coordinates, and see which TextField `text` / `type` / `key` / `compose` / `caret` / `select` / `backspace` hit (`N* placeholder="live" caret=B sel=A:C`). A `View.editor` dumps under `[editor]` (`N* caret=B sel=A:C sx=X sy=Y lines=L "buffer"`). Newlines stay as `\n`. Signal dump strings and inject `type` / `paste` / `compose` payloads escape backslash, quote, newline, CR, and tab. Diagnostic marks append `diag=P:S`. LSP span counts append `tok=N` / `inlay=N` / `fold=N` when non-zero. Compose appends `preedit="…"` when the preview is non-empty. Append `tap` / `xy` / `text` / `type` / `key` / `compose` / `commit` / `caret` / `select` / `copy` / `cut` / `paste` / `drag` / `hover` / `secondary` / `pump` / `scroll` / `backspace` / `dump` / `reload` / `quit` / `resetpeak` lines to `build/inject.script` to drive the session (rewrite plays the whole file). `dump` rewrites the debug dump now. `reload` rebuilds the View factory. `quit` stops the live session. Desktop quit is window close. `resetpeak` sets peak bytes to live and marks the heap delta. Panic prints remaining `[heap]` and `[live]`, writes `build/debug.dump.panic` when a live dump path is set, then frees remaining live blocks and abort. `text N s` / `type N s` / `backspace N k` / `caret N b` / `select N a c` / `scroll N dy` target dump index N. `key <name>[+shift|+ctrl|+cmd|+alt|+repeat] [text]` uses the starred field or focused editor (`Enter`, `Backspace`, `ArrowLeft`, `a`). `+repeat` is a held-key auto-repeat (same insert / move / delete as a discrete key). `compose <text>` sets IME preedit (underlined preview; not in the committed buffer). `compose` with no text, or `commit`, inserts the preedit at the caret. `key Escape` cancels preedit. `caret <n>` sets the starred-field or focused-editor caret byte offset. `caret N b` targets dump index N. `select <a> <c>` sets the starred-field selection. `copy` / `cut` / `paste` / `paste <s>` drive the session clipboard. Headless `paste` is first-class. Desktop/Mobile pull the OS pasteboard on paste when present. `drag x1 y1 x2 y2` is pointer-drag select. Live OS keys record as `key`, not `type`. Live OS auto-repeat records `key a+repeat`. Live OS copy/cut/paste and Shift+arrows record those verbs. One-token forms (`text s`, `backspace k`, `scroll 40`) still use the starred field or first Scroll. `text 0` remains payload `"0"`. `xy x y` injects a TAP at a logical point; a miss does not panic. `hover x y` injects a pointer MOVE with no button and shows `View.tooltip`. `secondary N` / `secondary x y` is a button-3 click; it does not fire the primary tap. Live OS hover and right-click record as `hover` / `secondary`. Desktop/Mobile `scuzz run` records live OS clicks and keys to `build/record.script` (not `inject.script`) and writes `build/debug.dump`. Replay with `scuzz run --headless --script build/record.script --dump build/debug.dump`. `--message-format=json` applies to `check` only. That JSON is the editor protocol.
 
 ## View + Signal + Ui
 
@@ -72,9 +72,9 @@ Build a pure `View` tree. Hold state in `Signal`. Run a session with `Ui.run`:
   } yield ()
 ```
 
-Lists: keep a `Signal.list`, render with `View.each(items)` (framework rebuilds `- item` texts at layout). `View.each(items, s => view)` builds one child per element. The element type comes from the signal (`Signal.list(xs)` over `List[T]` binds `T`; record fields like `item.label` work in the body). String lists dump `["a", "b"]`; other element types dump the count as `list[N] <name> = <count>`. `List.filter(xs, pred)` keeps elements for which `pred` is true. `List.map(xs, f)` builds a new list. The filter/map/flatMap/find/findLast/exists/count/takeWhile/dropWhile/forall/filterNot/indexWhere/lastIndexWhere/span/partition/prefixLength/segmentLength/sortBy/maxBy/minBy/groupBy/distinctBy/`IO.foreach`/`IO.foreachDiscard` lambda binds the element type. `Ref.update` / `Ref.updateAndGet` bind the cell. `Map.filter` / `Map.exists` / `Map.forall` / `Map.mapValues` bind the value. `Set.filter` / `Set.exists` / `Set.forall` / `Set.map` bind the key. `List.tabulate(n, f)` binds `Int`. `List.setAt(xs, i, v)` replaces the element at `i`. An index outside the list leaves the list. `List.take(xs, n)` keeps the first `n` elements (`n` <= 0 is empty). `List.drop(xs, n)` skips `n` (`n` <= 0 leaves the list). `List.find(xs, pred)` is a list of the first match, or empty. `List.exists(xs, pred)` is true when any element matches. `List.takeWhile(xs, pred)` keeps a prefix while `pred` is true. `List.dropWhile(xs, pred)` skips that prefix. `List.forall(xs, pred)` is true when every element matches (empty is true). `List.filterNot(xs, pred)` keeps elements for which `pred` is false. `List.count(xs, pred)` is the number of matches. `List.flatMap(xs, f)` concatenates the lists that `f` returns. `List.padTo(xs, n, x)` appends `x` until length `n`. `n` <= len leaves the list. `List.nonEmpty(xs)` is true when the list has a cell. `List.empty()` is Nil. `List.len(xs)` is the cell count. `List.head(xs)` is `Option[T]`. Empty is `None`. `List.at(xs, i)` is the element at `i`. An index outside panics. `List.tail(xs)` drops the first cell. Empty panics. `List.join(xs, sep)` joins string cells. `List.concat(xs, ys)` copies the `xs` spine and shares `ys`. `List.flatten(xss)` concatenates inner lists. `List.takeRight(xs, n)` keeps the last `n` elements (`n` <= 0 is empty). `List.dropRight(xs, n)` drops the last `n` (`n` <= 0 leaves the list). `List.init(xs)` drops the last cell (empty stays empty). `List.last(xs)` is a list of the last element, or empty. `List.getOrElse(xs, i, default)` is the element at `i`, or `default` when `i` is out of range. `List.fill(n, x)` is `n` copies of `x` (`n` <= 0 is empty). `List.range(from, until)` is boxed ints `[from, until)` (empty when `until` <= `from`). `List.tabulate(n, f)` is `f(0)` … `f(n-1)` (`n` <= 0 is empty). `List.intersperse(xs, x)` inserts `x` between cells. Empty or one cell shares. `List.grouped(xs, n)` is chunks of length `n`. The last chunk may be short. `n` <= 0 is empty. `List.sliding(xs, n)` is overlapping windows of length `n`. `n` <= 0 or `n` > len is empty. `List.slice(xs, from, until)` is `[from, until)`. Negative `from` / `until` is 0. `until` <= `from` is empty. `List.indexWhere(xs, pred)` is the first matching index, or `-1`. `List.lastIndexWhere(xs, pred)` is the last matching index, or `-1`. `List.indices(xs)` is boxed ints `[0, len)`. Empty when `xs` is empty. `List.splitAt(xs, n)` is two lists: take then drop, packed as `List[List[T]]`. `List.span(xs, pred)` is takeWhile then dropWhile. `List.partition(xs, pred)` is filter then filterNot. `List.inits(xs)` is prefixes including empty and the full list. `List.tails(xs)` is suffixes including the full list and empty. `List.zip(xs, ys)` is `List[(A, B)]`. A and B may differ. It stops at the shorter list. `List.interleave(xs, ys)` alternates cells from `xs` and `ys`, then appends the leftover. Empty or one list shares. `List.zipAll(xs, ys, x, y)` pads the shorter list with `x` or `y`. `List.unzip(pairs)` is `(List[A], List[B])`. Empty unzip is two empty lists. `List.zipWithIndex(xs)` is `List[(Int, T)]`. `List.foldLeft(xs, z, f)` folds with `f(acc, x)` and returns `z` when `xs` is empty. `List.foldRight(xs, z, f)` folds with `f(x, acc)` from the right. `List.scanLeft(xs, z, f)` is the list of accumulators including `z`. Empty is `[z]`. `List.scanRight(xs, z, f)` scans from the right. `List.reduceLeft(xs, f)` folds from the first cell. Empty panics. `List.reduceRight(xs, f)` folds from the last cell. Empty panics. `List.transpose(xss)` turns rows into columns. It stops at the shortest row. Empty `xss` is empty. `List.contains(xs, x)` is true when a cell equals `x`. Strings and boxed ints compare by value. `List.indexOf(xs, x)` is the first matching index, or `-1`. `List.lastIndexOf(xs, x)` is the last matching index, or `-1`. `List.distinct(xs)` keeps the first cell of each equal value. `List.distinctBy(xs, f)` keeps the first cell of each `Int` or `String` key that `f` returns. Empty stays empty. `List.toMap(pairs)` is `Map[K, V]` from `List[(K, V)]`. Duplicate keys keep the last value. Empty is empty. `List.toSet(xs)` is `Set[T]` from `List[Int]` or `List[String]`. Duplicate cells collapse. Empty is empty. `Map.toList(m)` is `List[(K, V)]` in key order. Empty is empty. `List.diff(xs, ys)` keeps cells of `xs` that are missing from `ys`. `List.intersect(xs, ys)` keeps cells of `xs` that occur in `ys`. `List.startsWith(xs, prefix)` is true when `xs` begins with `prefix`. Empty prefix is true. `List.endsWith(xs, suffix)` is true when `xs` ends with `suffix`. Empty suffix is true. `List.sameElements(xs, ys)` is true when both lists have the same cells in order. `List.patch(xs, from, other, replaced)` replaces `replaced` cells from `from` with `other`. Negative `from` / `replaced` is 0. `from` past the end appends `other`. `List.findLast(xs, pred)` is a list of the last match, or empty. `List.prefixLength(xs, pred)` is the length of the leading prefix where `pred` is true. `List.segmentLength(xs, pred, from)` is that length starting at `from`. Negative `from` is 0. `from` past the end is 0. `List.indexOfSlice(xs, slice)` is the first index of `slice`, or `-1`. Empty slice is 0. `List.lastIndexOfSlice(xs, slice)` is the last such index, or `-1`. Empty slice is the length. `List.isDefinedAt(xs, i)` is true when `i` is a valid index. `List.lengthCompare(xs, n)` is negative when the list is shorter than `n`, 0 when equal, and positive when longer. `List.sort(xs)` orders `Int` or `String` cells. Empty stays empty. Equal cells keep their order. `List.sortBy(xs, f)` orders by the `Int` key that `f` returns. `List.max(xs)` / `List.min(xs)` is the greatest / least `Int` or `String` cell. Empty panics. `List.maxBy(xs, f)` / `List.minBy(xs, f)` picks by that `Int` key. A tie keeps the first cell. `List.groupBy(xs, f)` groups cells by the `Int` or `String` key that `f` returns. Map keys sort. Cells in a group keep their order. Empty is empty. `List.sum(xs)` adds `Int` cells. Empty is 0. `List.product(xs)` multiplies `Int` cells. Empty is 1. `IO.foreach(xs, f)` runs `f` on each cell in order and is `IO[List[U]]`. Empty is an empty list. Failure or cancel stops later cells. `IO.foreachDiscard(xs, f)` is `IO[Unit]`. `IO.when(cond, io)` runs `io` when `cond` is true. Else it is `IO.pure(())`. `IO.unless` inverts the cond. `Ref.of(x)` is `IO[Ref[A]]`. `Ref.update(r, f)` / `Ref.updateAndGet(r, f)` apply `f` to the cell. Pin `Queue[Int]` / `Deferred[Int]` with `: IO[Queue[Int]]`. A missing pin is String. `Map.filter(m, pred)` keeps entries whose value matches `pred`. `Map.mapValues(m, f)` maps each value. `Map.exists(m, pred)` is true when any value matches. `Map.forall(m, pred)` is true when every value matches (empty is true). `Set.filter(s, pred)` keeps keys that match `pred`. `Set.map(s, f)` maps each key to an `Int` or `String` key. Duplicate keys collapse. `Set.exists(s, pred)` / `Set.forall(s, pred)` test keys. `Str.startsWith(s, prefix)` is `true` when `s` begins with `prefix`. `Str.contains(s, needle)` is true when `needle` occurs in `s`. `Str.endsWith(s, suffix)` is true when `s` ends with `suffix`. `Str.toInt(s, default)` parses base-10; junk or overflow uses `default`. `Str.replace(s, old, new)` replaces every non-overlapping `old`. Empty `old` leaves `s`. `Str.split(s, sep)` splits on non-overlapping `sep`. Empty `sep` copies `s` as one cell. `Str.isEmpty(s)` is true when `s` is empty. `Str.nonEmpty(s)` is true when `s` is not empty. `Str.toLower(s)` / `Str.toUpper(s)` map ASCII letters. Other bytes stay. `Str.capitalize(s)` maps the first ASCII letter to upper. Other bytes stay. Empty stays empty. `Str.repeat(s, n)` copies `s` `n` times (`n` <= 0 is empty). `Str.byteLen(s)` is the byte count; `Str.byteSlice(s, start, end)` copies that byte range. Use them for protocol framing (LSP `Content-Length` is bytes). All other `Str.*` index by code point. `Str.stripPrefix(s, prefix)` drops `prefix` when `s` starts with it. Else it copies `s`. `Str.stripSuffix(s, suffix)` drops `suffix` when `s` ends with it. Else it copies `s`. `Str.padLeft(s, n, pad)` / `Str.padRight(s, n, pad)` pad to width `n`. `n` <= len, or empty `pad`, copies `s`. `Str.isBlank(s)` is true when `s` has no bytes or only ASCII space, tab, CR, and LF. `Str.lastIndexOf(s, needle)` is the last start code-point index of `needle`, or `-1`. An empty needle is the length of `s`. `Str.take(s, n)` keeps the first `n` code points (`n` <= 0 is empty). `Str.drop(s, n)` skips `n` (`n` <= 0 copies `s`). `Str.takeRight(s, n)` keeps the last `n` code points. `Str.dropRight(s, n)` drops the last `n`. `Str.reverse(s)` reverses the code points. `Str.len(s)` is the code-point count. `Str.charAt(s, i)` is the code point at `i`, or `-1`. `Str.indexOf(s, needle)` is the first start code-point index, or `-1`. `Str.slice(s, start, end)` copies that code-point range. `Str.lines(s)` splits on CR/LF and drops empty lines. `List.reverse(xs)` copies the spine in reverse. `Str.trim(s)` drops leading and trailing ASCII space, tab, CR, and LF. `View.each` lambdas bind the element type. `Net.serve` lambdas bind `(String, String, String)` (path, method, body). `Stream.*` / `Resource.make` / `Resource.use` bind the payload. `Signal.map` / `List.tabulate` bind Int. The lambda body must return the kit result: `View` (`View.each` / `Ui.run`), `Bool` (filter / find / findLast / exists / takeWhile / dropWhile / forall / indexWhere / lastIndexWhere / span / partition / prefixLength / segmentLength / `Map.filter` / `Map.exists` / `Map.forall` / `Set.filter` / `Set.exists` / `Set.forall`), `Int` (`List.sortBy` / `List.maxBy` / `List.minBy`), `Int` or `String` (`List.groupBy` / `List.distinctBy` / `Set.map`), the mapped element (`List.map` / `List.tabulate` / `Map.mapValues` / `Stream.map`), `List` (`List.flatMap`), `String` (`Signal.map`; Int stringifies), or `IO` (`Resource` / `Net` / `Stream.evalMap` / `IO.foreach` / `IO.foreachDiscard`). `View.wrap(…)` lays out children left to right. A child that does not fit the remaining width starts a new run. Wrap sizes to the runs. `View.grid(n, …)` lays out children in `n` columns (`n` < `1` is one column). A new row starts after `n` shown children. Bounded width uses equal column slots. Height sizes to the rows. `View.scroll(child)` pans on y. Content lays out with unbounded height. Wrap a scroll list in `View.expanded(…)` inside a Column so it fills leftover height. `View.scrollH(child)` pans on x. Content lays out with unbounded width. Height sizes to the child. `scroll N dy` pans that scroll on its axis. In a Row, `View.expanded` takes leftover width. Scroll content is unbounded on the pan axis, so a Row inside a List keeps an intrinsic height. Expanded flex slots are tight. `View.stretch(child)` tightens the cross axis in a Column (width) or Row (height); the main axis stays intrinsic. Column and row do not stretch non-flex children unless wrapped in `View.stretch`. `View.center(child)` fills the max slot and centers the child. `View.align(ax, ay, child)` places the child (`0` start / `1` center / `2` end). `View.stack(…)` overlays children. `View.positioned(x, y, child)` offsets a Stack child. `View.padding(n, child)` insets uniformly. `View.sized(w, h, child)` is a tight slot. `View.minSize(w, h, child)` raises min size (`0` = no floor on that axis). `View.maxSize(w, h, child)` lowers max size (`0` = no cap on that axis). Incoming max still wins when tighter. `View.clip(child)` clips paint to the clip frame. Scroll uses the same clip. Do not add constraint-overflow dumps. `View.opacity(pct, child)` scales paint alpha (`0` = transparent, `100` = opaque). Nested opacity multiplies. `View.maxLines(n, child)` keeps at most `n` wrapped text lines (`0` = no cap). Nested caps take the tighter value. A11y still dumps the full string. Buttons and TextField stay one line. `View.ellipsis(child)` keeps extra lines off the paint. Without a positive `maxLines` it keeps one line. With `maxLines` it paints `...` on the last visible line when more text remains. A11y still dumps the full string. `View.textColor(color, child)` paints `View.text` / `View.bindText` with `color`. Nested `textColor` uses the inner color. Buttons and TextField stay on the theme. `View.gap(n, child)` sets Column/Row/Wrap/Grid/List spacing to `n` px (`0` = none). Nested `gap` uses the inner value. Without `View.gap`, Column/Row/Wrap/Grid/List use the theme gap. `View.fontSize(n, child)` sets `View.text` / `View.bindText` measure and paint size (`n` px, min `1`). Nested `fontSize` uses the inner size. Buttons and TextField stay on the theme font. `View.editor(sig)` paints a multiline buffer on `sig`. Insert and delete at the caret include newline and tab (two spaces). A11y dumps one `editor:editor` node. The dump uses `[editor]`, not `[fields]`. `View.split(frac, start, end)` is a row with a drag handle. `frac` is 0–100. `[splits]` dumps `N frac=F`. `View.overlay(open, child)` fills the parent when `open` is not 0. Compose it on `View.stack`. Escape and a backdrop tap write 0. Keys go to the overlay subtree while it is open. `[overlays]` dumps `N* open=0|1`. `View.focusGroup(child)` sizes to `child`. A tap on a descendant tap target focuses that list. ArrowUp / ArrowDown move among sibling taps when no overlay is open. Enter / Space activate the focused row. An open overlay still takes keys. `[session]` dumps `focus=button:<label>` for that row. A button tap clears TextField and editor focus. `Ui.setTitle(s)` sets the session title. `[session]` dumps `title=` and `focus=`. `Ui.setEditorCaret(line, col)` moves the first editor caret from a 1-based line and column. `Ui.setEditorDiagnostics(marks)` paints gutter marks from `(line, severity)` pairs. `Ui.setEditorTokens(data)` paints from the packed LSP `data` ints. Empty data keeps the lexer. `Ui.setEditorInlays(hints)` paints `(line, col, label)` at the cell. `Ui.setEditorFolds(ranges)` paints fold marks from `(start, end)` lines. `View.border(n, color, child)` paints an `n` px stroke in `color` inside the child frame (`0` = none). Nested border paints both. `View.radius(n, child)` clips paint to a rounded rect of `n` px (`0` = square). Nested radius uses the inner value. `View.checkbox(sig, label)` paints a box plus `label`. Tap flips `sig` between `0` and `1`. A11y dumps `checkbox:label=0` or `checkbox:label=1`. `[taps]` includes checkboxes so `tap N` hits them. `View.radio(sig, value, label)` paints a mark plus `label`. Tap writes `value` into `sig`. Radios that share `sig` form a group. A11y dumps `radio:label=0` or `radio:label=1`. `[taps]` includes radios. `View.slider(sig)` paints a track. Tap or pointer drag writes `sig` from the hit x, clamped `0`–`100`. A11y dumps `slider:n`. `[taps]` includes sliders so `tap N` hits them. `View.progress(sig)` paints a bar from `sig`, clamped `0`–`100`. It is not a tap target. A11y dumps `progress:n`. `View.switch(sig, label)` paints a track plus `label`. Tap flips `sig` between `0` and `1`. A11y dumps `switch:label=0` or `switch:label=1`. `[taps]` includes switches. `View.chip(sig, label)` paints `label` as a chip. Tap flips `sig` between `0` and `1`. A11y dumps `chip:label=0` or `chip:label=1`. `[taps]` includes chips. `View.filterChip(sig, label)` paints `label` as a chip with a leading check when on. Tap flips `sig` between `0` and `1`. A11y dumps `filterchip:label=0` or `filterchip:label=1`. `[taps]` includes filter chips. `View.choiceChip(sig, value, label)` paints `label` as a chip. Tap writes `value` into `sig`. Choice chips that share `sig` form a group with radios. A11y dumps `choicechip:label=0` or `choicechip:label=1`. `[taps]` includes choice chips. `View.actionChip(label, onTap)` paints `label` as a chip. Tap runs `onTap`. A11y dumps `actionchip:label`. `[taps]` includes action chips. `View.inputChip(sig, label)` paints `label` as a chip with a trailing X. Tap flips `sig` between `0` and `1`. A11y dumps `inputchip:label=0` or `inputchip:label=1`. `[taps]` includes input chips. `View.listTile(title)` is a full-width title row. `View.listTile(title, trailing)` places `trailing` on the right. It is not a tap target. A11y dumps `listtile:title`. `View.badge(sig, child)` paints a count from `sig` on the top-right of `child`. It sizes to the child. It is not a tap target. A11y dumps `badge:n`. `View.card(child)` paints a surface pad and a 1 px border around `child`. It is not a tap target. A11y dumps `card:card`. `View.divider()` paints a muted hairline in an 8 px slot. It is not a tap target. A11y dumps `divider:divider`. `View.expansionTile(sig, title, child)` paints a full-width header. Tap flips `sig` between `0` and `1`. `child` shows when `sig` is not `0`. A11y dumps `expansion:title=0` or `expansion:title=1`. `[taps]` includes expansion tiles. `View.iconButton(label, onTap)` paints a square control with `label`. Tap runs `onTap`. A11y dumps `iconbutton:label`. `[taps]` includes icon buttons. `View.verticalDivider()` paints a muted hairline in an 8 px slot. Height is the control height. It is not a tap target. A11y dumps `vdiv:vdiv`. `View.circularProgress(sig)` paints a square ring from `sig`, clamped `0`–`100`. It is not a tap target. A11y dumps `circular:n`. `View.avatar(label)` paints a disc with `label`. Height is the control height. It is not a tap target. A11y dumps `avatar:label`. `View.checkboxListTile(sig, title)` paints a full-width row with a box plus `title`. Tap flips `sig` between `0` and `1`. A11y dumps `checktile:title=0` or `checktile:title=1`. `[taps]` includes checkbox list tiles. `View.switchListTile(sig, title)` paints a full-width row with `title` and a trailing switch. Tap flips `sig` between `0` and `1`. A11y dumps `switchtile:title=0` or `switchtile:title=1`. `[taps]` includes switch list tiles. `View.radioListTile(sig, value, title)` paints a full-width row with a radio plus `title`. Tap writes `value` into `sig`. Radios that share `sig` form a group. A11y dumps `radiotile:title=0` or `radiotile:title=1`. `[taps]` includes radio list tiles. `View.segmented(sig, left, right)` paints a full-width row with two halves. Tap left writes `0` into `sig`. Tap right writes `1`. A11y dumps `segmented:0` or `segmented:1`. `[taps]` includes segmented rows. `View.fab(label, onTap)` is a circular tap. Tap runs the same closure as `View.button`. A11y dumps `fab:label`. `[taps]` includes fabs. `View.outlinedButton(label, onTap)` paints a surface fill and a border. Tap runs `onTap`. A11y dumps `outlined:label`. `[taps]` includes outlined buttons. `View.textButton(label, onTap)` paints `label` with no fill. Tap runs `onTap`. A11y dumps `textbutton:label`. `[taps]` includes text buttons. `View.tooltip(message, child)` sizes to `child`. It is not a tap target. A11y dumps `tooltip:message`. Child taps still fire. `View.placeholder(child)` sizes to `child`. It paints a muted box mark. It is not a tap target. A11y dumps `placeholder:ph`. Child taps still fire. `View.semantics(label, child)` sizes to `child`. It is not a tap target. A11y dumps `semantics:label`. Child taps still fire. `View.mergeSemantics(label, child)` sizes to `child`. It is not a tap target. A11y dumps `merge:label` and omits the child subtree. Child taps still fire. `View.inkWell(label, onTap, child)` sizes to `child`. Tap runs the same closure as `View.button`. A11y dumps `inkwell:label`. Child taps still fire. `[taps]` includes ink wells when the child is not a tap. `View.visibility(sig, child)` sizes to `child`. When `sig` is `0` it keeps that size, skips paint, and omits the child subtree from a11y. When `sig` is not `0` it paints the child. It is not a tap target. A11y dumps `visibility:0` or `visibility:1`. Child taps fire only when on. `View.offstage(sig, child)` lays out `child`. When `sig` is `0` it reports size `0`, skips paint, and omits the child subtree from a11y. The child still receives a layout pass. When `sig` is not `0` it sizes to the child and paints it. It is not a tap target. A11y dumps `offstage:0` or `offstage:1`. Child taps fire only when on. `View.unconstrainedBox(child)` sizes to `child`. The child lays out with unbounded max. Incoming max still clamps the box frame. It is not a tap target. A11y dumps `unconstrained:box`. Child taps still fire. `Color.rgb(r, g, b)` is opaque ARGB. `Color.rgba(r, g, b, a)` sets alpha (`0`–`255`). `View.ignorePointer(child)` skips hit-test on the subtree so taps pass through. `View.absorbPointer(child)` blocks taps without firing the child. `View.excludeSemantics(child)` omits the subtree from the a11y dump and from TextField collect. Taps still hit the child. `View.background(color, child)` paints `color` and sizes to the child. `View.text` wraps at newlines and at incoming max width; height sizes up. Buttons and TextField stay one line. `View.aspectRatio(rw, rh, child)` is the largest `rw:rh` box that fits incoming max. `View.fraction(wpct, hpct, child)` takes that percent of incoming max (`0` = size to child on that axis). See `examples/counter` and `examples/studio`.
+Lists: keep a `Signal.list`, render with `View.each(items)` (framework rebuilds `- item` texts at layout). `View.each(items, s => view)` builds one child per element. The element type comes from the signal (`Signal.list(xs)` over `List[T]` binds `T`; record fields like `item.label` work in the body). String lists dump `["a", "b"]`; other element types dump the count as `list[N] <name> = <count>`. `List.filter(xs, pred)` keeps elements for which `pred` is true. `List.map(xs, f)` builds a new list. The filter/map/flatMap/find/findLast/exists/count/takeWhile/dropWhile/forall/filterNot/indexWhere/lastIndexWhere/span/partition/prefixLength/segmentLength/sortBy/maxBy/minBy/groupBy/distinctBy/`IO.foreach`/`IO.foreachDiscard` lambda binds the element type. `Ref.update` / `Ref.updateAndGet` bind the cell. `Map.filter` / `Map.exists` / `Map.forall` / `Map.mapValues` bind the value. `Set.filter` / `Set.exists` / `Set.forall` / `Set.map` bind the key. `List.tabulate(n, f)` binds `Int`. `List.setAt(xs, i, v)` replaces the element at `i`. An index outside the list leaves the list. `List.take(xs, n)` keeps the first `n` elements (`n` <= 0 is empty). `List.drop(xs, n)` skips `n` (`n` <= 0 leaves the list). `List.find(xs, pred)` is a list of the first match, or empty. `List.exists(xs, pred)` is true when any element matches. `List.takeWhile(xs, pred)` keeps a prefix while `pred` is true. `List.dropWhile(xs, pred)` skips that prefix. `List.forall(xs, pred)` is true when every element matches (empty is true). `List.filterNot(xs, pred)` keeps elements for which `pred` is false. `List.count(xs, pred)` is the number of matches. `List.flatMap(xs, f)` concatenates the lists that `f` returns. `List.padTo(xs, n, x)` appends `x` until length `n`. `n` <= len leaves the list. `List.nonEmpty(xs)` is true when the list has a cell. `List.empty()` is Nil. `List.len(xs)` is the cell count. `List.head(xs)` is `Option[T]`. Empty is `None`. `List.at(xs, i)` is the element at `i`. An index outside panics. `List.tail(xs)` drops the first cell. Empty panics. `List.join(xs, sep)` joins `List[String]` cells. `List.concat(xs, ys)` copies the `xs` spine and shares `ys`. `List.flatten(xss)` concatenates inner lists. `List.takeRight(xs, n)` keeps the last `n` elements (`n` <= 0 is empty). `List.dropRight(xs, n)` drops the last `n` (`n` <= 0 leaves the list). `List.init(xs)` drops the last cell (empty stays empty). `List.last(xs)` is a list of the last element, or empty. `List.getOrElse(xs, i, default)` is the element at `i`, or `default` when `i` is out of range. `List.fill(n, x)` is `n` copies of `x` (`n` <= 0 is empty). `List.range(from, until)` is boxed ints `[from, until)` (empty when `until` <= `from`). `List.tabulate(n, f)` is `f(0)` … `f(n-1)` (`n` <= 0 is empty). `List.intersperse(xs, x)` inserts `x` between cells. Empty or one cell shares. `List.grouped(xs, n)` is chunks of length `n`. The last chunk may be short. `n` <= 0 is empty. `List.sliding(xs, n)` is overlapping windows of length `n`. `n` <= 0 or `n` > len is empty. `List.slice(xs, from, until)` is `[from, until)`. Negative `from` / `until` is 0. `until` <= `from` is empty. `List.indexWhere(xs, pred)` is the first matching index, or `-1`. `List.lastIndexWhere(xs, pred)` is the last matching index, or `-1`. `List.indices(xs)` is boxed ints `[0, len)`. Empty when `xs` is empty. `List.splitAt(xs, n)` is two lists: take then drop, packed as `List[List[T]]`. `List.span(xs, pred)` is takeWhile then dropWhile. `List.partition(xs, pred)` is filter then filterNot. `List.inits(xs)` is prefixes including empty and the full list. `List.tails(xs)` is suffixes including the full list and empty. `List.zip(xs, ys)` is `List[(A, B)]`. A and B may differ. It stops at the shorter list. `List.interleave(xs, ys)` alternates cells from `xs` and `ys`, then appends the leftover. Empty or one list shares. `List.zipAll(xs, ys, x, y)` pads the shorter list with `x` or `y`. `List.unzip(pairs)` is `(List[A], List[B])`. Empty unzip is two empty lists. `List.zipWithIndex(xs)` is `List[(Int, T)]`. `List.foldLeft(xs, z, f)` folds with `f(acc, x)` and returns `z` when `xs` is empty. `List.foldRight(xs, z, f)` folds with `f(x, acc)` from the right. `List.scanLeft(xs, z, f)` is the list of accumulators including `z`. Empty is `[z]`. `List.scanRight(xs, z, f)` scans from the right. `List.reduceLeft(xs, f)` folds from the first cell. Empty panics. `List.reduceRight(xs, f)` folds from the last cell. Empty panics. `List.transpose(xss)` turns rows into columns. It stops at the shortest row. Empty `xss` is empty. `List.contains(xs, x)` is true when a cell equals `x`. Strings and boxed ints compare by value. `List.indexOf(xs, x)` is the first matching index, or `-1`. `List.lastIndexOf(xs, x)` is the last matching index, or `-1`. `List.distinct(xs)` keeps the first cell of each equal value. `List.distinctBy(xs, f)` keeps the first cell of each `Int` or `String` key that `f` returns. Empty stays empty. `List.toMap(pairs)` is `Map[K, V]` from `List[(K, V)]`. Duplicate keys keep the last value. Empty is empty. `List.toSet(xs)` is `Set[T]` from `List[Int]` or `List[String]`. Duplicate cells collapse. Empty is empty. A non-empty list takes the key kind from the first cell. `Map.toList(m)` is `List[(K, V)]` in key order. Empty is empty. `List.diff(xs, ys)` keeps cells of `xs` that are missing from `ys`. `List.intersect(xs, ys)` keeps cells of `xs` that occur in `ys`. `List.startsWith(xs, prefix)` is true when `xs` begins with `prefix`. Empty prefix is true. `List.endsWith(xs, suffix)` is true when `xs` ends with `suffix`. Empty suffix is true. `List.sameElements(xs, ys)` is true when both lists have the same cells in order. `List.patch(xs, from, other, replaced)` replaces `replaced` cells from `from` with `other`. Negative `from` / `replaced` is 0. `from` past the end appends `other`. `List.findLast(xs, pred)` is a list of the last match, or empty. `List.prefixLength(xs, pred)` is the length of the leading prefix where `pred` is true. `List.segmentLength(xs, pred, from)` is that length starting at `from`. Negative `from` is 0. `from` past the end is 0. `List.indexOfSlice(xs, slice)` is the first index of `slice`, or `-1`. Empty slice is 0. `List.lastIndexOfSlice(xs, slice)` is the last such index, or `-1`. Empty slice is the length. `List.isDefinedAt(xs, i)` is true when `i` is a valid index. `List.lengthCompare(xs, n)` is negative when the list is shorter than `n`, 0 when equal, and positive when longer. `List.sort(xs)` orders `Int` or `String` cells. Empty stays empty. Equal cells keep their order. `List.sortBy(xs, f)` orders by the `Int` key that `f` returns. `List.max(xs)` / `List.min(xs)` is the greatest / least `Int` or `String` cell. Empty panics. `List.maxBy(xs, f)` / `List.minBy(xs, f)` picks by that `Int` key. A tie keeps the first cell. `List.groupBy(xs, f)` groups cells by the `Int` or `String` key that `f` returns. Map keys sort. Cells in a group keep their order. Empty is empty. `List.sum(xs)` adds `Int` cells. Empty is 0. `List.product(xs)` multiplies `Int` cells. Empty is 1. `IO.foreach(xs, f)` runs `f` on each cell in order and is `IO[List[U]]`. Empty is an empty list. Failure or cancel stops later cells. `IO.foreachDiscard(xs, f)` is `IO[Unit]`. `IO.when(cond, io)` runs `io` when `cond` is true. Else it is `IO.pure(())`. `IO.unless` inverts the cond. `Ref.of(x)` is `IO[Ref[A]]`. `Ref.update(r, f)` / `Ref.updateAndGet(r, f)` apply `f` to the cell. Pin `Queue[Int]` with `: IO[Queue[Int]]`. A missing pin is String. `Deferred.get` returns `IO[A]` when the handle is `Deferred[A]`. `Map.filter(m, pred)` keeps entries whose value matches `pred`. `Map.mapValues(m, f)` maps each value. `Map.exists(m, pred)` is true when any value matches. `Map.forall(m, pred)` is true when every value matches (empty is true). `Set.filter(s, pred)` keeps keys that match `pred`. `Set.map(s, f)` maps each key to an `Int` or `String` key. Duplicate keys collapse. The output key kind comes from the mapped key. `Set.exists(s, pred)` / `Set.forall(s, pred)` test keys. `Str.startsWith(s, prefix)` is `true` when `s` begins with `prefix`. `Str.contains(s, needle)` is true when `needle` occurs in `s`. `Str.endsWith(s, suffix)` is true when `s` ends with `suffix`. `Str.toInt(s, default)` parses base-10; junk or overflow uses `default`. `Str.fromBool(b)` is `"true"` or `"false"`. `Str.replace(s, old, new)` replaces every non-overlapping `old`. Empty `old` leaves `s`. `Str.split(s, sep)` splits on non-overlapping `sep`. Empty `sep` copies `s` as one cell. `Str.isEmpty(s)` is true when `s` is empty. `Str.nonEmpty(s)` is true when `s` is not empty. `Str.toLower(s)` / `Str.toUpper(s)` map ASCII letters. Other bytes stay. `Str.capitalize(s)` maps the first ASCII letter to upper. Other bytes stay. Empty stays empty. `Str.repeat(s, n)` copies `s` `n` times (`n` <= 0 is empty). `Str.byteLen(s)` is the byte count; `Str.byteSlice(s, start, end)` copies that byte range. Use them for protocol framing (LSP `Content-Length` is bytes). All other `Str.*` index by code point. `Str.stripPrefix(s, prefix)` drops `prefix` when `s` starts with it. Else it copies `s`. `Str.stripSuffix(s, suffix)` drops `suffix` when `s` ends with it. Else it copies `s`. `Str.padLeft(s, n, pad)` / `Str.padRight(s, n, pad)` pad to code-point width `n`. Fill cycles complete code points. `n` <= len, or empty `pad`, copies `s`. `Str.isBlank(s)` is true when `s` has no bytes or only ASCII space, tab, CR, and LF. `Str.lastIndexOf(s, needle)` is the last start code-point index of `needle`, or `-1`. An empty needle is the length of `s`. `Str.take(s, n)` keeps the first `n` code points (`n` <= 0 is empty). `Str.drop(s, n)` skips `n` (`n` <= 0 copies `s`). `Str.takeRight(s, n)` keeps the last `n` code points. `Str.dropRight(s, n)` drops the last `n`. `Str.reverse(s)` reverses the code points. `Str.len(s)` is the code-point count. `Str.charAt(s, i)` is the code point at `i`, or `-1`. `Str.indexOf(s, needle)` is the first start code-point index, or `-1`. `Str.slice(s, start, end)` copies that code-point range. `Str.lines(s)` splits on CR/LF and drops empty lines. `List.reverse(xs)` copies the spine in reverse. `Str.trim(s)` drops leading and trailing ASCII space, tab, CR, and LF. `View.each` lambdas bind the element type. `Net.serve` lambdas bind `(String, String, String)` (path, method, body). `Stream.*` / `Resource.make` / `Resource.use` bind the payload. `Signal.map` / `List.tabulate` bind Int. The lambda body must return the kit result: `View` (`View.each` / `Ui.run`), `Bool` (filter / find / findLast / exists / takeWhile / dropWhile / forall / indexWhere / lastIndexWhere / span / partition / prefixLength / segmentLength / `Map.filter` / `Map.exists` / `Map.forall` / `Set.filter` / `Set.exists` / `Set.forall`), `Int` (`List.sortBy` / `List.maxBy` / `List.minBy`), `Int` or `String` (`List.groupBy` / `List.distinctBy` / `Set.map`), the mapped element (`List.map` / `List.tabulate` / `Map.mapValues` / `Stream.map`), `List` (`List.flatMap`), `String` (`Signal.map`; Int stringifies), or `IO` (`Resource` / `Net` / `Stream.evalMap` / `IO.foreach` / `IO.foreachDiscard`). `View.wrap(…)` lays out children left to right. A child that does not fit the remaining width starts a new run. Wrap sizes to the runs. `View.grid(n, …)` lays out children in `n` columns (`n` < `1` is one column). A new row starts after `n` shown children. Bounded width uses equal column slots. Height sizes to the rows. `View.scroll(child)` pans on y. Content lays out with unbounded height. Wrap a scroll list in `View.expanded(…)` inside a Column so it fills leftover height. `View.scrollH(child)` pans on x. Content lays out with unbounded width. Height sizes to the child. `scroll N dy` pans that scroll on its axis. In a Row, `View.expanded` takes leftover width. Scroll content is unbounded on the pan axis, so a Row inside a List keeps an intrinsic height. Expanded flex slots are tight. `View.stretch(child)` tightens the cross axis in a Column (width) or Row (height); the main axis stays intrinsic. Column and row do not stretch non-flex children unless wrapped in `View.stretch`. `View.center(child)` fills the max slot and centers the child. `View.align(ax, ay, child)` places the child (`0` start / `1` center / `2` end). `View.stack(…)` overlays children. `View.positioned(x, y, child)` offsets a Stack child. `View.padding(n, child)` insets uniformly. `View.sized(w, h, child)` is a tight slot. `View.minSize(w, h, child)` raises min size (`0` = no floor on that axis). `View.maxSize(w, h, child)` lowers max size (`0` = no cap on that axis). Incoming max still wins when tighter. `View.clip(child)` clips paint to the clip frame. Scroll uses the same clip. Do not add constraint-overflow dumps. `View.opacity(pct, child)` scales paint alpha (`0` = transparent, `100` = opaque). Nested opacity multiplies. `View.maxLines(n, child)` keeps at most `n` wrapped text lines (`0` = no cap). Nested caps take the tighter value. A11y still dumps the full string. Buttons and TextField stay one line. `View.ellipsis(child)` keeps extra lines off the paint. Without a positive `maxLines` it keeps one line. With `maxLines` it paints `...` on the last visible line when more text remains. A11y still dumps the full string. `View.textColor(color, child)` paints `View.text` / `View.bindText` with `color`. Nested `textColor` uses the inner color. Buttons and TextField stay on the theme. `View.gap(n, child)` sets Column/Row/Wrap/Grid/List spacing to `n` px (`0` = none). Nested `gap` uses the inner value. Without `View.gap`, Column/Row/Wrap/Grid/List use the theme gap. `View.fontSize(n, child)` sets `View.text` / `View.bindText` measure and paint size (`n` px, min `1`). Nested `fontSize` uses the inner size. Buttons and TextField stay on the theme font. `View.editor(sig)` paints a multiline buffer on `sig`. Insert and delete at the caret include newline and tab (two spaces). A11y dumps one `editor:editor` node. The dump uses `[editor]`, not `[fields]`. `View.split(frac, start, end)` is a row with a drag handle. `frac` is 0–100. `[splits]` dumps `N frac=F`. `View.overlay(open, child)` fills the parent when `open` is not 0. Compose it on `View.stack`. Escape and a backdrop tap write 0. Keys go to the overlay subtree while it is open. `[overlays]` dumps `N* open=0|1`. `View.focusGroup(child)` sizes to `child`. A tap on a descendant tap target focuses that list. ArrowUp / ArrowDown move among sibling taps when no overlay is open. Enter / Space activate the focused row. An open overlay still takes keys. `[session]` dumps `focus=button:<label>` for that row. A button tap clears TextField and editor focus. `Ui.setTitle(s)` sets the session title. `[session]` dumps `title=` and `focus=`. `Ui.setEditorCaret(line, col)` moves the first editor caret from a 1-based line and column. `Ui.setEditorDiagnostics(marks)` paints gutter marks from `(line, severity)` pairs. `Ui.setEditorTokens(data)` paints from the packed LSP `data` ints. Empty data keeps the lexer. `Ui.setEditorInlays(hints)` paints `(line, col, label)` at the cell. `Ui.setEditorFolds(ranges)` paints fold marks from `(start, end)` lines. `View.border(n, color, child)` paints an `n` px stroke in `color` inside the child frame (`0` = none). Nested border paints both. `View.radius(n, child)` clips paint to a rounded rect of `n` px (`0` = square). Nested radius uses the inner value. `View.checkbox(sig, label)` paints a box plus `label`. Tap flips `sig` between `0` and `1`. A11y dumps `checkbox:label=0` or `checkbox:label=1`. `[taps]` includes checkboxes so `tap N` hits them. `View.radio(sig, value, label)` paints a mark plus `label`. Tap writes `value` into `sig`. Radios that share `sig` form a group. A11y dumps `radio:label=0` or `radio:label=1`. `[taps]` includes radios. `View.slider(sig)` paints a track. Tap or pointer drag writes `sig` from the hit x, clamped `0`–`100`. A11y dumps `slider:n`. `[taps]` includes sliders so `tap N` hits them. `View.progress(sig)` paints a bar from `sig`, clamped `0`–`100`. It is not a tap target. A11y dumps `progress:n`. `View.switch(sig, label)` paints a track plus `label`. Tap flips `sig` between `0` and `1`. A11y dumps `switch:label=0` or `switch:label=1`. `[taps]` includes switches. `View.chip(sig, label)` paints `label` as a chip. Tap flips `sig` between `0` and `1`. A11y dumps `chip:label=0` or `chip:label=1`. `[taps]` includes chips. `View.filterChip(sig, label)` paints `label` as a chip with a leading check when on. Tap flips `sig` between `0` and `1`. A11y dumps `filterchip:label=0` or `filterchip:label=1`. `[taps]` includes filter chips. `View.choiceChip(sig, value, label)` paints `label` as a chip. Tap writes `value` into `sig`. Choice chips that share `sig` form a group with radios. A11y dumps `choicechip:label=0` or `choicechip:label=1`. `[taps]` includes choice chips. `View.actionChip(label, onTap)` paints `label` as a chip. Tap runs `onTap`. A11y dumps `actionchip:label`. `[taps]` includes action chips. `View.inputChip(sig, label)` paints `label` as a chip with a trailing X. Tap flips `sig` between `0` and `1`. A11y dumps `inputchip:label=0` or `inputchip:label=1`. `[taps]` includes input chips. `View.listTile(title)` is a full-width title row. `View.listTile(title, trailing)` places `trailing` on the right. It is not a tap target. A11y dumps `listtile:title`. `View.badge(sig, child)` paints a count from `sig` on the top-right of `child`. It sizes to the child. It is not a tap target. A11y dumps `badge:n`. `View.card(child)` paints a surface pad and a 1 px border around `child`. It is not a tap target. A11y dumps `card:card`. `View.divider()` paints a muted hairline in an 8 px slot. It is not a tap target. A11y dumps `divider:divider`. `View.expansionTile(sig, title, child)` paints a full-width header. Tap flips `sig` between `0` and `1`. `child` shows when `sig` is not `0`. A11y dumps `expansion:title=0` or `expansion:title=1`. `[taps]` includes expansion tiles. `View.iconButton(label, onTap)` paints a square control with `label`. Tap runs `onTap`. A11y dumps `iconbutton:label`. `[taps]` includes icon buttons. `View.verticalDivider()` paints a muted hairline in an 8 px slot. Height is the control height. It is not a tap target. A11y dumps `vdiv:vdiv`. `View.circularProgress(sig)` paints a square ring from `sig`, clamped `0`–`100`. It is not a tap target. A11y dumps `circular:n`. `View.avatar(label)` paints a disc with `label`. Height is the control height. It is not a tap target. A11y dumps `avatar:label`. `View.checkboxListTile(sig, title)` paints a full-width row with a box plus `title`. Tap flips `sig` between `0` and `1`. A11y dumps `checktile:title=0` or `checktile:title=1`. `[taps]` includes checkbox list tiles. `View.switchListTile(sig, title)` paints a full-width row with `title` and a trailing switch. Tap flips `sig` between `0` and `1`. A11y dumps `switchtile:title=0` or `switchtile:title=1`. `[taps]` includes switch list tiles. `View.radioListTile(sig, value, title)` paints a full-width row with a radio plus `title`. Tap writes `value` into `sig`. Radios that share `sig` form a group. A11y dumps `radiotile:title=0` or `radiotile:title=1`. `[taps]` includes radio list tiles. `View.segmented(sig, left, right)` paints a full-width row with two halves. Tap left writes `0` into `sig`. Tap right writes `1`. A11y dumps `segmented:0` or `segmented:1`. `[taps]` includes segmented rows. `View.fab(label, onTap)` is a circular tap. Tap runs the same closure as `View.button`. A11y dumps `fab:label`. `[taps]` includes fabs. `View.outlinedButton(label, onTap)` paints a surface fill and a border. Tap runs `onTap`. A11y dumps `outlined:label`. `[taps]` includes outlined buttons. `View.textButton(label, onTap)` paints `label` with no fill. Tap runs `onTap`. A11y dumps `textbutton:label`. `[taps]` includes text buttons. `View.tooltip(message, child)` sizes to `child`. It is not a tap target. A11y dumps `tooltip:message`. Child taps still fire. `View.placeholder(child)` sizes to `child`. It paints a muted box mark. It is not a tap target. A11y dumps `placeholder:ph`. Child taps still fire. `View.semantics(label, child)` sizes to `child`. It is not a tap target. A11y dumps `semantics:label`. Child taps still fire. `View.mergeSemantics(label, child)` sizes to `child`. It is not a tap target. A11y dumps `merge:label` and omits the child subtree. Child taps still fire. `View.inkWell(label, onTap, child)` sizes to `child`. Tap runs the same closure as `View.button`. A11y dumps `inkwell:label`. Child taps still fire. `[taps]` includes ink wells when the child is not a tap. `View.visibility(sig, child)` sizes to `child`. When `sig` is `0` it keeps that size, skips paint, and omits the child subtree from a11y. When `sig` is not `0` it paints the child. It is not a tap target. A11y dumps `visibility:0` or `visibility:1`. Child taps fire only when on. `View.offstage(sig, child)` lays out `child`. When `sig` is `0` it reports size `0`, skips paint, and omits the child subtree from a11y. The child still receives a layout pass. When `sig` is not `0` it sizes to the child and paints it. It is not a tap target. A11y dumps `offstage:0` or `offstage:1`. Child taps fire only when on. `View.unconstrainedBox(child)` sizes to `child`. The child lays out with unbounded max. Incoming max still clamps the box frame. It is not a tap target. A11y dumps `unconstrained:box`. Child taps still fire. `Color.rgb(r, g, b)` is opaque ARGB. `Color.rgba(r, g, b, a)` sets alpha (`0`–`255`). `View.ignorePointer(child)` skips hit-test on the subtree so taps pass through. `View.absorbPointer(child)` blocks taps without firing the child. `View.excludeSemantics(child)` omits the subtree from the a11y dump and from TextField collect. Taps still hit the child. `View.background(color, child)` paints `color` and sizes to the child. `View.text` wraps at newlines and at incoming max width; height sizes up. Buttons and TextField stay one line. `View.aspectRatio(rw, rh, child)` is the largest `rw:rh` box that fits incoming max. `View.fraction(wpct, hpct, child)` takes that percent of incoming max (`0` = size to child on that axis). See `examples/counter` and `examples/studio`.
 
-`Ui.run(_ => view)` under Headless: mount → optional scripted text/tap (`tap_text` in toml / env) → snapshot → unmount. Desktop stays open when `[ui].default_runtime = "desktop"` (`examples/studio`; close the window to quit). The factory re-runs construction on stamp-watch. Create Signals outside the factory. `Ui.run` does not take a prebuilt View. After a Desktop session, replay the recorded script Headless:
+`Ui.run(_ => view)` under Headless: mount → optional scripted tap → snapshot → unmount. Desktop stays open when `[ui].default_runtime = "desktop"` (`examples/studio`; close the window to quit). The CLI sets `SCUZZ_UI_RUNTIME` from that key. `--headless` forces Headless. The factory re-runs construction on stamp-watch. Create Signals outside the factory. `Ui.run` does not take a prebuilt View. After a Desktop session, replay the recorded script Headless:
 
 ```bash
 scuzz run examples/studio
@@ -106,24 +106,24 @@ src/
 count.scuzz_verify     # Timeline => Verdict session claims and Bool drive oracles (anywhere in the package)
 ```
 
-- Prefer sim overlays for app policy (API base URL, a `Backend` value). Blessed kits stay one implementation with TestRuntime fakes on the wire. Simulation is hermetic: TestRuntime does not open live sockets. HTTP client kits use stubs. A loopback URL with no stub parks on a virtual mailbox. `Net.serve` / `Net.serveOnce` accept injected requests and mailbox items. TCP and UDP kits use a mailbox. `Sys.exec` and `Sys.spawn` fail. `Sys.getenv` is sealed. `Sys.alive` / `Sys.kill` use a fake process table. Live `Net.serve` and `Net.tcpListen` bind localhost (`127.0.0.1` and/or `::1`). Live HTTP client kits take `http://` and `https://`. `https://` uses OpenSSL and the system trust store. Handshake parks on poll. DNS uses answer RRs for the queried name. A 2xx response finishes on `Content-Length` or EOF. HEAD finishes at the header. Bodies cap at 1 MiB. Live HTTP client kits may leave the host. TCP connect takes IPv4/IPv6 literals or localhost. UDP bind 0 picks an ephemeral port.
-- `*.scuzz_verify` files hold author claims. Put a file anywhere in the package. It does not pair with a live source. A def with one `Timeline` parameter is a session claim and returns `Verdict`. A def with two `Timeline` parameters is a relation claim: `scuzz fuzz --relate` runs each corpus entry under two PCT schedules and judges the claim over both timelines. Example: `def countStaysNonNeg(t: Timeline): Verdict = Verdict.every(t, i => Timeline.signalInt(t, i, "count") >= 0)`. A Signal publishes its `for` binder name (`count = Signal.int(0)` is `"count"`). `Timeline.signalInt` / `Timeline.signalListLen` / `Timeline.signalStrHas` take that name. An invalid `Verdict` carries the violating state index and evidence. Kit: `Timeline.len`, `Timeline.signalInt`, `Timeline.signalListLen`, `Timeline.signalStrHas`, `Timeline.a11yHas`, `Timeline.lastHitHas`, `Timeline.driveHas`, `Timeline.effectHas`, `Timeline.faultKindHas`, `Timeline.effectCount`, `Timeline.fiberLive`, `Timeline.fiberReady`, `Timeline.fiberParked`, `Timeline.fiberDone`, `Timeline.faultN`, `Timeline.checkpoint`, `Timeline.nearestCheckpoint`, `Timeline.forall`, `Timeline.exists` (Bool or Int predicates); `Verdict.every`, `Verdict.any`, `Verdict.ok`, `Verdict.fail`, `Verdict.and`, `Verdict.or`, `Verdict.alwaysHas(t, needle)` (a11y shows the needle at every state), `Verdict.afterHit(t, hit, needle)` (a hit shows the needle at that state or a later one; no hit stays valid) (judgments). A dump may include `effects:`, `fibers:`, and `fault:` after `a11y:`. Older v=1 dumps without those blocks still load. `Timeline.lastHitHas` reads the sticky last-hit field: a tap shows in the state its pump produced and stays until the next hit, so write trigger edges as `lastHitHas(t, i, x) && (i == 0 || !lastHitHas(t, i - 1, x))`. Other public defs return `Bool`. `scuzz fuzz` judges each timeline predicate over the recorded timeline at the terminal point. A def with at most three generator-friendly params is a drive oracle. Example: `def bump(n: Int): Bool = Main.bump(n) == n + 1`. The compiler publishes `drive bump`. A zero-argument oracle writes `drive <name>` into `build/seeds.txt`. `scuzz check` typechecks the file. A present empty file fails `check`. A leftover `*.scuzz_intent` file fails resolve. Do not put `@main`, `Property.*`, or `.require` in a verify file.
+- Prefer sim overlays for app policy (API base URL, a `Backend` value). Blessed kits stay one implementation with TestRuntime fakes on the wire. Simulation is hermetic: TestRuntime does not open live sockets. HTTP client kits use stubs. A loopback URL with no stub parks on a virtual mailbox. `Net.serve` / `Net.serveOnce` accept injected requests and mailbox items. TCP and UDP kits use a mailbox. `Sys.exec` and `Sys.spawn` fail. `Sys.getenv` is sealed. `Sys.alive` / `Sys.kill` use a fake process table. Live `Net.serve` and `Net.tcpListen` bind localhost (`127.0.0.1` and/or `::1`). Live HTTP client kits take `http://` and `https://`. `https://` uses OpenSSL and the system trust store. Handshake parks on poll. DNS uses answer RRs for the queried name. A 2xx response finishes on `Content-Length` or EOF. HEAD finishes at the header. Bodies cap at 1 MiB. Live HTTP client kits may leave the host. TCP connect takes IPv4/IPv6 literals or localhost. `Net.tcpRead(n)` copies at most n bytes (cap 1 MiB). Live drains the socket until n, EOF, or no more data. A short read is possible. Park waits 1 s for the first byte. UDP bind is IPv4 localhost. Bind 0 picks an ephemeral port. An IPv6 send host fails.
+- `*.scuzz_verify` files hold author claims. Put a file anywhere in the package. It does not pair with a live source. A def with one `Timeline` parameter is a session claim and returns `Verdict`. A def with two `Timeline` parameters is a relation claim: `scuzz fuzz --relate` runs each corpus entry under two PCT schedules and judges the claim over both timelines. Example: `def countStaysNonNeg(t: Timeline): Verdict = Verdict.every(t, i => Timeline.signalInt(t, i, "count") >= 0)`. A Signal publishes its `for` binder name (`count = Signal.int(0)` is `"count"`). `Timeline.signalInt` / `Timeline.signalListLen` / `Timeline.signalStrHas` take that name. `Timeline.signalStrHas` searches the unescaped string value. An empty needle is true when that value is empty. An invalid `Verdict` carries the violating state index and evidence. Kit: `Timeline.len`, `Timeline.signalInt`, `Timeline.signalListLen`, `Timeline.signalStrHas`, `Timeline.a11yHas`, `Timeline.lastHitHas`, `Timeline.driveHas`, `Timeline.effectHas`, `Timeline.faultKindHas`, `Timeline.effectCount`, `Timeline.fiberLive`, `Timeline.fiberReady`, `Timeline.fiberParked`, `Timeline.fiberDone`, `Timeline.faultN`, `Timeline.checkpoint`, `Timeline.nearestCheckpoint`, `Timeline.forall`, `Timeline.exists` (Bool or Int predicates); `Verdict.every`, `Verdict.any`, `Verdict.ok`, `Verdict.fail`, `Verdict.and`, `Verdict.or`, `Verdict.alwaysHas(t, needle)` (a11y shows the needle at every state), `Verdict.afterHit(t, hit, needle)` (a hit shows the needle at that state or a later one; no hit stays valid) (judgments). A dump may include `effects:`, `fibers:`, and `fault:` after `a11y:`. Older v=1 dumps without those blocks still load. `Timeline.lastHitHas` reads the sticky last-hit field: a tap shows in the state its pump produced and stays until the next hit, so write trigger edges as `lastHitHas(t, i, x) && (i == 0 || !lastHitHas(t, i - 1, x))`. Other public defs return `Bool`. `scuzz fuzz` judges each timeline predicate over the recorded timeline at the terminal point. A def with at most three generator-friendly params is a drive oracle. Example: `def bump(n: Int): Bool = Main.bump(n) == n + 1`. The compiler publishes `drive bump`. A zero-argument oracle writes `drive <name>` into `build/seeds.txt`. `scuzz check` typechecks the file. A present empty file fails `check`. A leftover `*.scuzz_intent` file fails resolve. Do not put `@main`, `Property.*`, or `.require` in a verify file.
 - `.require` preserves the receiver type. Pure values residualize to `Property.check`. `IO[A]` sequences the check after the effect (`Property.assert`). Predicates may be `Bool`, `IO[Bool]`, or `x => pred`. Name the check with `.require("name", pred)`. `io.attempt` is `IO[Result[A]]`. Match `Result.Ok` / `Result.Err`. `io.handleErrorWith(err => …)` binds `err` as `E` (`String` when the effect is `IO[A]`). There is no `property` keyword.
 - `where` on `def` params and `record` fields is a Bool predicate. The checker inserts `Property.check` at call / construction under the verify graph and erases it live.
 - `Property.check(name, ok, value)` is identity live and panics under TestRuntime when `ok` is false. `Property.sometimes(name)` records path reachability (`Unit`, not a value method). Fuzz fails the campaign if a string-literal name is never hit. `Property.classify(name, hit)` records true/false counts in `build/fuzz/summary.toml`. It always returns `true`, so `classify(...) && pred` does not drop the oracle. A class with `0` true hits is visibility, not a campaign failure.
 - Observation builtins: `Property.signalInt(name)`, `Property.signalStr(name)`, `Property.signalListLen(name)`, `Property.signalListAt(name, i)`, `Property.a11yHas(needle)` (signal store + stashed a11y dump)
 - Drivers are new `IO[Unit]` defs (0 or 1 generator-friendly param). `check` rejects `Property.*` and `.require` inside them. Fuzz scripts gain `drive <name> [args]` (`true`/`false` for Bool; `Rect(3,5)` / `Some(3)` / `[1,2]` for records, enums, and lists).
 - No `src/test` twin trees. Only stem-paired `*.scuzz_sim` / `*.scuzz_drivers` plus free-standing `*.scuzz_verify`. No third-party test or mutation frameworks.
-- Example: `examples/counter` + `examples/shared` (`Shared.scuzz_sim` swaps `counterTitle`; `countLabel` uses `.require`; `noteDrive(n: Int where n >= 0)` residualizes at `plusN` and publishes `noteDrive i>=0`; `+1` records `Property.sometimes("tappedPlus")`; `Main.scuzz` keeps count / label `.require` and `startZero` / `incremented`; `count.scuzz_verify` claims the `+1` button and sim title stay visible and `count` stays at 0 or more). `examples/kernel` uses `where` on `Point.x` / `Point.y` and `add.scuzz_verify` swap plus `addTwoThree`. `examples/hello` prints hello. `examples/bad-example` is the expected-fail campaign: `bump` is wrong, `scuzz fuzz` drives `bump`, prints the shrunk arg, and writes `repro.toml`, `corpus/` holds `drive bump 0`, `scale` has no oracle. `--no-fail-fast` still mutates after that verify failure. An idle `scale` mutant does not change the timeline, so it is inert. `examples/bad-fault` is the expected-fail fault campaign: `saveNote` swallows `Fs.write` failure, `scuzz fuzz` drives `checkNote` under `fault_seed`, and `corpus/` pins `drive checkNote a` with `fault_kind = "fs"`. A replay without `fault_seed` passes. `examples/bad-adt` is the expected-fail ADT campaign: `area` adds `Rect` sides, `scuzz fuzz` draws `Rect` values, `Property.classify` records `square` / `wide`, and `corpus/` pins a shrunk `drive area Rect(...)`. `examples/bad-sched` is the expected-fail PCT campaign: `leftFirst` assumes FIFO `IO.both` Queue offer order, `scuzz fuzz` drives `checkOrder` under `schedule_seed`, and `corpus/` pins `drive checkOrder` with `pct_d` / `pct_k`. A replay without `schedule_seed` passes. `examples/bad-intent` is a present empty verify file. `scuzz check` fails.
+- Example: `examples/counter` + `examples/shared` (`Shared.scuzz_sim` swaps `counterTitle`; `countLabel` uses `.require`; `noteDrive(n: Int where n >= 0)` residualizes at `plusN` and publishes `noteDrive i>=0`; `+1` records `Property.sometimes("tappedPlus")`; `Main.scuzz` keeps count / label `.require` and `startZero` / `incremented`; `count.scuzz_verify` claims the `+1` button and sim title stay visible and `count` stays at 0 or more). `examples/kernel` uses `where` on `Point.x` / `Point.y` and `add.scuzz_verify` swap plus `addTwoThree`. `examples/hello` prints hello. `examples/bad-example` is the expected-fail campaign: `bump` is wrong, `scuzz fuzz` drives `bump`, prints the shrunk arg, and writes `repro.toml`, `corpus/` holds `drive bump 0`, `scale` has no oracle. `--no-fail-fast` still mutates after that verify failure. An idle `scale` mutant does not change the timeline, so it is inert. `examples/bad-fault` is the expected-fail fault campaign: `saveNote` swallows `Fs.write` failure, `scuzz fuzz` drives `checkNote` under `fault_seed`, and `corpus/` pins `drive checkNote a` with `fault_kind = "fs"`. A replay without `fault_seed` passes. `examples/bad-adt` is the expected-fail ADT campaign: `area` adds `Rect` sides, `scuzz fuzz` draws `Rect` values, `Property.classify` records `square` / `wide`, and `corpus/` pins a shrunk `drive area Rect(...)`. `examples/bad-sched` is the expected-fail PCT campaign: `leftFirst` assumes FIFO `IO.both` Queue offer order, `scuzz fuzz` drives `checkOrder` under `schedule_seed`, and `corpus/` pins `drive checkOrder` with `pct_d` / `pct_k`. A replay without `schedule_seed` passes. `examples/bad-intent` is a present empty verify file or leftover `*.scuzz_intent`. `scuzz check` fails.
 
 ### Commands
 
 - `[ui]` packages: `scuzz test` is Headless **structural** goldens on the **live** graph (signal store + a11y dump + tap/field/scroll indices). PNG optional through `--pixels`. Seed with `scuzz test --update`. `--update` creates `goldens/` when it is missing. Missing `goldens/` or empty dumps fail without `--update`. Seed and compare PNG goldens under the in-tree `sk_sw` backend (`SCUZZ_SKIA=sk_sw`) so pixels stay platform-deterministic. `scuzz test --differential` runs the golden scenarios once per render backend (`skia`, `sk_sw`, `gpu`) and compares the structural dumps across backends; a backend that cannot run on the host skips with a note. `scuzz fuzz` compiles the **verify** graph (sim + residual `.require` / `*.scuzz_verify` + drivers).
-- IO packages (no `[ui]`): `scuzz test` compiles and runs under `SCUZZ_TESTRT=1`, requiring exit 0
-- `scuzz check` format-verifies `src/` and `*.scuzz_verify` and typechecks live + sim + drivers + verify predicates + `where` + `.require`. A present empty `*.scuzz_verify` fails. A leftover `*.scuzz_intent` file fails. It reports unused imports, unused locals, unused parameters, and unused private defs. It reports unclaimed defs, signals, and controls as info (used names that no claim observes). A name that starts with `_` is kept on purpose. `--message-format=json` is the editor protocol (`check` only). `scuzz lsp` wraps that JSON over stdin/stdout (open buffers overlay disk on didOpen/didChange; didClose uses disk; `workspace/didChangeWatchedFiles` republishes check). Language-server methods use the same parse. One run reports every parse and type diagnostic. Unclaimed reports do not fail `check`.
+- IO packages (no `[ui]`): `scuzz test` compiles and runs under `SCUZZ_TESTRT=1`, requiring exit 0. It copies `SCUZZ_SERVE` and `SCUZZ_KIT` into the sealed getenv map.
+- `scuzz check` format-verifies `src/` and `*.scuzz_verify`. It typechecks live `*.scuzz` plus `where` / `.require`. Stem-paired `*.scuzz_sim` / `*.scuzz_drivers` load under verify/fuzz, not `check`. It structurally checks `*.scuzz_verify`: drive and claim shape, no `@main` / enums / aliases / traits / impls / imports, and no `Property.*` or `.require` in those bodies. A present empty `*.scuzz_verify` fails. A leftover `*.scuzz_intent` file fails. It reports unused imports, unused locals, unused parameters, and unused private defs. It reports unclaimed defs, signals, and controls as info (used names that no claim observes). A name that starts with `_` is kept on purpose. `--message-format=json` is the editor protocol (`check` only). `scuzz lsp` wraps that JSON over stdin/stdout. Open buffers overlay disk on didOpen/didChange. didChange reads full-sync `contentChanges`. didClose uses disk and publishes empty diagnostics for that URI. Language-server methods use the same parse. The server advertises only methods it implements. Rename returns a WorkspaceEdit. Diagnostics run the check file list with overlays. One run reports every parse and type diagnostic. Unclaimed reports do not fail `check`.
 - `scuzz ide [path]` launches the bundled `[ui]` editor with Desktop. `--headless` stays. The CLI finds `SCUZZ_IDE`, `SCUZZ_HOME/ide`, or `examples/editor`. It passes the path through `Sys.args`. There is no `scuzz-ide` binary.
-- `scuzz fuzz --iterations N` is the verification campaign. It loads `<pkg>/corpus/*.toml` (sibling of `goldens/`; same shape as `repro.toml`) in sorted-name order and replays those entries before search. It also replays `build/seeds.txt` zero-argument verify oracles (`drive <name>`). A missing or empty `corpus/` is a no-op. Missing seeds is a no-op. `--iterations 0` is corpus-only: replay, then stop. `--minimize-corpus` rewrites stored entries to their shortest forms that keep pass/fail status and declared `sometimes` coverage. No search. No mutation. Use it for a fast inner loop. A failing stored entry is a search failure; the stored file is the repro. A failing seed writes `build/fuzz/repro.toml`. Passing entries seed in-memory keeps. For `N > 0` it splits the rest of the budget into search then mutation. `[ui]` search tries exhaustive event scripts while the next full depth fits, then coverage-guided random. Scripts that hit new `Property.sometimes` names or a new Headless `dump.txt` are kept, replayed once more (dump and timeline must match), and later iters extend those prefixes. Search writes a shrunk failure into `corpus/` under a hash of `schedule_seed` plus events plus a non-zero `fault_seed` (idempotent). Shrink first drops events, then shrinks `drive` args (Int toward the published bound or 0, Bool to `false`, String to `a`, record/enum fields, list length then elements), then shrinks the fault seed, then shrinks PCT `pct_k`. The campaign prints `shrunk events:` with those lines. A simple Int `where` bound publishes as a driver-table token (`noteDrive i>=0`) and clamps draws. Record / enum / list params publish as `Rect(i>=0,i)` / `e:Some(i)|None` / `[i]`. A recursive enum caps nest depth at 3 and publishes a nested `e:N(i)|Add(...)` spec. Search also persists a keep that reaches a `sometimes` name no stored entry reaches (cap: declared-name count). Dump-novelty keeps stay in memory. Review new `corpus/*.toml` files like goldens. After a UI refactor a stored `tap N` can miss (the index is gone). Delete that entry. IO-only keeps schedule seeds that hit new sometimes names and perturbs them. `--replay repro.toml` restores a shrunk event list + optional `schedule_seed` / `pct_d` / `pct_k` + optional fault plan. Oracles are residual `.require` / `Property.check`, panic/`SzError`, dump determinism, leak (heap growth across consecutive idle UI pumps), deadlock (all fibers parked with no timer pending), heap baseline after session teardown, acquire/release pairing, finalizer-on-cancel, leftover parked fibers after quiesce, live/verify differential, and campaign `Property.sometimes` reachability. `Property.classify` counts write to `summary.toml` `[classify]` and do not fail the campaign. Search explores `SCUZZ_FAULT_SEED` like `SCUZZ_SCHED_SEED`. `SCUZZ_SCHED_SEED` is a packed PCT plan. `repro.toml` writes `pct_d` / `pct_k`. Seed `0` is no fault. Iter `0` stays no-fault. After search, mutation compiles live `def` bodies (flip `==`/`</<=/>/>=/&&/||`, swap `+`/`-` and `*`/`/`, replace `%` with `*`, drop `&&` conjuncts, swap `if` arms, swap `0`↔`1`, replace an ADT construct with a same-arity sibling). Program mode also swaps a tap handler body with a sibling handler and replaces a `Signal.map` transform with the identity. Mutants that do not compile count as killed. A probe that runs longer than 20 s is killed. Residual oracles stay armed. `--oracles` mutates residual `Property.check` / `Property.assert` / `.require` predicates instead. It also negates or drops residual `where` bounds. Each mutant gets an idle TestRuntime probe, then corpus replay. Kill = any probe fails. A surviving mutant that changes a claimed `State` field is a weak claim. A surviving mutant that changes an unclaimed `State` field is a missing claim. Mutants with a bit-identical replayed timeline are inert and unreported. Each survivor prints file:line, enclosing def, mutation label with a source excerpt, the nearest residual oracle (same def, else closest span in the same module, else no observing oracle), and a weak or missing claim. `summary.toml` `[mutate]` records `survivors` (kind and fields) and `inert`. No sites (for example `examples/hello`) exits 0. Do not add external mutators. The command writes `build/fuzz/summary.toml` with coverage (`declared` / `reachability`), `[coverage].unclaimed_varied` (`State` fields that varied and no claim reads), a `[corpus]` table (`entries` / `failures` / `reached` / `promoted`), `[classify]` true/false counts, and mutation (`killed` / `survived` / `inert` / `score` / `survivors`). Unclaimed variation reports to the author. It does not fail the campaign. Missing names split into not reached in this budget vs reached by no stored corpus entry. Default stops at the first search failure. `--no-fail-fast` keeps that `repro.toml`, finishes search, then mutates. `examples/bad-example` must fail: search drives `bump` against a wrong `bump` and prints the shrunk arg (`drive bump 0`). A checked-in `corpus/` entry pins that failure. `examples/bad-fault` must fail: search drives `checkNote` under a fault seed that fails `Fs.write`. `saveNote` swallows that error, so `loadNote` does not match. A checked-in `corpus/` entry pins `drive checkNote a` with `fault_seed = "1"`. Replay without `fault_seed` passes. `examples/bad-adt` must fail: search draws `Rect` values against a wrong `area` (`w + h` vs `w * h`). `Property.classify` records `square` / `wide`. A checked-in `corpus/` entry pins a shrunk `drive area Rect(...)`. `examples/bad-sched` must fail: search drives `checkOrder` under a PCT schedule seed that offers `R` first. A checked-in `corpus/` entry pins `drive checkOrder` with `schedule_seed = "1344"` / `pct_d = 2` / `pct_k = 0`. Replay without `schedule_seed` passes. `scuzz check` and `scuzz test` still pass. A failing search keeps no passing corpus, so idle mutants that change the replayed timeline survive. Mutants with a bit-identical replayed timeline are inert and unreported. `scale` has no oracle. An idle `scale` mutant does not change the timeline, so it is inert.
-- Deterministic fakes: `TestRuntime` / `SCUZZ_TESTRT=1` for clock/random/FS/network/console in app binaries. Simulation is hermetic (no live sockets; `Sys.exec` / `Sys.spawn` fail; `Sys.getenv` sealed; `Sys.alive` / `Sys.kill` fake). Fault injection: `SCUZZ_FAULT_SEED` (or `SCUZZ_FAULT_KIND` + `SCUZZ_FAULT_N` + `SCUZZ_FAULT_MODE`) fails the Nth `Fs` / `Net` / `Queue` op, or drops/corrupts a Net stub. Seed `0` / unset is no fault. `scuzz fuzz` writes `fault_seed` and the decoded plan into `repro.toml`. PCT schedule: `SCUZZ_SCHED_SEED` arms priority plus change-points (packed `k=s%8`, `d=2+(s/8)%4`, `rng=s/32`). `SCUZZ_PCT_D` / `SCUZZ_PCT_K` override. Unset keeps FIFO. `scuzz fuzz` writes `schedule_seed` / `pct_d` / `pct_k` into `repro.toml`. Implicit oracles fail a run on leak (heap growth across consecutive idle UI pumps), deadlock (all fibers parked with no timer pending), heap baseline after session teardown, acquire/release pairing, finalizer-on-cancel, leftover parked fibers after quiesce, and a silent live/verify split (a `*.scuzz_sim` overlay is a declared delta).
+- `scuzz fuzz --iterations N` is the verification campaign. It loads `<pkg>/corpus/*.toml` (sibling of `goldens/`; same shape as `repro.toml`) in sorted-name order and replays those entries before search. It also replays `build/seeds.txt` zero-argument verify oracles (`drive <name>`). A missing or empty `corpus/` is a no-op. Missing seeds is a no-op. `--iterations 0` is corpus-only: replay, then stop. A failing stored entry is a search failure; the stored file is the repro. A failing seed writes `build/fuzz/repro.toml`. Passing entries seed in-memory keeps. For `N > 0` it splits the rest of the budget into search then mutation. Search after replay repeats the same seed/corpus script. It walks `SCUZZ_SCHED_SEED` 0, 1, 2, … for the remaining budget. Iter 0 keeps no fault. Later iters set `SCUZZ_FAULT_SEED` to that same counter. Drive does not mutate `run.script` yet. Scripts that hit new `Property.sometimes` names or a new Headless `dump.txt` are kept, replayed once more (dump and timeline must match), and later iters extend those prefixes. Search writes a shrunk failure into `corpus/` under a hash of `schedule_seed` plus events plus a non-zero `fault_seed` (idempotent). Shrink first drops events, then shrinks `drive` args (Int toward the published bound or 0, Bool to `false`, String to `a`, record/enum fields, list length then elements), then shrinks the fault seed, then shrinks PCT `pct_k`. The campaign prints `shrunk events:` with those lines. A simple Int `where` bound publishes as a driver-table token (`noteDrive i>=0`) and clamps draws. Record / enum / list params publish as `Rect(i>=0,i)` / `e:Some(i)|None` / `[i]`. A recursive enum caps nest depth at 3 and publishes a nested `e:N(i)|Add(...)` spec. Search also persists a keep that reaches a `sometimes` name no stored entry reaches (cap: declared-name count). Dump-novelty keeps stay in memory. Review new `corpus/*.toml` files like goldens. After a UI refactor a stored `tap N` can miss (the index is gone). Delete that entry. IO-only keeps schedule seeds that hit new sometimes names and perturbs them. `--replay repro.toml` restores a shrunk event list + optional `schedule_seed` / `pct_d` / `pct_k` + optional fault plan. Oracles are residual `.require` / `Property.check`, panic/`SzError`, dump determinism, leak (heap growth across consecutive idle UI pumps), deadlock (all fibers parked with no timer pending), heap baseline after session teardown, acquire/release pairing, finalizer-on-cancel, leftover parked fibers after quiesce, live/verify differential, and campaign `Property.sometimes` reachability. `Property.classify` counts write to `summary.toml` `[classify]` and do not fail the campaign. Search explores `SCUZZ_FAULT_SEED` like `SCUZZ_SCHED_SEED`. `SCUZZ_SCHED_SEED` is a packed PCT plan. `repro.toml` writes `pct_d` / `pct_k`. Seed `0` is no fault. Iter `0` stays no-fault. After search, mutation compiles live `def` bodies (flip `==`/`</<=/>/>=/&&/||`, swap `+`/`-` and `*`/`/`, replace `%` with `*`, drop `&&` conjuncts, swap `if` arms, swap `0`↔`1`, replace a `Signal.map` transform with the identity, and swap a tap handler body with the next handler in walk order). Mutation also walks impl method bodies. Mutants that do not compile count as killed. A probe that runs longer than 20 s is killed. Residual oracles stay armed. `--oracles` mutates residual `Property.check` / `Property.assert` / `Property.force` / `.require` predicates instead (negate `!`, flip `true`/`false`, flip relations, 0↔1, arith, drop `&&` conjuncts). Each mutant gets an idle TestRuntime probe, then replay of corpus+seeds entries that passed on the original. Kill = idle fails, or a passing entry fails. A surviving mutant that changes a claimed `State` field is a weak claim. A surviving mutant that changes an unclaimed `State` field is a missing claim. Mutants with a bit-identical replayed timeline are inert and unreported. `summary.toml` `[mutate]` records `survivors` (kind and fields) and `inert`. No sites (for example `examples/hello`) exits 0. Do not add external mutators. The command writes `build/fuzz/summary.toml` with `[corpus]` (`entries` / `failures` / `promoted`), `[classify]` true/false counts when the dump has rows, and `[mutate]` (`killed` / `survived` / `inert` / `ran` / `sites` / `oracles`). Omit empty arrays. Omit `score` when `sites` is 0. Write `score` as killed/sites when sites is greater than 0. Unclaimed variation reports to the author. It does not fail the campaign. Missing names split into not reached in this budget vs reached by no stored corpus entry. Default stops at the first search failure. `--no-fail-fast` keeps that `repro.toml`, finishes search, then mutates. `examples/bad-example` must fail: search drives `bump` against a wrong `bump` and prints the shrunk arg (`drive bump 0`). A checked-in `corpus/` entry pins that failure. `examples/bad-fault` must fail: search drives `checkNote` under a fault seed that fails `Fs.write`. `saveNote` swallows that error, so `loadNote` does not match. A checked-in `corpus/` entry pins `drive checkNote a` with `fault_seed = "1"`. Replay without `fault_seed` passes. `examples/bad-adt` must fail: search draws `Rect` values against a wrong `area` (`w + h` vs `w * h`). `Property.classify` records `square` / `wide`. A checked-in `corpus/` entry pins a shrunk `drive area Rect(...)`. `examples/bad-sched` must fail: search drives `checkOrder` under a PCT schedule seed that offers `R` first. A checked-in `corpus/` entry pins `drive checkOrder` with `schedule_seed = "1344"` / `pct_d = 2` / `pct_k = 0`. Replay without `schedule_seed` passes. `scuzz check` and `scuzz test` still pass. A failing search keeps no passing corpus, so idle mutants that change the replayed timeline survive. Mutants with a bit-identical replayed timeline are inert and unreported. `scale` has no oracle. An idle `scale` mutant does not change the timeline, so it is inert.
+- Deterministic fakes: `TestRuntime` / `SCUZZ_TESTRT=1` for clock/random/FS/network/console in app binaries. `SCUZZ_RAND_SEED` seeds `Random.nextInt` (unset or `0` keeps 42). Under TestRuntime, Clock.realTime and Clock.monotonic both read the virtual ms counter (start 1). Simulation is hermetic (no live sockets; `Sys.exec` / `Sys.spawn` fail; `Sys.getenv` sealed except `SCUZZ_SERVE` / `SCUZZ_KIT`; `Sys.alive` / `Sys.kill` fake). Fault injection: `SCUZZ_FAULT_SEED` (or `SCUZZ_FAULT_KIND` + `SCUZZ_FAULT_N` + `SCUZZ_FAULT_MODE`) fails the Nth `Fs` / `Net` / `Queue` op, or drops/corrupts a Net stub. Seed `0` / unset is no fault. `scuzz fuzz` writes `fault_seed` and the decoded plan into `repro.toml`. PCT schedule: `SCUZZ_SCHED_SEED` arms priority plus change-points (packed `k=s%8`, `d=2+(s/8)%4`, `rng=s/32`). `SCUZZ_PCT_D` / `SCUZZ_PCT_K` override. Unset keeps FIFO. `scuzz fuzz` writes `schedule_seed` / `pct_d` / `pct_k` into `repro.toml`. Implicit oracles fail a run on leak (heap growth across consecutive idle UI pumps), deadlock (all fibers parked with no timer pending), heap baseline after session teardown, acquire/release pairing, finalizer-on-cancel, leftover parked fibers after quiesce, and a silent live/verify split (a `*.scuzz_sim` overlay is a declared delta).
 - Put non-determinism behind blessed `IO`. Keep View construction pure.
 
 ## Examples to read next
@@ -132,23 +132,23 @@ count.scuzz_verify     # Timeline => Verdict session claims and Bool drive oracl
 | --- | --- |
 | `examples/fmt` | Scuzz fmt core: printer over `examples/syntax`. Drive oracles check the kernel dialect (`fmt-ok`). Scuzz emit of `Drive.emitDir` compiles this package from disk |
 | `examples/syntax` | Kernel lexer and parser. Path dep for `examples/fmt` and `examples/compiler` |
-| `examples/compiler` | Kernel typechecker, LLVM emit, `scuzz.toml` parse, compile pipeline, clang argv. `Drive.compileFiles` emits multi-file IR. `Drive.emitDir` lists `src/` and nested path-dep `src/` and writes the `.ll`. A library package skips dummy `@main`. Scuzz-emitted CLI compiles this package; `clang -c` accepts the IR. Path dep for `examples/tyck`, `examples/codegen`, and `examples/cli` |
-| `examples/tyck` | Kernel typechecker oracles. Drive oracles check JSON diagnostics (`tyck-ok`). Scuzz emit clang-links and prints `tyck-ok`. Scuzz emit of `Drive.emitDir` compiles this package from disk |
+| `examples/compiler` | Kernel typechecker, LLVM emit, `scuzz.toml` parse, compile pipeline, clang argv. `Drive.compileFiles` typechecks then emits multi-file IR. `Drive.emitDir` lists `src/` and path-dep `src/` and writes the `.ll`. A library package skips dummy `@main`. Scuzz-emitted CLI compiles this package; `clang -c` accepts the IR. Path dep for `examples/tyck`, `examples/codegen`, and `examples/cli` |
+| `examples/tyck` | Kernel typechecker oracles. Drive groups check JSON diagnostics, apply-site arg type, and function body vs `A => B` (`tyck-ok`). Scuzz emit clang-links and prints `tyck-ok`. Scuzz emit of `Drive.emitDir` compiles this package from disk |
 | `examples/codegen` | Kernel codegen oracles. Drive oracles check LLVM IR for the kernel subset (`ir-ok`). Scuzz emit clang-links and prints `ir-ok`. Scuzz emit of `Drive.emitDir` compiles this package from disk |
 | `examples/cli` | Scuzz CLI core and driver: argv parse, help, fmt dispatch, manifest, compile pipeline, check dispatch, test/fuzz reports. Empty `Sys.args` prints `cli-ok`. `scuzz build --out-dir` writes `Drive.emitDir`. `scuzz run --out-dir` clang-links and writes child stdout. Drive oracles print `cli-ok`. `Drive.compileFiles` matches `compilePkg` show output. Scuzz emit clang-links and prints `cli-ok`. That binary `run`s hello, compiles the compiler library, and compiles `examples/cli` itself |
 | `examples/bad-example` | Known-wrong `bump` plus `bump.scuzz_verify`. `scuzz fuzz` fails and writes `repro.toml` with shrunk args. `corpus/` pins `drive bump 0`. `--iterations 0` fails before search, including when `corpus/` is absent. `--no-fail-fast` still mutates. An idle `scale` mutant does not change the timeline, so it is inert |
 | `examples/bad-fault` | Known-wrong `Fs.write` handler. `saveNote` swallows the error. `scuzz fuzz` drives `checkNote` and fails only when a fault seed hits `Fs`. `corpus/` pins `drive checkNote a` with `fault_seed = "1"`. Replay without `fault_seed` passes. `scuzz check` and `scuzz test` still pass |
 | `examples/bad-adt` | Known-wrong `record Rect` `area`. `area.scuzz_verify` claims the product of the fields. `scuzz fuzz` draws `Rect` values, shrinks fields, and writes `repro.toml`. `Property.classify` records `square` / `wide` in `summary.toml`. `corpus/` pins a shrunk `drive area Rect(...)`. `scuzz check` and `scuzz test` still pass |
 | `examples/bad-sched` | Known-wrong `IO.both` Queue offer order. FIFO offers `L` first. PCT can offer `R` first. `scuzz fuzz` drives `checkOrder` and fails under `schedule_seed`. `corpus/` pins `drive checkOrder` with `pct_d = 2` / `pct_k = 0`. Replay without `schedule_seed` passes. `scuzz check` and `scuzz test` still pass |
-| `examples/bad-intent` | Present empty `*.scuzz_verify`. `scuzz check` fails. Delete the file or write a claim. |
+| `examples/bad-intent` | Present empty `*.scuzz_verify` or leftover `*.scuzz_intent`. `scuzz check` fails. Delete the leftover file or write a claim. |
 | `examples/bad-split` | Live graph and verify graph disagree on the Headless dump with no `*.scuzz_sim`. An effectful `.require` pred runs only under verify. `scuzz fuzz` fails. `scuzz check` still passes. |
 | `examples/bad-response` | Known-wrong app vs claim. `afterPlusChanged` expects a11y `text:changed` after a `button:+1` hit; the label stays `count = N`. `scuzz fuzz` taps `+1`, fails the claim, and writes `repro.toml`. `corpus/` pins `tap 0` with `schedule_seed`. `--iterations 0` fails from corpus alone. `scuzz check` and `scuzz test` still pass |
 | `examples/counter` | Small UI: `Signal.map` + `View.bindText` + layout widgets + button lambda + `Ui.run(_ => view)` factory + path dep on `shared` + in-body `.require` / `Property.sometimes` + `count.scuzz_verify` `Timeline => Verdict` |
 | `examples/shared` | Library package (`{ path = "..." }`) with helpers + optional `*.scuzz_sim` + `.require` |
-| `examples/editor` | Bundled IDE package. `scuzz ide` launches it. Open a project root from `Sys.args`, edit in `View.editor`, save with `Fs.write`. Nested file tree (dir tap expands in place, nested rows indent, tree scrolls), basename tab plus dirty mark, wrapping toolbar, find/replace, completion/hover/palette overlays, Context overlay on a tree-file button-3 (`View.onSecondary`; Open / Delete), output list (hidden when empty), and `Ui.setTitle`. Tree and diagnostic rows wrap in `View.focusGroup`. A tap focuses that list. ArrowUp / ArrowDown move among sibling rows when no overlay is open. Enter / Space activate. Check writes the buffer, runs `scuzz check --message-format=json`, parses JSON, lists diagnostics, and jumps the caret. A diagnostic tap opens that file when the row encodes one. Hover / Complete / Format / Def / Rename / Fix host `scuzz lsp` over `Sys.spawn` pipes. Def can open a definition uri. Fix applies the first `newText` from a code action. A completion tap inserts the label at the editor caret (`Ui.editorCaret`). Fuzz overlays `analyze` and `lspCall` with canned JSON. Headless goldens dump `[editor]`. Search-plus-mutate `scuzz fuzz --iterations N` compiles mutants on the compiler stack. `key s+ctrl` / `f+ctrl` fire labeled toolbar buttons. `key p+shift+ctrl` opens Palette. |
+| `examples/editor` | Bundled IDE package. `scuzz ide` launches it. Open a project root from `Sys.args`, edit in `View.editor`, save with `Fs.write`. Nested file tree (dir tap expands in place, nested rows indent, tree scrolls), basename tab plus dirty mark, wrapping toolbar, find/replace, completion/hover/palette overlays, Context overlay on a tree-file button-3 (`View.onSecondary`; Open / Delete), output list (hidden when empty), and `Ui.setTitle`. Tree and diagnostic rows wrap in `View.focusGroup`. A tap focuses that list. ArrowUp / ArrowDown move among sibling rows when no overlay is open. Enter / Space activate. Check writes the buffer, runs `scuzz check --message-format=json`, parses JSON, lists diagnostics, and jumps the caret. A diagnostic tap opens that file when the row encodes one. Hover / Complete / Format / Def / Rename / Fix host `scuzz lsp` over `Sys.spawn` pipes. Def can open a definition uri. Rename applies WorkspaceEdit `changes`. Fix applies the first `newText` from a code action. A completion tap inserts the label at the editor caret (`Ui.editorCaret`). Fuzz overlays `analyze` and `lspCall` with canned JSON. Headless goldens dump `[editor]`. Search-plus-mutate `scuzz fuzz --iterations N` compiles mutants on the compiler stack. `key s+ctrl` / `f+ctrl` fire labeled toolbar buttons. `key p+shift+ctrl` opens Palette. |
 | `examples/studio` | Desktop stay-open app: `showWhen` pages, `Signal.list` + `View.each`, Done/Add/Del/Rename, `View.radio` / `View.slider` / `View.progress` / `View.switch` / `View.chip` / `View.filterChip` / `View.choiceChip` / `View.actionChip` / `View.inputChip` / `View.listTile` / `View.badge` / `View.card` / `View.divider` / `View.expansionTile` / `View.iconButton` / `View.verticalDivider` / `View.circularProgress` / `View.avatar` / `View.checkboxListTile` / `View.switchListTile` / `View.radioListTile` / `View.segmented` / `View.fab` / `View.outlinedButton` / `View.textButton` / `View.tooltip` / `View.placeholder` / `View.semantics` / `View.mergeSemantics` / `View.inkWell` / `View.visibility` / `View.offstage` / `View.unconstrainedBox` / `View.scrollH` / `View.grid`, Fs load/save, `record` / `trait` / stem modules, `*.scuzz_verify` + drivers / `Property.sometimes`. `scuzz run` opens a window (close the window to quit). `--headless` snapshots. |
 | `examples/kernel` | Language constructs: enums, `record` + `where` + `.copy`, `trait` / `impl`, generics, generic enum/record, type aliases, stem modules, `private def`, `import` / `as` / `*`, unused names, `Float`, match guards, literal match, or-patterns, as-patterns, list patterns (`[]` / `::` / `[a, b]`), named field patterns, bare constructors (`case None`, `Some(1)`), tuple of 2 through 8 slots, tuple and constructor `for` / lambda unpack, `if` in `for`, `if` without `else` (`Unit` / `IO[Unit]`), `IO.fail` as `IO[A]`, `io.map`, case lambdas (`{ case … }`), `A => B` apply (`f(x)`, `f(x, y)`), named Fun values (`inc = (_ + 1): Int => Int`, `addN`), unary-def eta (`Str.fromInt`, `id`), n-ary-def eta (`add`), cons `h :: t`, named call arguments, default arguments, type ascription, typed lambdas, placeholder lambdas (`_ + 1`), structural `==`, numeric separators, scientific floats, triple-quoted strings, self-tail calls (loop lowering), Builder (linear string kit), recursive `Term` drive (`termDiff`) |
 | `examples/scale` | Compiler-scale package: about 4k lines across stem modules. A live run fills a String-keyed `Map` of 3048 entries (`mapn:3048`, `hit:0:49`). `scuzz fuzz --iterations 8` samples 3 of 97 live-code sites and finishes in about 36 s |
-| `examples/io` | Blessed kits: Clock / `Random.nextInt` / Fs (`list` entries, `exists`, `join` / `dirname` / `basename`, `delete` / `rename` / `walk`) / `Impurity.runKit` / `Ref` / `Queue` / `Deferred` / `Fiber` / `Resource` / `Stream` (range / zip / interleave / zipWith / flatMap / mapConcat / scan / fold / forall / iterate / unfold / head) / Json query (`get` / `keys` / `arr` / `merge`) and write (`set` / `remove` / `append` / `dropAt`) / `Net.serveOnce` POST through virtual loopback plus TCP echo and UDP ping (`Impurity.runKit` and serve under `scuzz test`). `flow.scuzz_verify` claims fiber census, effect count, checkpoint, and nearest checkpoint stay in range. `fs.scuzz_verify` claims a `Fs.write` effect on the timeline. `net.scuzz_verify` claims a `Net.httpPost` effect |
+| `examples/io` | Blessed kits: Clock / `Random.nextInt` / Fs (`list` entries, `exists`, `join` / `dirname` / `basename`, `delete` / `rename` / `walk`) / `Impurity.runKit` / `Ref` / `Queue` / `Deferred` (`empty` / `get` / `complete` / `fail`) / `Fiber` / `Resource` / `Stream` (range / zip / interleave / zipWith / flatMap / mapConcat / scan / fold / forall / iterate / unfold / head) / Json query (`get` / `keys` / `arr` / `merge` / `isBool` / `getFloat` / `asFloat`) and write (`set` / `remove` / `append` / `dropAt`); parse miss is Result.Err / `Net.serveOnce` POST through virtual loopback plus TCP echo and UDP ping (`Impurity.runKit` and serve under `scuzz test`). `flow.scuzz_verify` claims fiber census, effect count, checkpoint, and nearest checkpoint stay in range. `fs.scuzz_verify` claims a `Fs.write` effect on the timeline. `net.scuzz_verify` claims a `Net.httpPost` effect |
 
 Edit [vision.md](vision.md) when changing GC, Skia, effects, UI boundaries, or language direction.
diff --git a/docs/schemas/scuzz-toml.md b/docs/schemas/scuzz-toml.md
index 0aba2986..e50eca1c 100644
--- a/docs/schemas/scuzz-toml.md
+++ b/docs/schemas/scuzz-toml.md
@@ -44,7 +44,7 @@ utils = { path = "../utils" }
 - Each entry is an inline table with exactly `path`.
 - Paths resolve relative to the directory that contains the declaring `scuzz.toml`.
 - Dependencies may declare their own path dependencies (recursive).
-- Resolution is deterministic (sorted by dependency name). A package directory is compiled once even if reached through multiple paths.
+- Resolution is deterministic. A package directory is compiled once even if reached through multiple paths.
 - Sources from the complete graph are **merged and typechecked as one program** (not separately compiled library artifacts). An executable root needs exactly one `@main`.
 - Cycles, missing packages/`src/`, duplicate names, empty paths, and unsupported value shapes are rejected.
 - Unknown keys and extra top-level tables are rejected (`git` / `version` on a dependency, `[plugins]`). Do not add `[plugins]` or a settings DSL.
@@ -55,11 +55,10 @@ Optional. Used by `scuzz run` / `test` / `package`.
 
 | Key | Type | Notes |
 | --- | --- | --- |
-| `default_runtime` | `"headless"` \| `"desktop"` \| `"mobile"` | `scuzz run` default; `--headless` forces Headless |
+| `default_runtime` | `"headless"` \| `"desktop"` \| `"mobile"` | `scuzz run` / `scuzz ide` export `SCUZZ_UI_RUNTIME` from this key. `--headless` forces Headless. A raw binary with that env unset stays Headless. |
 | `headless_size` | `[w, h]` | Logical pixels for Headless / goldens / Mobile host |
 | `headless_scale` | float | Headless session scale (default 1). Desktop uses OS backing scale when higher. |
 | `tap_button` | int (optional) | 0-based `[taps]` index for `_after_tap` goldens (`SCUZZ_UI_TAP_N`) |
-| `tap_text` | string (optional) | Text injected before the scripted tap (`SCUZZ_UI_TEXT`) |
 | `bundle_id` | string | Android package / iOS `CFBundleIdentifier` for `scuzz package` |
 
 Invalid `default_runtime`, non-positive `headless_size`, non-positive `headless_scale`, or an empty `bundle_id` fail load.
@@ -85,4 +84,4 @@ my-app/
     ios/<name>.app          # signed sim bundle (`scuzz package --target ios`)
 ```
 
-The compiler accepts `*.scuzz` under `src/` (recursive). Units in the same package are merged. Executables need exactly one `@main`. Stem-paired `*.scuzz_sim` / `*.scuzz_drivers` and `*.scuzz_verify` load under `scuzz check` and verify/fuzz builds. See [vision.md](../vision.md#properties-simulation-mutation-and-verification). `scuzz fmt` and `scuzz check` format-verify the selected project's `src/` plus package `*.scuzz_verify` (not dependency trees).
+The compiler accepts `*.scuzz` files in `src/` (not nested directories). Units in the same package are merged. Executables need exactly one `@main`. `scuzz check` typechecks live `*.scuzz`. Stem-paired `*.scuzz_sim` / `*.scuzz_drivers` load under verify/fuzz builds. `*.scuzz_verify` load under `scuzz check` and verify/fuzz builds. See [vision.md](../vision.md#properties-simulation-mutation-and-verification). `scuzz fmt` and `scuzz check` format-verify the selected project's `src/` plus package `*.scuzz_verify` (not dependency trees).
diff --git a/docs/vision.md b/docs/vision.md
index 3e702ea7..2e7088f5 100644
--- a/docs/vision.md
+++ b/docs/vision.md
@@ -14,7 +14,7 @@ Edit this file when a decision or next-step order changes.
 - **Batteries**: the language and standard kits cover common app cases. No ecosystem library sprawl. No Maven, cats, or ZIO ports.
 - **Tooling**: one opinionated CLI (`scuzz`) — compile, link, assets, watch, packaging, format, check, and the whole verification stack. One formatter (`scuzz fmt`). One linter (`scuzz check`: format-verify + typecheck; further lints emit here; no `lint` subcommand). One testing strategy. Mutation, fuzzing, properties, simulation, and determinism are **first-class in the language and `scuzz`**. They are not a third-party harness. Compiler, CLI, and toolchain are Scuzz (`examples/compiler`, `examples/cli`). A rebuild uses the newest GitHub `v*` bootstrap ([Self-hosting](#self-hosting)). `scuzz ide` launches a Scuzz `[ui]` app. That app is the dogfood IDE, not the compiler. Prerequisites: [`gaps.md`](gaps.md).
 - **Language proof**: examples that exercise the surface (`examples/`). The dogfood IDE is an app on that same surface. Self-hosted tooling is the long-term proof. It lands in staged slices after the prerequisites close ([Self-hosting](#self-hosting)).
-- **AI-Friendly**: Headless, hot reload, and debugging tools aid agents. Headless is a peer runtime. `scuzz watch` only rebuilds. `[ui] run --watch` is hot reload: it stamp-reloads Views, writes `build/debug.dump`, and plays `build/inject.script`. Desktop/Mobile `scuzz run` records live OS input to `build/record.script`. Replay Headless with `scuzz run --headless --script build/record.script --dump build/debug.dump`. Stamp-watch keeps Signals. IO-only `run --watch` kills and reruns on source change. `scuzz lsp` wraps `scuzz check` JSON diagnostics. Panic, goto-def, and rename must use Scuzz source spans. Dump, inject, fuzz verdict, and coverage become one typed session schema. Text dump and script stay until that schema ships. Dump and script verbs: [`guide.md`](guide.md).
+- **AI-Friendly**: Headless, hot reload, and debugging tools aid agents. Headless is a peer runtime. `scuzz watch` only rebuilds. `[ui] run --watch` is hot reload: it stamp-reloads Views, writes `build/debug.dump`, and plays `build/inject.script`. Desktop/Mobile `scuzz run` exports `SCUZZ_UI_RECORD` and `SCUZZ_UI_DEBUG_DUMP`. The session records live OS input to `build/record.script` and writes `build/debug.dump`. Replay Headless with `scuzz run --headless --script build/record.script --dump build/debug.dump`. Stamp-watch keeps Signals. IO-only `run --watch` kills and reruns on source change. `scuzz lsp` wraps `scuzz check` JSON diagnostics. Panic, goto-def, and rename must use Scuzz source spans. Dump, inject, fuzz verdict, and coverage become one typed session schema. Text dump and script stay until that schema ships. Dump and script verbs: [`guide.md`](guide.md).
 
 Upstream Scala Native is a *reference*, not a dependency. Divergence is intentional.
 
@@ -28,7 +28,7 @@ Upstream Scala Native is a *reference*, not a dependency. Divergence is intentio
 | Renderer (v0) | Skia through thin C ABI; Impeller deferred |
 | Build tool | DIY Mill/Cargo-like: `scuzz` (not sbt/Maven) |
 | Effects | Language + runtime builtins |
-| Impurity | All nondeterminism / external I/O through blessed `IO`; no app-level `IO.delay` escape hatch. Simulation is hermetic (TestRuntime fakes; no live sockets; `Sys.exec` / `Sys.spawn` fail; `Sys.getenv` sealed; `Sys.alive` / `Sys.kill` fake) |
+| Impurity | All nondeterminism / external I/O through blessed `IO`; no app-level `IO.delay` escape hatch. Simulation is hermetic (TestRuntime fakes; no live sockets; `Sys.exec` / `Sys.spawn` fail; `Sys.getenv` sealed except `SCUZZ_SERVE` / `SCUZZ_KIT`; `Sys.alive` / `Sys.kill` fake) |
 | Tests | One built-in strategy: **mutation + fuzz + properties + sim + determinism** (TestRuntime). Claims are pure predicates over recorded **timelines**, judged at the terminal point of each run. The author surface names Signals and controls. Dump slot ids stay behind the algebra. Claims live in `*.scuzz_verify` (`Timeline => Verdict` session claims and `Bool` drive oracles) and in live bodies (`.require`, `where`, `Property.sometimes`). **Drivers** are oracle-free workloads the fuzzer composes. No classical unit-test culture. No external test frameworks |
 | Modules | `scuzz.toml` package = crate; `Foo.scuzz` = module (not JVM packages) |
 | Toolchain | Scuzz (`examples/cli`); one compiler. Product version lives in `VERSION`. Bootstrap fetches the newest GitHub `v*` release ([Self-hosting](#self-hosting)) |
@@ -68,13 +68,13 @@ One CLI. One typer. One formatter. One linter. One testing strategy. No second a
 - **Watch** rebuilds when sources or `scuzz.toml` change. It does not patch running machine code. `[ui]` `run --watch` is hot reload: it recompiles `build/reload.dylib`, stamps, and swaps the View tree without resetting Signals (see [`guide.md`](guide.md)). IO-only `run --watch` kills and reruns the process on source change.
 - **Static hygiene** is `scuzz check` (the linter). `scuzz fmt` rewrites. No `lint` subcommand.
 - **Verification** is built into `scuzz` and the language (properties, sim overlays, deterministic TestRuntime, fuzz search, mutation). Not optional crates or Maven/npm test plugins. A search failure fails `scuzz fuzz`. A mutation survivor does not. A drive-script probe does not run `@main`.
-- **JSON diagnostics** (`scuzz check --message-format=json`) are the editor protocol. `check` reports the real file stem, line, and column from recorded token offsets. `scuzz lsp` wraps that, overlays open buffers, and serves language-server methods from the same parse. Goto-def, rename, hover, and completion use that parse. They must land on the right Scuzz span. Unclaimed def, signal, and control reports are info. They do not fail `check`. Do not grow a second typer or schema. A typed agent session schema is later ([`gaps.md`](gaps.md)). `--message-format=json` stays `check` until that schema ships.
+- **JSON diagnostics** (`scuzz check --message-format=json`) are the editor protocol. `check` reports the real file stem, line, and column from recorded token offsets. `scuzz lsp` wraps that, overlays open buffers, and serves language-server methods from the same parse. Overlay presence is a list entry. An open empty file stays empty. didChange reads full-sync `contentChanges`. Rename returns a WorkspaceEdit for the document URI. The server advertises only methods it implements (full sync, hover, completion, definition, formatting, rename without prepare, semantic tokens full). Diagnostics run the check file list with overlays through `Check.checkFilesOwn`. Goto-def, rename, hover, and completion use that parse. They must land on the right Scuzz span. Unclaimed def, signal, and control reports are info. They do not fail `check`. Do not grow a second typer or schema. A typed agent session schema is later ([`gaps.md`](gaps.md)). `--message-format=json` stays `check` until that schema ships.
 - **Dogfood IDE.** A Scuzz `[ui]` package is the in-tree IDE. `scuzz ide` on the one CLI launches that package with Desktop. Headless stays a peer (`scuzz ide --headless`). The app talks to `scuzz check` / `scuzz lsp` / `scuzz fmt` / `scuzz run` / `scuzz fuzz`. It does not reimplement them. `scuzz lsp` stays the protocol for external editors. Do not add Desktop-only editor behavior. Do not ship a second `scuzz-ide` binary.
-- **`scuzz.toml` is data** — package, path deps, `[ui]`. No plugin DSL. No `build.scuzz` hooks. Unknown keys rejected. Do not add `[plugins]`.
-- **Fingerprint** (incremental): miss → rebuild. A hit still rebuilds when the out-dir has no `.ll`. The fingerprint includes compiler/runtime identity, native sources, target, clang version, Skia backend, and verify mode. Live (`fingerprint`) and verify (`fingerprint.verify`) share `build/` artifacts. A compile writes its mode file and deletes the sibling so a later switch rebuilds. No `scuzz clean` ritual.
+- **`scuzz.toml` is data** — package, path deps, `[ui]`. No plugin DSL. No `build.scuzz` hooks. Unknown keys rejected. Do not add `[plugins]`. `scuzz run` and `scuzz ide` export `SCUZZ_UI_RUNTIME` from `[ui].default_runtime`. `--headless` forces Headless. A raw binary with that env unset stays Headless.
+- **Fingerprint** (incremental): miss → rebuild. A hit still rebuilds when the out-dir has no `.ll`. A hit with a `.ll` is silent. The fingerprint text is VERSION, `uname -s`, a `clang -v` one-liner, `sk_capi_backend`, the toml, and the listed sources. Live (`fingerprint`) and verify (`fingerprint.verify`) share `build/` artifacts. A compile writes its mode file and deletes the sibling so a later switch rebuilds. Native `.a` mtimes are not in the stamp. No `scuzz clean` ritual.
 - **Native make:** quiet on success. A failed `make` prints the log. Clang compiles `.ll` without C `-I`. Package link uses `-O0 -Wno-override-module` (IR has no host triple). `scripts/bootstrap.sh` clang-links the product CLI at `-O2` after tagged bootstrap emit. A cli-ok proof of `examples/cli` writes a separate out-dir so it does not replace that binary. Make and clang of runtime and UI crates use `SCUZZ_HOME` when that env is set. `scuzz run` uses the fingerprint. `scuzz build PATH` writes `PATH/build`. A fuzz probe that runs longer than 20 s is killed.
 - **Missing tools:** fail on the first missing tool with one install line. No `flutter doctor` mega-checklist.
-- **`scuzz package`:** Android runs `crates/embedder-mobile/shells/android/build_ndk.sh` and emits `libscuzz.so` (needs the NDK). The same command installs the APK when `adb` lists a device. No device is not a failure. iOS runs `crates/embedder-mobile/shells/ios/build_sim.sh` and emits a signed simulator `.app`. Artifacts land in `build/package/`. A package that calls Net fails: mobile shells do not link OpenSSL. Not a Gradle/CocoaPods API.
+- **`scuzz package`:** `--target` is host, android, ios, or all. Default is host. An unknown target fails at parse. Android runs `crates/embedder-mobile/shells/android/build_ndk.sh` and emits `libscuzz.so` (needs the NDK). The same command installs the APK when `adb` lists a device. No device is not a failure. iOS runs `crates/embedder-mobile/shells/ios/build_sim.sh` and emits a signed simulator `.app`. When `SCUZZ_HOME` is set, the command exports `SCUZZ` to `$SCUZZ_HOME/bin/scuzz` before those shells. Shell tokens (bundle id, script path, project dir, copy dests) are quoted. Artifacts land in `build/package/`. A package that calls Net fails: mobile shells do not link OpenSSL. Not a Gradle/CocoaPods API.
 
 ### Self-hosting
 
@@ -94,8 +94,8 @@ Verification track:
 
 **Staged slices**, in order. Each slice is a Scuzz package with its own campaign. Each slice must pass roundtrip, idempotence, and differential oracles before the next starts:
 
-1. `scuzz fmt` core in Scuzz. In: `examples/fmt` printer over `examples/syntax`. Oracles: parse-print roundtrip, fmt idempotence (`fmt-ok`). Timeline session claims emit `effectHas` / fiber counts / `signalListLen` / `signalStrHas` as runtime kits. A tap lambda runs the body as IO only when that body is IO. `Signal.set` is not IO. Lexer and parser live in `examples/syntax` (path dep).
-2. Kernel typechecker in Scuzz. In: `examples/tyck` typechecks a kernel subset (unbound name, arithmetic mismatch, arity, def body, `IO.println` payload, unknown function, unknown kit name, comparison, `@main` body, arg type). Diagnostics report the real file stem, line, and column. A duplicate substring does not steal the span. A second file keeps its own stem. Oracles: diagnostic idempotence (`tyck-ok`). Checker lives in `examples/compiler` (path dep).
+1. `scuzz fmt` core in Scuzz. In: `examples/fmt` printer over `examples/syntax`. Oracles: parse-print roundtrip, fmt idempotence (`fmt-ok`). Pretty prints `::` with parser precedence (tighter than `==`, looser than `<<`) and right-assoc parens. A `for` guard prints `if pred`. Timeline session claims emit `effectHas` / fiber counts / `signalListLen` / `signalStrHas` as runtime kits. A tap lambda runs the body as IO only when that body is IO. `Signal.set` is not IO. Lexer and parser live in `examples/syntax` (path dep).
+2. Kernel typechecker in Scuzz. In: `examples/tyck` typechecks a kernel subset (unbound name, arithmetic mismatch, arity, def body, `IO.println` payload, unknown function, unknown kit name, comparison, `@main` body, arg type, function apply, function body vs `A => B`). Diagnostics report the real file stem, line, and column. A parse miss is not a type error. A duplicate substring does not steal the span. A second file keeps its own stem. Oracles: drive groups (`tyck-ok`). Checker lives in `examples/compiler` (path dep).
 3. Kernel codegen in Scuzz: LLVM IR text. In: `examples/codegen` lowers the kernel subset (hello, `if`, lists, enums, match). Oracles: emit idempotence (`ir-ok`). Emit lives in `examples/compiler` (path dep).
 4. CLI, driver, and the verification stack. In: `examples/cli` parses argv, emits help, and dispatches. `examples/compiler` holds the kernel typechecker, LLVM emit, `scuzz.toml` parse, compile pipeline, and clang argv. `Cli.runCmd` emits human or JSON diagnostics. `Emit.emitFull` / `Drive.compilePkg` / `Drive.emitDir` emit a linkable `.ll` from `src/` and path-dep packages. Oracles: empty-args `cli-ok`. The product CLI is the Scuzz-emitted binary. That binary compiles hello, the compiler library, and `examples/cli`. `scuzz test` fails when clang fails. `scuzz fuzz` runs drive oracles, mutation, `Timeline => Verdict` session claims, and `--relate`. `scuzz package` copies host, Android, and iOS artifacts. Product version lives in `VERSION`.
 
@@ -113,11 +113,13 @@ IO constructors retain inner nodes and drop the caller ref after the call. Delay
 
 ### Skia
 
-No vendored Skia tree. Thin `sk_capi` (measure + draw). **Default UI backend** is the pinned Skia CPU prebuilt (`third_party/skia/PIN` → `scripts/fetch_skia.sh`). App link uses host zlib/bz2, not brotli. In-tree `sk_sw` is the explicit opt-out (`SCUZZ_SKIA=sk_sw`). `SCUZZ_SKIA=gpu` paints with `sk_sw` and presents through OpenGL (must not change `Ui` session or logical goldens). Impeller / Skia GPU raster stay deferred. Callers depend only on `sk_capi.h`.
+No vendored Skia tree. Thin `sk_capi` (measure + draw). **Default UI backend** is the pinned Skia CPU prebuilt (`third_party/skia/PIN` → `scripts/fetch_skia.sh`). `make lib` compiles the in-tree shim into that archive so save/clip/restore and RGBA peek match `sk_capi.h`. App link uses host zlib/bz2, not brotli. In-tree `sk_sw` is the explicit opt-out (`SCUZZ_SKIA=sk_sw`). `SCUZZ_SKIA=gpu` paints with `sk_sw` and presents through OpenGL (must not change `Ui` session or logical goldens). Impeller / Skia GPU raster stay deferred. Callers depend only on `sk_capi.h`.
 
 ### IO and impurity
 
-One failure channel: `SzError` on `IO[T]`. The fail payload is a `String` message. Direction: typed `E` on `IO` without environment `R`. Do not add `ZIO[R, E, A]`. Blessed kits only. No app-level `IO.delay`. No user FFI. Expand kits for time, regex, and hash after the thesis-critical language gaps close. Cooperative single-threaded fibers are the scheduler for CLI, server, and UI (no OS threads for IO). Park on sleep, empty take, incomplete get, and fd poll. Cancel runs `IO.ensure` / `Resource` finalizers. `Fiber.fork` starts a supervised child. TestRuntime (`SCUZZ_TESTRT=1`) fakes clock, random, FS, net, and console. Simulation is hermetic: no live sockets; HTTP uses stubs and a loopback mailbox; `Sys.exec` / `Sys.spawn` fail; `Sys.getenv` is sealed; `Sys.alive` / `Sys.kill` use a fake process table. Live `Net.serve` binds localhost. Live HTTP client kits take `http://` and `https://` with OpenSSL. Expand `Net` on this HTTP/1.0 stack. Do not expose POSIX sockets. Do not add a second HTTP client. TLS is for `https://` on this kit. Every new `Net` op keeps a TestRuntime fake. Surface catalogs: [`guide.md`](guide.md). Panics abort through `sz_panic`. A panic must print a Scuzz file and line.
+One failure channel: `SzError` on `IO[T]`. The fail payload is a `String` message. Direction: typed `E` on `IO` without environment `R`. Do not add `ZIO[R, E, A]`. Blessed kits only. No app-level `IO.delay`. No user FFI. Expand kits for time, regex, and hash after the thesis-critical language gaps close. Cooperative single-threaded fibers are the scheduler for CLI, server, and UI (no OS threads for IO). Park on sleep, empty take, incomplete get, and fd poll. Cancel runs `IO.ensure` / `Resource` finalizers. `Fiber.fork` starts a supervised child. TestRuntime (`SCUZZ_TESTRT=1`) fakes clock, random, FS, net, and console. Simulation is hermetic: no live sockets; HTTP uses stubs and a loopback mailbox; `Sys.exec` / `Sys.spawn` fail; `Sys.getenv` is sealed except `SCUZZ_SERVE` / `SCUZZ_KIT`; `Sys.alive` / `Sys.kill` use a fake process table. Live `Net.serve` binds localhost. Live HTTP client kits take `http://` and `https://` with OpenSSL. Expand `Net` on this HTTP/1.0 stack. Do not expose POSIX sockets. Do not add a second HTTP client. TLS is for `https://` on this kit. Every new `Net` op keeps a TestRuntime fake. Surface catalogs: [`guide.md`](guide.md). Panics abort through `sz_panic`. A panic must print a Scuzz file and line.
+
+`Stream` is one finite pull interpreter. Constructors and transformers are `Stream[A]`. Bind a Stream with `=`. `<-` needs `IO`. Terminals (`compileToList` / `drain` / `head` / `last` / `count` / `fold` / `exists` / `forall` / `none`) are `IO`. `take` pulls until n outputs. `head` and `forall` / `none` / `exists` / `find` stop early. `range` / `iterate` / `unfold` allocate on pull. The unfold cap is 65536 pulled steps. Do not add backpressure, publishers, or a second stream kit.
 
 ### `Ui` vs `View`
 
@@ -145,10 +147,10 @@ Locks (not an API catalog — see [`guide.md`](guide.md)):
 
 - Expression dialect only: `for` primary binder (`=` pure, `<-` effect); no `val` / statement blocks / `var`. A `for` binder may unpack a tuple of 2 through 8 slots (`(a, b) = e`, `(a, b, c) = e`, `(a, b) <- e`) or a constructor, list, or as-pattern (`Point(x, y) = p`, `Opt.Some(n) <- e`, `h :: t = xs`). A miss panics. A `for` may include `if pred` (`pred` is Bool). A miss is `IO.fail`. The `for` needs a `<-` binder.
 - Optional `package`; top-level `def` / `private def` / `import`; `@main def …: IO[Unit]`
-- Payload enums + `record` sugar (methods on generic records and enums) + thin traits/`impl` (static dispatch, including `trait Get[T]` / `impl Get[Int] for Point` / `impl Get[T] for Opt`) + monomorphized generics on defs/enums/records. Match arms may use `case Pat if pred =>` (`pred` is Bool). A guarded arm does not cover the pattern for exhaustiveness. Match arms may use literal patterns (`case 0 =>`, `case "ok" =>`, `case true =>`). `true` and `false` together cover Bool. Int, Float, and String literals need `_` or a name bind. Match arms may use or-patterns (`case A | B =>`). Nested or in a payload works (`case Opt.Some(0 | 1)`). The body must typecheck for every alternative. Match arms may use an as-pattern (`case n @ Opt.Some(_)`). `n` binds the whole value. `n @ A | B` binds `n` for every alternative. Match arms may use list patterns (`case [] =>`, `case x :: xs =>`, `case [a, b] =>`). `[]` and `_ :: _` together cover `List`. Match arms may use a tuple pattern (2 through 8 slots) (`case (a, b)`). `(A, B, …)` is exhaustive. `p._1` … `p._N` project slots. A `for` binder and a lambda may unpack the same way (`(a, b) = e`, `(a, b) <- e`, `(a, b) =>`, `Point(x, y) = p`, `Opt.Some(n) <- e`, `h :: t = xs`, `(Opt.Some(n)) =>`). Nested tuples are allowed. A miss panics. Match arms may use named field patterns (`case Point(x = n)`, `case Opt.Some(x = n)`). Omitted fields are `_`. Positionals come first. Match arms may use a bare constructor name that starts with an uppercase letter (`case None`, `case Some(n)`, `case Red | Blue`). The scrutinee type selects the case. A lowercase name still binds. A lambda may pin its parameter with `(x: T) =>`. The annotation must match the expected kit or `A => B` parameter type. A kit or `A => B` argument may use one `_` hole (`List.map(xs, _ + 1)`, `List.map(xs, Str.fromInt(_))`). `_ + _` is rejected. `_ =>` still discards. A kit or `A => B` argument may be a case lambda (`{ case Opt.Some(n) => n case Opt.None => 0 }`, `{ case Some(n) => n case None => 0 }`). It matches the bound value. Exhaustiveness is the same as match. A kit or `A => B` argument may be a unary def (`List.map(xs, Str.fromInt)`, `apply(id, 3)`). A def with 2 through 8 params eta-expands as `(A, B, …) => R` (`List.foldLeft(xs, 0, add)`, `applyPair(add, 2, 3)`). A `for` binder or def may name an `A => B` value (`inc = (_ + 1): Int => Int`, `typed = (n: Int) => n + 1`, `def addN(n: Int): Int => Int = (m: Int) => n + m`). `f(x)` applies that value. `f(x, y)` applies `(A, B) => C`. An `A => B` expression applies with `e(x)` on one line (`plusOne()(5)`, `addN(3)(4)`, `((n: Int) => n + 1)(6)`). An `(A, B) => C` expression applies with `e(x, y)` (`((a, b) => a + b)(2, 3)`). Pass a named Fun to a kit or `A => B` parameter (`List.map(xs, eta)`, `apply(inc, 5)`, `apply(plusOne(), 6)`). `{ … }` without `case` is illegal.
+- Payload enums + `record` sugar (methods on generic records and enums) + thin traits/`impl` (static dispatch, including `trait Get[T]` / `impl Get[Int] for Point` / `impl Get[T] for Opt`) + monomorphized generics on defs/enums/records. Match arms may use `case Pat if pred =>` (`pred` is Bool). A guarded arm does not cover the pattern for exhaustiveness. Match arms may use literal patterns (`case 0 =>`, `case "ok" =>`, `case true =>`). `true` and `false` together cover Bool. Int, Float, and String literals need `_` or a name bind. Match arms may use or-patterns (`case A | B =>`). Nested or in a payload works (`case Opt.Some(0 | 1)`). The body must typecheck for every alternative. Match arms may use an as-pattern (`case n @ Opt.Some(_)`). `n` binds the whole value. `n @ A | B` binds `n` for every alternative. Match arms may use list patterns (`case [] =>`, `case x :: xs =>`, `case [a, b] =>`). `[]` and `_ :: _` together cover `List`. Match arms may use a tuple pattern (2 through 8 slots) (`case (a, b)`). `(A, B, …)` is exhaustive. `e._1` … `e._N` project slots of any tuple expression. A `for` binder and a lambda may unpack the same way (`(a, b) = e`, `(a, b) <- e`, `(a, b) =>`, `Point(x, y) = p`, `Opt.Some(n) <- e`, `h :: t = xs`, `(Opt.Some(n)) =>`). Nested tuples are allowed. A miss panics. Match arms may use named field patterns (`case Point(x = n)`, `case Opt.Some(x = n)`). Omitted fields are `_`. Positionals come first. Match arms may use a bare constructor name that starts with an uppercase letter (`case None`, `case Some(n)`, `case Red | Blue`). The scrutinee type selects the case. A lowercase name still binds. A lambda may pin its parameter with `(x: T) =>`. The annotation must match the expected kit or `A => B` parameter type. A kit or `A => B` argument may use one `_` hole (`List.map(xs, _ + 1)`, `List.map(xs, Str.fromInt(_))`). `_ + _` is rejected. `_ =>` still discards. A kit or `A => B` argument may be a case lambda (`{ case Opt.Some(n) => n case Opt.None => 0 }`, `{ case Some(n) => n case None => 0 }`). It matches the bound value. Exhaustiveness is the same as match. A kit or `A => B` argument may be a unary def (`List.map(xs, Str.fromInt)`, `apply(id, 3)`). A def with 2 through 8 params eta-expands as `(A, B, …) => R` (`List.foldLeft(xs, 0, add)`, `applyPair(add, 2, 3)`). A `for` binder or def may name an `A => B` value (`inc = (_ + 1): Int => Int`, `typed = (n: Int) => n + 1`, `def addN(n: Int): Int => Int = (m: Int) => n + m`). `f(x)` applies that value. `f(x, y)` applies `(A, B) => C`. An `A => B` expression applies with `e(x)` on one line (`plusOne()(5)`, `addN(3)(4)`, `((n: Int) => n + 1)(6)`). An `(A, B) => C` expression applies with `e(x, y)` (`((a, b) => a + b)(2, 3)`). Pass a named Fun to a kit or `A => B` parameter (`List.map(xs, eta)`, `apply(inc, 5)`, `apply(plusOne(), 6)`). `{ … }` without `case` is illegal.
 - File-stem modules; enums namespaced by stem; `import Module.name` for bare disambiguation. `import Module.name as alias` binds a local name. `import Module.*` binds every public def, enum, and type alias. `check` reports an unused import, an unused local, an unused parameter, and an unused private def. A name that starts with `_` is kept on purpose. Lone `_` discards. A record value rebuilds with `.copy` (`p.copy(y = 9)`, `p.copy(1)`). Omitted fields keep the receiver values. Positionals fill fields in order. A file may declare `type Name = T` or `type Name[T] = List[T]`. The checker expands the alias in params, returns, and `e: T`.
-- Types: `Unit`, `Int`, `Float`, `String`, `Bool`, `List[T]`, `Option[T]`, `Map[K, V]`, `Set[T]`, `(A, B, …)`, `IO[T]`, `IO[E, A]`, `A => B`, blessed handles (`Fiber[A]`, `Ref[A]`, `Queue[A]`, `Deferred[A]`, `Resource[A]`, `Stream[A]`), nominal enums. `true` / `false` are `Bool`. `Bool` is not `Int`. An `if` may omit `else` when the then arm is `Unit` or `IO[Unit]`. `attempt` is `IO[Result[A]]`. `List.head` is `Option[T]`. Empty is `None`. `IO[A]` means `IO[String, A]`. `IO.fail(e)` takes `E`. `handleErrorWith` binds `E`. `flatMap` keeps one `E`. Unary `!` is Bool. Unary `-` is Int or Float. Unary `~` and bitwise `&` / `|` / `^` / `<<` / `>>` are Int. `h :: t` is `List.cons(h, t)` (right-associative). Hex (`0xFF`) and binary (`0b1010`) are Int literals. Underscore may separate digits (`1_000`, `0xFF_00`, `0b1010_0001`). Scientific notation is a Float (`1.5e-3`, `1e10`). Triple-quoted strings (`"""…"""` / `s"""…$x…"""`) keep newlines. Identifiers may start with `_` (`_n`). Lone `_` discards. Call arguments may use `name = expr`. Positionals come first. Named arguments fill the remaining parameters by name. A `def` parameter may have a default (`m: Int = 1`). Omitted trailing arguments use the default. Named calls may omit any parameter that has a default. Defaults are closed expressions (no parameter names). Properties, traits, and methods do not take defaults. A call may end with a comma. An expression may pin its type with `e: T`. A typed position may construct with a bare uppercase case name (`None: Option[Int]`, `Some(1)`, `if (ok) Some(n) else None`). `==` / `!=` on String, List, Map, Set, tuples, enums, and records compare by value. Blessed handles compare by identity.
-- Blessed kits + `Signal` / `View` / `Ui` / `Property.*` / `.require` as documented in the guide. `IO.fail(e)` is `IO[E, A]`. `IO[A]` means `IO[String, A]`. An `if` / match / `IO.race` arm may be `IO.fail` next to another `IO[T]`. An `if` may omit `else` when the then arm is `Unit` or `IO[Unit]`. `io.map(f)` maps a success. The body is pure `B`. The result is `IO[B]`. Kit lambdas bind the list element type (`List.filter` / `List.filterNot` / `List.map` / `List.flatMap` / `List.find` / `List.findLast` / `List.exists` / `List.count` / `List.takeWhile` / `List.dropWhile` / `List.forall` / `List.indexWhere` / `List.lastIndexWhere` / `List.span` / `List.partition` / `List.prefixLength` / `List.segmentLength` / `List.sortBy` / `List.maxBy` / `List.minBy` / `List.groupBy` / `List.distinctBy` / `IO.foreach` / `IO.foreachDiscard`), the fold pair (`List.foldLeft` / `List.foldRight` / `List.scanLeft` / `List.scanRight` / `List.reduceLeft` / `List.reduceRight`), the map value (`Map.filter` / `Map.exists` / `Map.forall` / `Map.mapValues`), the set element (`Set.filter` / `Set.exists` / `Set.forall` / `Set.map`), the ref cell (`Ref.update` / `Ref.updateAndGet`), `String` (`View.each`), the request tuple (`Net.serve`), the stream or resource payload (`Stream.*` / `Resource.make` / `Resource.use`), the fold pair (`Stream.scan` / `Stream.fold` / `Stream.zipWith`), or `Int` (`Signal.map` / `List.tabulate`). The lambda body must return the kit result (`View`, `Bool`, `String`, `T` for `List.map` / `List.tabulate` / `Map.mapValues` / `Stream.map` / `Ref.update` / `Ref.updateAndGet`, `Int` for `List.sortBy` / `List.maxBy` / `List.minBy`, `Int` or `String` for `List.groupBy` / `List.distinctBy` / `Set.map`, `List` for `List.flatMap` / `Stream.mapConcat` / `Stream.unfold`, `Stream` for `Stream.flatMap`, or `IO`). A lambda may pin that bind with `(x: T) =>`. A lambda may unpack a tuple of 2 through 8 slots with `(a, b) =>` or a constructor with `(Opt.Some(n)) =>`. A kit or `A => B` argument may use one `_` hole (`List.map(xs, _ + 1)`, `Str.fromInt(_)`). `_ + _` is rejected. `_ =>` still discards. A kit or `A => B` argument may be a case lambda (`{ case Opt.Some(n) => n case Opt.None => 0 }`, `{ case Some(n) => n case None => 0 }`). It matches the bound value. Exhaustiveness is the same as match. A kit or `A => B` argument may be a unary def (`List.map(xs, Str.fromInt)`, `apply(id, 3)`). A def with 2 through 8 params eta-expands as `(A, B, …) => R` (`List.foldLeft(xs, 0, add)`, `applyPair(add, 2, 3)`). A `for` binder or def may name an `A => B` value (`inc = (_ + 1): Int => Int`, `typed = (n: Int) => n + 1`, `def addN(n: Int): Int => Int = (m: Int) => n + m`). `f(x)` applies that value. `f(x, y)` applies `(A, B) => C`. An `A => B` expression applies with `e(x)` on one line (`plusOne()(5)`, `addN(3)(4)`, `((n: Int) => n + 1)(6)`). An `(A, B) => C` expression applies with `e(x, y)` (`((a, b) => a + b)(2, 3)`). Pass a named Fun to a kit or `A => B` parameter (`List.map(xs, eta)`, `apply(inc, 5)`, `apply(plusOne(), 6)`). `{ … }` without `case` is illegal.
+- Types: `Unit`, `Int`, `Float`, `String`, `Bool`, `List[T]`, `Option[T]`, `Map[K, V]`, `Set[T]`, `(A, B, …)`, `IO[T]`, `IO[E, A]`, `A => B`, blessed handles (`Fiber[A]`, `Ref[A]`, `Queue[A]`, `Deferred[A]`, `Resource[A]`, `Stream[A]`), nominal enums. `true` / `false` are `Bool`. `Bool` is not `Int`. An `if` may omit `else` when the then arm is `Unit` or `IO[Unit]`. `attempt` is `IO[Result[A]]`. `List.head` is `Option[T]`. Empty is `None`. `Map.get` is `Option[V]`. A miss is `None`. `IO[A]` means `IO[String, A]`. `IO.fail(e)` takes `E`. `handleErrorWith` binds `E`. `flatMap` keeps one `E`. Unary `!` is Bool. Unary `-` is Int or Float. Unary `~` and bitwise `&` / `|` / `^` / `<<` / `>>` are Int. `h :: t` is `List.cons(h, t)` (right-associative). Hex (`0xFF`) and binary (`0b1010`) are Int literals. Underscore may separate digits (`1_000`, `0xFF_00`, `0b1010_0001`). Scientific notation is a Float (`1.5e-3`, `1e10`). Triple-quoted strings (`"""…"""`) keep newlines. Use `s"…$x…"` for interpolation. The dialect has no line comments. Identifiers may start with `_` (`_n`). Lone `_` discards. Call arguments may use `name = expr`. Positionals come first. Named arguments fill the remaining parameters by name. A `def` parameter may have a default (`m: Int = 1`). Omitted trailing arguments use the default. Named calls may omit any parameter that has a default. Defaults are closed expressions (no parameter names). Properties, traits, and methods do not take defaults. A call may end with a comma. An expression may pin its type with `e: T`. A typed position may construct with a bare uppercase case name (`None: Option[Int]`, `Some(1)`, `if (ok) Some(n) else None`). `==` / `!=` on String, List, Map, Set, tuples, enums, and records compare by value. Blessed handles compare by identity.
+- Blessed kits + `Signal` / `View` / `Ui` / `Property.*` / `.require` as documented in the guide. `IO.fail(e)` is `IO[E, A]`. `IO[A]` means `IO[String, A]`. An `if` / match / `IO.race` arm may be `IO.fail` next to another `IO[T]`. An `if` may omit `else` when the then arm is `Unit` or `IO[Unit]`. `io.map(f)` maps a success. The body is pure `B`. The result is `IO[B]`. Kit lambdas bind the list element type (`List.filter` / `List.filterNot` / `List.map` / `List.flatMap` / `List.find` / `List.findLast` / `List.exists` / `List.count` / `List.takeWhile` / `List.dropWhile` / `List.forall` / `List.indexWhere` / `List.lastIndexWhere` / `List.span` / `List.partition` / `List.prefixLength` / `List.segmentLength` / `List.sortBy` / `List.maxBy` / `List.minBy` / `List.groupBy` / `List.distinctBy` / `IO.foreach` / `IO.foreachDiscard`), the fold pair (`List.foldLeft` / `List.foldRight` / `List.scanLeft` / `List.scanRight` / `List.reduceLeft` / `List.reduceRight`), the map value (`Map.filter` / `Map.exists` / `Map.forall` / `Map.mapValues`), the set element (`Set.filter` / `Set.exists` / `Set.forall` / `Set.map`), the ref cell (`Ref.update` / `Ref.updateAndGet`), `String` (`View.each`), the request tuple (`Net.serve`), the stream or resource payload (`Stream.*` / `Resource.make` / `Resource.use`), the fold pair (`Stream.scan` / `Stream.fold` / `Stream.zipWith`), or `Int` (`Signal.map` / `List.tabulate`). The lambda body must return the kit result (`View`, `Bool`, `String`, `T` for `List.map` / `List.tabulate` / `Map.mapValues` / `Stream.map` / `Ref.update` / `Ref.updateAndGet`, `Int` for `List.sortBy` / `List.maxBy` / `List.minBy`, `Int` or `String` for `List.groupBy` / `List.distinctBy` / `Set.map`. `Set.map` and `List.toSet` take the key kind from the key cell. `List` for `List.flatMap` / `Stream.mapConcat` / `Stream.unfold`, `Stream` for `Stream.flatMap`, or `IO`). A lambda may pin that bind with `(x: T) =>`. A lambda may unpack a tuple of 2 through 8 slots with `(a, b) =>` or a constructor with `(Opt.Some(n)) =>`. A kit or `A => B` argument may use one `_` hole (`List.map(xs, _ + 1)`, `Str.fromInt(_)`). `_ + _` is rejected. `_ =>` still discards. A kit or `A => B` argument may be a case lambda (`{ case Opt.Some(n) => n case Opt.None => 0 }`, `{ case Some(n) => n case None => 0 }`). It matches the bound value. Exhaustiveness is the same as match. A kit or `A => B` argument may be a unary def (`List.map(xs, Str.fromInt)`, `apply(id, 3)`). A def with 2 through 8 params eta-expands as `(A, B, …) => R` (`List.foldLeft(xs, 0, add)`, `applyPair(add, 2, 3)`). A `for` binder or def may name an `A => B` value (`inc = (_ + 1): Int => Int`, `typed = (n: Int) => n + 1`, `def addN(n: Int): Int => Int = (m: Int) => n + m`). `f(x)` applies that value. `f(x, y)` applies `(A, B) => C`. An `A => B` expression applies with `e(x)` on one line (`plusOne()(5)`, `addN(3)(4)`, `((n: Int) => n + 1)(6)`). An `(A, B) => C` expression applies with `e(x, y)` (`((a, b) => a + b)(2, 3)`). Pass a named Fun to a kit or `A => B` parameter (`List.map(xs, eta)`, `apply(inc, 5)`, `apply(plusOne(), 6)`). `{ … }` without `case` is illegal.
 - No macros, no implicits, no HKT beyond `IO`, no null
 
 ## Language direction
@@ -186,7 +188,7 @@ Close these before more widgets or Net surface.
 
 - **Named Signals.** In: a Signal publishes its `for` binder name (`count = Signal.int(0)` → `"count"`). Claims and `Property.signal*` read that name. `Verdict.alwaysHas` and `Verdict.afterHit` cover the always-visible and after-hit-shows folds. Dump slot ids stay an implementation detail. The integer-id kit is gone.
 - **`Signal[T]`.** In: `Signal.list` holds `List[T]` over records and enums; `View.each` binds the element type (record fields work in the body). A record list dumps its count only (`list[N] name = <count>`). Direction: one generic cell (`Signal.map` stays `Int => String`; no non-list `Signal[T]` cell yet). Encoded strings as domain values are not.
-- **UTF-8 `String`.** In: `Str.*` indexes Unicode code points (`len` / `charAt` / `slice` / `take` / `drop` / `takeRight` / `dropRight` / `reverse` / `indexOf` / `lastIndexOf`). `Str.byteLen` / `Str.byteSlice` keep bytes for protocol framing. Case maps stay ASCII. TextField and editor caret offsets stay bytes. ASCII strings take a byte fast path in the runtime.
+- **UTF-8 `String`.** In: `Str.*` indexes Unicode code points (`len` / `charAt` / `slice` / `take` / `drop` / `takeRight` / `dropRight` / `reverse` / `indexOf` / `lastIndexOf`). An isolated or invalid byte counts as one code point (same walk as decode). `Str.byteLen` / `Str.byteSlice` keep bytes for protocol framing. `Str.padLeft` / `Str.padRight` measure width in code points and cycle complete code points. `Str.fromBool` is `"true"` / `"false"`. Case maps stay ASCII. The `Str` kit is closed: unknown `Str.*` fails `check`. String-producing `Str` ops type as `String`. TextField and editor caret offsets stay bytes. ASCII strings take a byte fast path in the runtime.
 - **Typed fail.** Check encodes `IO[E, A]`. `IO[A]` means `IO[String, A]`. `IO.fail(e)` takes `E`. `handleErrorWith` binds `E`. `flatMap` keeps one `E`. Kits still fail with `String`. The C `SzError` wire stays a string. Do not add environment `R`. Do not add user FFI.
 
 ### Modules and source shape
@@ -212,9 +214,9 @@ App correctness is **not** classical unit tests. Prefer **mutation, fuzzing, pro
 - **Concrete facts are legitimate oracles.** A `.require` may state one known input/output pair (the VAT rate for `"DE"` is `0.19`). Mutation arms it like any oracle. Do not contort a concrete fact into a general claim. Do not grow fixture-diff suites out of concrete facts. A zero-argument `*.scuzz_verify` oracle writes `drive <name>` into `build/seeds.txt`. `scuzz fuzz` replays those seeds with `corpus/`.
 - **Metamorphic oracles close the remaining gap.** When no absolute oracle exists, relate two runs of the same def (a permuted input keeps the total). Metamorphic relations are drive oracles in `*.scuzz_verify` (swap) or `.require` idioms. Do not keep a second Scuzz body as a spec.
 - **Drivers (`*.scuzz_drivers`) do things.** Impure, parameterized, oracle-free steps. `scuzz fuzz` composes them (generated args, random order / interleaving) alongside the UI event alphabet. `check` rejects `Property.*` and `.require` in driver files. Drive names are unique in the package (`drive` has no module). A driver name must not match another driver or a verify drive oracle. At most 32 drive names. An assert inside a driver is a unit test in disguise.
-- **Simulation is hermetic.** Fuzz, mutation, and TestRuntime keep impurity inside fakes. No live sockets. HTTP client kits use stubs. A loopback URL with no stub parks on a virtual mailbox. `Net.serve` / `Net.serveOnce` accept injected requests and those mailbox items. TCP and UDP kits use a mailbox. Persistent fake serve drains and stops when injects and the mailbox are empty. `serveOnce` parks so `IO.both(Net.serveOnce, Net.httpGet)` completes in either order. Stubs win over loopback. A Net fault fails before loopback. `Sys.exec` / `Sys.spawn` fail under TestRuntime so a child cannot open the network. `Sys.getenv` does not read the host map. `Sys.alive` / `Sys.kill` do not touch host pids. Live HTTP client kits may leave the host. Scheduler ownership, not address, is the determinism boundary.
+- **Simulation is hermetic.** Fuzz, mutation, and TestRuntime keep impurity inside fakes. No live sockets. HTTP client kits use stubs. A loopback URL with no stub parks on a virtual mailbox. `Net.serve` / `Net.serveOnce` accept injected requests and those mailbox items. TCP and UDP kits use a mailbox. Persistent fake serve drains and stops when injects and the mailbox are empty. `serveOnce` parks so `IO.both(Net.serveOnce, Net.httpGet)` completes in either order. Stubs win over loopback. A Net fault fails before loopback. `Sys.exec` / `Sys.spawn` fail under TestRuntime so a child cannot open the network. `Sys.getenv` does not read the host map. Install copies `SCUZZ_SERVE` and `SCUZZ_KIT` into the sealed overlay. `Sys.alive` / `Sys.kill` do not touch host pids. Live HTTP client kits may leave the host. Scheduler ownership, not address, is the determinism boundary.
 - **`Property.sometimes` keeps composition honest.** Reachability accumulates across a fuzz *campaign*. Declared-but-never-reached states fail the campaign. Oracle-free drivers cannot pass vacuously. It is a coverage/fitness signal for corpus guidance, alongside Headless dump novelty. It is a path marker (`Unit`), not a value method.
-- **Mutation pressures the oracles.** `scuzz fuzz` mutates live `def` bodies after search. Residual oracles must kill each mutant. `--oracles` mutates residual predicates. A surviving mutant reports the source location, enclosing def, mutation label, the nearest residual oracle, and a weak or missing claim. Survivors that change a claimed `State` field are weak claims. Survivors that change an unclaimed `State` field are missing claims. Survivors with bit-identical replayed timelines are inert and unreported.
+- **Mutation pressures the oracles.** `scuzz fuzz` mutates live `def` and impl method bodies after search. Residual oracles must kill each mutant. `--oracles` mutates residual predicates. Count and apply share one walk, so site numbers match. A typecheck or link miss is killed, not a campaign abort. Each mutant gets an idle probe, then replay of corpus+seeds entries that passed on the original. Kill = idle fails, or a passing entry fails. Survivors that change a claimed `State` field are weak claims. Survivors that change an unclaimed `State` field are missing claims. Survivors with bit-identical replayed timelines are inert and unreported.
 - **Expected-fail proof** is the `examples/bad-*` packages. Each pins a known-wrong campaign in `corpus/`. Search must fail and write `repro.toml`. `examples/bad-intent` fails `scuzz check`. The others keep `scuzz check` and `scuzz test` green. `--no-fail-fast` still mutates. Inert mutants stay unreported. Catalog: [`guide.md`](guide.md).
 
 | Phase | Role |
@@ -262,9 +264,9 @@ Oracles divide into three tiers by the judgment they need.
 
 ### `scuzz fuzz`
 
-Deterministic TestRuntime + (for `[ui]`) Headless event scripts (plus sim overlays when present). The fuzz alphabet is `[taps]` targets, text fields, and scrolls **plus declared drivers** **plus verify drive oracles** (same `drive` verb). Oracles: `*.scuzz_verify` timeline predicates and drive oracles, plus in-body `.require` / `where`, first. Panic/`SzError` still fails. Implicit oracles fail a run on leak, deadlock, heap baseline, acquire/release pairing, finalizer-on-cancel, leftover parked fibers after quiesce, and a silent live/verify split. `Property.sometimes` reachability judges the campaign. `Property.classify` counts are visibility only. `repro.toml` records a **shrunk** event list + driver invocations + optional schedule and fault plan so replay is generator-independent. Every campaign loads `<pkg>/corpus/*.toml` then `build/seeds.txt` before search. A failing stored entry is a search failure. `--iterations 0` replays corpus and seeds and stops. `[ui]` kept prefixes run twice; a dump or timeline mismatch fails. `tap N` / `scroll N` follow a11y preorder, not a pixel scan. Stable control keys for inject stay a later gap. Named observations apply to claims first. `pump` is time. No hidden nondeterminism. Search explores `SCUZZ_FAULT_SEED` like `SCUZZ_SCHED_SEED`. Seed `0` is no fault. Iter `0` stays no-fault. Default stops at the first search failure. `--no-fail-fast` keeps that repro, finishes search, then mutates. Survivors with bit-identical replayed timelines are inert and unreported. `--oracles` mutates residual predicates. The command writes `build/fuzz/summary.toml`. Flags, script verbs, schedule seeds, and fault seeds: [`guide.md`](guide.md).
+Deterministic TestRuntime + (for `[ui]`) Headless event scripts (plus sim overlays when present). The fuzz alphabet is `[taps]` targets, text fields, and scrolls **plus declared drivers** **plus verify drive oracles** (same `drive` verb). Oracles: `*.scuzz_verify` timeline predicates and drive oracles, plus in-body `.require` / `where`, first. Panic/`SzError` still fails. Implicit oracles fail a run on leak, deadlock, heap baseline, acquire/release pairing, finalizer-on-cancel, leftover parked fibers after quiesce, and a silent live/verify split. `Property.sometimes` reachability judges the campaign. `Property.classify` counts are visibility only. `repro.toml` records a **shrunk** event list + driver invocations + optional schedule and fault plan so replay is generator-independent. Every campaign loads `<pkg>/corpus/*.toml` then `build/seeds.txt` before search. A failing stored entry is a search failure. `--iterations 0` replays corpus and seeds and stops. Search after replay repeats that same script. It walks `SCUZZ_SCHED_SEED` 0, 1, 2, … for the remaining budget. Iter 0 keeps no fault. Later iters set `SCUZZ_FAULT_SEED` to that same counter. Drive does not mutate `run.script` yet. `tap N` / `scroll N` follow a11y preorder, not a pixel scan. Stable control keys for inject stay a later gap. Named observations apply to claims first. `pump` is time. No hidden nondeterminism. Search explores `SCUZZ_FAULT_SEED` like `SCUZZ_SCHED_SEED`. Seed `0` is no fault. Iter `0` stays no-fault. Default stops at the first search failure. `--no-fail-fast` keeps that repro, finishes search, then mutates. Survivors with bit-identical replayed timelines are inert and unreported. `--oracles` mutates residual predicates. The command writes `build/fuzz/summary.toml`. Flags, script verbs, schedule seeds, and fault seeds: [`guide.md`](guide.md).
 
-Runs end in a quiesce phase and claims judge the complete timeline at the terminal point, in memory. The campaign persists identities (corpus entries, `repro.toml`) and aggregates (`summary.toml`). Full timelines re-derive by replay. `Property.sometimes` verdicts match Antithesis campaign aggregation: a name must occur at least once. Scuzz does not emit an Antithesis SDK JSONL stream. `scuzz fuzz --minimize-corpus` greedily drops events while pass/fail status and declared `sometimes` coverage hold. Push/PR CI stays a bounded deterministic campaign. Long-budget campaigns stay local. No corpus auto-commit; failures report to authors.
+Runs end in a quiesce phase and claims judge the complete timeline at the terminal point, in memory. The campaign persists identities (corpus entries, `repro.toml`) and aggregates (`summary.toml`). Full timelines re-derive by replay. `Property.sometimes` verdicts match Antithesis campaign aggregation: a name must occur at least once. Scuzz does not emit an Antithesis SDK JSONL stream. Push/PR CI stays a bounded deterministic campaign. Long-budget campaigns stay local. No corpus auto-commit; failures report to authors.
 
 ### Layout model
 
@@ -293,7 +295,7 @@ App authors: [`guide.md`](guide.md). Vertical slices over breadth. No Desktop-on
 | Language + UI + tooling is huge | Small subset. Vertical slices. Counter before generality |
 | Dialect unexercised by apps | Kernel examples that stress each construct. `check` / `test` / `fuzz` on the passing `examples/`. `examples/bad-*` are expected-fail campaigns |
 | Effects too weak or too heavy | Builtin IO. Pure `View`. `Ui` at session boundary |
-| Hidden nondeterminism | Closed impurity + hermetic TestRuntime + deterministic `*.scuzz_sim`. No live sockets under sim. `Sys.exec` / `Sys.spawn` fail under TestRuntime. `Sys.getenv` is sealed. `Sys.alive` / `Sys.kill` use a fake process table. Double-run same-seed determinism is a universal oracle |
+| Hidden nondeterminism | Closed impurity + hermetic TestRuntime + deterministic `*.scuzz_sim`. No live sockets under sim. `Sys.exec` / `Sys.spawn` fail under TestRuntime. `Sys.getenv` is sealed except `SCUZZ_SERVE` / `SCUZZ_KIT`. `Sys.alive` / `Sys.kill` use a fake process table. Double-run same-seed determinism is a universal oracle |
 | Properties become brittle dump goldens | Named observations on Signals and controls. Two `Verdict` helpers for the repeated folds. Strict sim/live pairing in `check`. Mutation kills weak oracles. `scuzz test` goldens stay regression pins |
 | `String` as bytes mangles UI text | UTF-8 `String` before more text features ([`gaps.md`](gaps.md)) |
 | `Signal.list` of String blocks domain UI | `Signal[T]` and `View.each` over records ([`gaps.md`](gaps.md)) |
diff --git a/examples/bad-intent/empty.scuzz_verify b/examples/bad-intent/empty.scuzz_verify
index e69de29b..142cbdde 100644
--- a/examples/bad-intent/empty.scuzz_verify
+++ b/examples/bad-intent/empty.scuzz_verify
@@ -0,0 +1,3 @@
+def ok(): Bool =
+  true
+
diff --git a/examples/bad-intent/nested/stale.scuzz_intent b/examples/bad-intent/nested/stale.scuzz_intent
new file mode 100644
index 00000000..19bbe9c5
--- /dev/null
+++ b/examples/bad-intent/nested/stale.scuzz_intent
@@ -0,0 +1 @@
+leftover intent
diff --git a/examples/bad-intent/scuzz.toml b/examples/bad-intent/scuzz.toml
index d573dd52..c71b4fae 100644
--- a/examples/bad-intent/scuzz.toml
+++ b/examples/bad-intent/scuzz.toml
@@ -1,4 +1,4 @@
 [package]
 name = "bad-intent"
 version = "0.1.0"
-description = "Present empty verify. scuzz check must fail."
+description = "Present empty verify or leftover intent. scuzz check must fail."
diff --git a/examples/cli/cli.scuzz_verify b/examples/cli/cli.scuzz_verify
index e5601949..eaf5fead 100644
--- a/examples/cli/cli.scuzz_verify
+++ b/examples/cli/cli.scuzz_verify
@@ -17,13 +17,13 @@ def cliJsonCheck(): Bool =
   Main.cliDiff(Cli.show(Cli.parse(Main.a2("--message-format=json", "check"))), "check path=. json=true")
 
 def cliErrs(): Bool =
-  Main.cliDiff(Cli.render(Cli.parse(Main.a1("nope"))), Main.wantUnrec()) && Main.cliDiff(Cli.render(Cli.parse(Main.a2("fmt", "--nope"))), Main.wantUnexp())
+  Main.cliDiff(Cli.render(Cli.parse(Main.a1("nope"))), Main.wantUnrec()) && Main.cliDiff(Cli.render(Cli.parse(Main.a2("fmt", "--nope"))), Main.wantUnexp()) && Main.cliDiff(Cli.render(Cli.parse(Main.a3("fuzz", "--iterations", "abc"))), Main.wantBadIter()) && Main.cliDiff(Cli.render(Cli.parse(Main.a3("check", "examples/hello", "examples/cli"))), Main.wantExtra()) && Main.cliDiff(Cli.render(Cli.parse(Main.a4("fuzz", "--relate", "--iterations", "8"))), Main.wantRelate()) && Main.cliDiff(Cli.render(Cli.parse(Main.a2("new", "123app"))), Main.wantBadName()) && Main.pkgParseOk()
 
 def cliJsonOnly(): Bool =
   Main.cliDiff(Cli.render(Cli.parse(Main.a2("--message-format=json", "fmt"))), Main.wantJsonOnly())
 
 def cliFuzz(): Bool =
-  Main.cliDiff(Cli.show(Cli.parse(Main.a3("fuzz", "--iterations", "16"))), "fuzz path=. iterations=16 seed=42 replay= oracles=false noFailFast=false minimize=false relate=false")
+  Main.cliDiff(Cli.show(Cli.parse(Main.a3("fuzz", "--iterations", "16"))), "fuzz path=. iterations=16 seed=42 replay= oracles=false noFailFast=false relate=false") && Cli.showFlagNat("16") == "16" && Cli.showFlagNat("abc") == "fail" && Cli.showFlagNat("-1") == "fail" && Cli.showFlagInt("-7") == "-7" && Cli.showFlagInt("nope") == "fail" && Cli.resolveIdeDir("/opt/ide", "/home/ide", "examples/editor") == "/opt/ide" && Cli.resolveIdeDir("", "/home/ide", "examples/editor") == "/home/ide" && Cli.resolveIdeDir("", "", "examples/editor") == "examples/editor" && Cli.resolveIdeDir("", "", "") == ""
 
 def cliFmtSrc(): Bool =
   Main.cliDiff(Cli.fmtSrc(Main.srcHi()), Main.wantHi())
@@ -32,7 +32,7 @@ def cliIdemFmt(): Bool =
   Main.cliIdem(Main.a1("fmt"))
 
 def drvHello(): Bool =
-  Drive.showMan(Manifest.parse(Main.tomlHello())) == "name=hello ver=0.1.0 ui=false deps=0" && Drive.bundleIdOf(Main.tomlHello()) == "dev.scuzz.app" && Drive.bundleIdOf(Main.tomlBundle()) == "dev.scuzz.hello" && Drive.showMan(Manifest.parse(Main.tomlEmptyBundle())) == Str.concat("err:", Main.wantEmptyBundle())
+  Drive.showMan(Manifest.parse(Main.tomlHello())) == Main.wantHelloMan() && Drive.bundleIdOf(Main.tomlHello()) == "dev.scuzz.app" && Drive.bundleIdOf(Main.tomlBundle()) == "dev.scuzz.hello" && Drive.showMan(Manifest.parse(Main.tomlEmptyBundle())) == Str.concat("err:", Main.wantEmptyBundle()) && Main.manUiOk()
 
 def drvPlugins(): Bool =
   Drive.showMan(Manifest.parse(Main.tomlPlugins())) == Str.concat("err:", Main.wantPlugins())
@@ -71,7 +71,7 @@ def campWrap(): Bool =
   Verify.wrapSrc("bump", Main.srcBumpVerify()) == Main.wantWrapBump()
 
 def campFuzz0(): Bool =
-  Verify.fuzzOut(0, 42, 0, 0, 0, 0) == Main.wantFuzzHello0()
+  Main.campReproOk()
 
 def campEvents(): Bool =
   Verify.nls(Verify.parseEvents(Main.srcBumpRepro())) == Main.wantBumpEvents()
@@ -80,13 +80,13 @@ def campTest(): Bool =
   Cli.runCmd(Cli.parse(Main.a1("test")), Main.srcIrHi()) == Main.wantTestOk()
 
 def campEmpty(): Bool =
-  Verify.checkVerify("", "bad-intent/empty.scuzz_verify") == Main.wantEmptyVerify()
+  Verify.checkVerify("", "bad-intent/empty.scuzz_verify") == Main.wantEmptyVerify() && Verify.checkVerify(Main.srcBadDrive(), "bad.scuzz_verify") == Main.wantBadDrive() && Verify.checkVerify(Main.srcOpaqueDrive(), "bad.scuzz_verify") == Main.wantOpaqueDrive() && Verify.checkVerify("nope", "junk.scuzz_verify") != Main.wantEmptyVerify() && Verify.intentMsg("nested/stale.scuzz_intent") == "nested/stale.scuzz_intent:1:1: error: leftover *.scuzz_intent; rename to *.scuzz_verify or delete the file"
 
 def drvPkg(): Bool =
-  Drive.showPkg(Drive.compilePkg(Main.tomlHello(), Main.srcIrHi(), "build", "clang", "crates/runtime/build/libscuzz_rt.a")) == Main.wantPkg()
+  Drive.showPkg(Drive.compilePkg(Main.tomlHello(), Main.srcIrHi(), "build", "clang", "crates/runtime/build/libscuzz_rt.a")) == Main.wantPkg() && Main.pkgEnvOk() && Main.pkgIdOk() && Main.pkgAndroidCmdOk()
 
 def drvFiles(): Bool =
-  Drive.showPkg(Drive.compileFiles(Main.tomlHello(), ("Main", Main.srcIrHi()) :: Manifest.noPairs(), "build", "clang", "crates/runtime/build/libscuzz_rt.a")) == Main.wantPkg()
+  Drive.showPkg(Drive.compileFiles(Main.tomlHello(), ("Main", Main.srcIrHi()) :: Manifest.noPairs(), "build", "clang", "crates/runtime/build/libscuzz_rt.a")) == Main.wantPkg() && !Drive.compileFiles(Main.tomlHello(), ("Main", Main.srcTyUnbound()) :: Manifest.noPairs(), "build", "clang", "crates/runtime/build/libscuzz_rt.a").ok && Mutate.sitesOk()
 
 def lspDef(): Bool =
   Main.lspOk()
diff --git a/examples/cli/src/Cli.scuzz b/examples/cli/src/Cli.scuzz
index 24372f75..d806d648 100644
--- a/examples/cli/src/Cli.scuzz
+++ b/examples/cli/src/Cli.scuzz
@@ -9,7 +9,7 @@ enum Cmd:
   case Watch(path: String, outDir: String)
   case Test(path: String, update: Bool, pixels: Bool, differential: Bool)
   case Lsp(path: String)
-  case Fuzz(path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, minimize: Bool, relate: Bool)
+  case Fuzz(path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool)
   case New(name: String, path: String, ui: Bool)
   case Ide(path: String, outDir: String, headless: Bool)
   case Package(path: String, outDir: String, target: String)
@@ -88,6 +88,99 @@ For more information, try '--help'.
 def missCmd(): String =
   Help.helpRoot()
 
+def extraArg(a: String, usage: String): String =
+  Str.concat("error: unexpected argument '", Str.concat(a, Str.concat("""' found
+
+Usage: """, Str.concat(usage, """
+
+For more information, try '--help'.
+"""))))
+
+def badInt(name: String, v: String): String =
+  Str.concat("error: invalid value '", Str.concat(v, Str.concat("' for '", Str.concat(name, """'
+
+For more information, try '--help'.
+"""))))
+
+def relateOnly(): String =
+  """error: --relate does not accept --iterations, --seed, --replay, --oracles, or --no-fail-fast
+
+Usage: scuzz fuzz [OPTIONS] [PATH]
+
+For more information, try '--help'.
+"""
+
+def badName(name: String): String =
+  Str.concat("error: invalid project name '", Str.concat(name, """'; use [A-Za-z_][A-Za-z0-9_-]*
+
+For more information, try '--help'.
+"""))
+
+def missIde(): String =
+  "scuzz ide: editor package not found (set SCUZZ_IDE, or SCUZZ_HOME/ide, or run from a checkout with examples/editor)"
+
+def existNew(dir: String): String =
+  Str.concat("scuzz new: ", Str.concat(Drive.joinSlash(dir, "scuzz.toml"), " already exists"))
+
+def orDot(path: String): String =
+  if (path == "") "." else path
+
+def isDigits(s: String): Bool =
+  s != "" && Manifest.allDigits(s, 0)
+
+def parseFlagNat(s: String): (Bool, Int) =
+  if (!isDigits(s)) (false, 0) else parseFlagNatGot(s, Str.toInt(s, 0))
+
+def parseFlagNatGot(s: String, n: Int): (Bool, Int) =
+  if (Str.fromInt(n) != s) (false, 0) else (true, n)
+
+def parseFlagInt(s: String): (Bool, Int) =
+  if (s == "") (false, 0) else if (Str.charAt(s, 0) == 45) parseFlagNeg(s) else parseFlagNat(s)
+
+def parseFlagNeg(s: String): (Bool, Int) =
+  if (Str.len(s) < 2) (false, 0) else parseFlagNegRest(s, Str.slice(s, 1, Str.len(s)))
+
+def parseFlagNegRest(s: String, rest: String): (Bool, Int) =
+  if (!isDigits(rest)) (false, 0) else parseFlagNegGot(s, Str.toInt(s, 0))
+
+def parseFlagNegGot(s: String, n: Int): (Bool, Int) =
+  if (Str.fromInt(n) != s) (false, 0) else (true, n)
+
+def showFlagNat(s: String): String =
+  showFlagGot(parseFlagNat(s))
+
+def showFlagInt(s: String): String =
+  showFlagGot(parseFlagInt(s))
+
+def showFlagGot(p: (Bool, Int)): String =
+  p match {
+    case (ok, n) => if (!ok) "fail" else Str.fromInt(n)
+  }
+
+def resolveIdeDir(ideEnv: String, homeIde: String, checkout: String): String =
+  if (ideEnv != "") ideEnv else if (homeIde != "") homeIde else checkout
+
+def runExtra(path: String): String =
+  Str.concat(" ", Drive.shQuote(orDot(path)))
+
+def okPkgName(s: String): Bool =
+  s != "" && okNameStart(Str.charAt(s, 0)) && okNameRest(s, 1)
+
+def okNameStart(c: Int): Bool =
+  c >= 65 && c <= 90 || c >= 97 && c <= 122 || c == 95
+
+def okNameRest(s: String, i: Int): Bool =
+  if (i >= Str.len(s)) true else okNameChar(Str.charAt(s, i)) && okNameRest(s, i + 1)
+
+def okNameChar(c: Int): Bool =
+  okNameStart(c) || c >= 48 && c <= 57 || c == 45
+
+def fuzzHasCamp(args: List[String], i: Int): Bool =
+  if (i >= List.len(args)) false else fuzzCampTok(arg(args, i)) || fuzzHasCamp(args, i + 1)
+
+def fuzzCampTok(a: String): Bool =
+  a == "--oracles" || a == "--no-fail-fast" || a == "--iterations" || flagPref(a, "--iterations") || a == "--seed" || flagPref(a, "--seed") || a == "--replay" || flagPref(a, "--replay")
+
 def flagPref(a: String, name: String): Bool =
   Str.startsWith(a, Str.concat(name, "="))
 
@@ -115,7 +208,7 @@ def show(c: Cmd): String =
     case Cmd.Watch(path, outDir) => Str.concat("watch path=", Str.concat(path, Str.concat(" out=", outDir)))
     case Cmd.Test(path, update, pixels, differential) => Str.concat("test path=", Str.concat(path, Str.concat(" update=", Str.concat(yn(update), Str.concat(" pixels=", Str.concat(yn(pixels), Str.concat(" differential=", yn(differential))))))))
     case Cmd.Lsp(path) => Str.concat("lsp path=", path)
-    case Cmd.Fuzz(path, iterations, seed, replay, oracles, noFailFast, minimize, relate) => Str.concat("fuzz path=", Str.concat(path, Str.concat(" iterations=", Str.concat(Str.fromInt(iterations), Str.concat(" seed=", Str.concat(Str.fromInt(seed), Str.concat(" replay=", Str.concat(replay, Str.concat(" oracles=", Str.concat(yn(oracles), Str.concat(" noFailFast=", Str.concat(yn(noFailFast), Str.concat(" minimize=", Str.concat(yn(minimize), Str.concat(" relate=", yn(relate))))))))))))))))
+    case Cmd.Fuzz(path, iterations, seed, replay, oracles, noFailFast, relate) => Str.concat("fuzz path=", Str.concat(path, Str.concat(" iterations=", Str.concat(Str.fromInt(iterations), Str.concat(" seed=", Str.concat(Str.fromInt(seed), Str.concat(" replay=", Str.concat(replay, Str.concat(" oracles=", Str.concat(yn(oracles), Str.concat(" noFailFast=", Str.concat(yn(noFailFast), Str.concat(" relate=", yn(relate))))))))))))))
     case Cmd.New(name, path, ui) => Str.concat("new name=", Str.concat(name, Str.concat(" path=", Str.concat(path, Str.concat(" ui=", yn(ui))))))
     case Cmd.Ide(path, outDir, headless) => Str.concat("ide path=", Str.concat(path, Str.concat(" out=", Str.concat(outDir, Str.concat(" headless=", yn(headless))))))
     case Cmd.Package(path, outDir, target) => Str.concat("package path=", Str.concat(path, Str.concat(" out=", Str.concat(outDir, Str.concat(" target=", target)))))
@@ -162,13 +255,13 @@ def parseHelp(args: List[String], i: Int, json: Bool): Cmd =
   if (i >= List.len(args)) gateJson(Cmd.Help(""), json) else if (isCmd(arg(args, i)) || arg(args, i) == "") gateJson(Cmd.Help(arg(args, i)), json) else gateJson(Cmd.Fail(unrec(arg(args, i))), json)
 
 def parseCmd(args: List[String], cmd: String, i: Int, json: Bool): Cmd =
-  if (cmd == "fmt") parseFmt(args, i, json, ".", false) else if (cmd == "check") parseCheck(args, i, json, ".") else if (cmd == "build") parseBuild(args, i, json, ".", "build", false, false) else if (cmd == "run") parseRun(args, i, json, ".", "build", false, false, "", "") else if (cmd == "watch") parseWatch(args, i, json, ".", "build") else if (cmd == "test") parseTest(args, i, json, ".", false, false, false) else if (cmd == "lsp") parseLsp(args, i, json, ".") else if (cmd == "fuzz") parseFuzz(args, i, json, ".", 32, 42, "", false, false, false, false) else if (cmd == "new") parseNew(args, i, json, "", ".", false) else if (cmd == "ide") parseIde(args, i, json, ".", "build", false) else parsePkg(args, i, json, ".", "build", "host")
+  if (cmd == "fmt") parseFmt(args, i, json, "", false) else if (cmd == "check") parseCheck(args, i, json, "") else if (cmd == "build") parseBuild(args, i, json, "", "build", false, false) else if (cmd == "run") parseRun(args, i, json, "", "build", false, false, "", "") else if (cmd == "watch") parseWatch(args, i, json, "", "build") else if (cmd == "test") parseTest(args, i, json, "", false, false, false) else if (cmd == "lsp") parseLsp(args, i, json, "") else if (cmd == "fuzz") parseFuzz(args, i, json, "", 32, 42, "", false, false, false) else if (cmd == "new") parseNew(args, i, json, "", ".", false) else if (cmd == "ide") parseIde(args, i, json, "", "build", false) else parsePkg(args, i, json, "", "build", "host")
 
 def parseFmt(args: List[String], i: Int, json: Bool, path: String, check: Bool): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Fmt(path, check), json) else parseFmtTok(args, i, json, path, check, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Fmt(orDot(path), check), json) else parseFmtTok(args, i, json, path, check, arg(args, i))
 
 def parseFmtTok(args: List[String], i: Int, json: Bool, path: String, check: Bool, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("fmt"), json) else if (a == "--check") parseFmt(args, i + 1, json, path, true) else if (a == "--message-format" || flagPref(a, "--message-format")) parseFmtMsg(takeVal(args, i, "--message-format"), args, path, check) else if (a == "--") parseFmtPos(args, i + 1, json, path, check) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz fmt [OPTIONS] [PATH]")) else parseFmt(args, i + 1, json, a, check)
+  if (isHelp(a)) gateJson(Cmd.Help("fmt"), json) else if (a == "--check") parseFmt(args, i + 1, json, path, true) else if (a == "--message-format" || flagPref(a, "--message-format")) parseFmtMsg(takeVal(args, i, "--message-format"), args, path, check) else if (a == "--") parseFmtPos(args, i + 1, json, path, check) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz fmt [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz fmt [OPTIONS] [PATH]")) else parseFmt(args, i + 1, json, a, check)
 
 def parseFmtMsg(p: (String, Int), args: List[String], path: String, check: Bool): Cmd =
   p match {
@@ -176,13 +269,13 @@ def parseFmtMsg(p: (String, Int), args: List[String], path: String, check: Bool)
   }
 
 def parseFmtPos(args: List[String], i: Int, json: Bool, path: String, check: Bool): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Fmt(path, check), json) else parseFmt(args, i + 1, json, arg(args, i), check)
+  if (i >= List.len(args)) gateJson(Cmd.Fmt(orDot(path), check), json) else if (path != "") Cmd.Fail(extraArg(arg(args, i), "scuzz fmt [OPTIONS] [PATH]")) else parseFmt(args, i + 1, json, arg(args, i), check)
 
 def parseCheck(args: List[String], i: Int, json: Bool, path: String): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Check(path, json), json) else parseCheckTok(args, i, json, path, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Check(orDot(path), json), json) else parseCheckTok(args, i, json, path, arg(args, i))
 
 def parseCheckTok(args: List[String], i: Int, json: Bool, path: String, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("check"), json) else if (a == "--message-format" || flagPref(a, "--message-format")) parseCheckMsg(takeVal(args, i, "--message-format"), args, path) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz check [OPTIONS] [PATH]")) else parseCheck(args, i + 1, json, a)
+  if (isHelp(a)) gateJson(Cmd.Help("check"), json) else if (a == "--message-format" || flagPref(a, "--message-format")) parseCheckMsg(takeVal(args, i, "--message-format"), args, path) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz check [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz check [OPTIONS] [PATH]")) else parseCheck(args, i + 1, json, a)
 
 def parseCheckMsg(p: (String, Int), args: List[String], path: String): Cmd =
   p match {
@@ -190,10 +283,10 @@ def parseCheckMsg(p: (String, Int), args: List[String], path: String): Cmd =
   }
 
 def parseBuild(args: List[String], i: Int, json: Bool, path: String, outDir: String, full: Bool, verify: Bool): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Build(path, outDir, full, verify), json) else parseBuildTok(args, i, json, path, outDir, full, verify, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Build(orDot(path), outDir, full, verify), json) else parseBuildTok(args, i, json, path, outDir, full, verify, arg(args, i))
 
 def parseBuildTok(args: List[String], i: Int, json: Bool, path: String, outDir: String, full: Bool, verify: Bool, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("build"), json) else if (a == "--full") parseBuild(args, i + 1, json, path, outDir, true, verify) else if (a == "--verify") parseBuild(args, i + 1, json, path, outDir, full, true) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parseBuildOut(takeVal(args, i, "--out-dir"), args, json, path, full, verify) else if (a == "--message-format" || flagPref(a, "--message-format")) parseBuildMsg(takeVal(args, i, "--message-format"), args, path, outDir, full, verify) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz build [OPTIONS] [PATH]")) else parseBuild(args, i + 1, json, a, outDir, full, verify)
+  if (isHelp(a)) gateJson(Cmd.Help("build"), json) else if (a == "--full") parseBuild(args, i + 1, json, path, outDir, true, verify) else if (a == "--verify") parseBuild(args, i + 1, json, path, outDir, full, true) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parseBuildOut(takeVal(args, i, "--out-dir"), args, json, path, full, verify) else if (a == "--message-format" || flagPref(a, "--message-format")) parseBuildMsg(takeVal(args, i, "--message-format"), args, path, outDir, full, verify) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz build [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz build [OPTIONS] [PATH]")) else parseBuild(args, i + 1, json, a, outDir, full, verify)
 
 def parseBuildOut(p: (String, Int), args: List[String], json: Bool, path: String, full: Bool, verify: Bool): Cmd =
   p match {
@@ -206,10 +299,10 @@ def parseBuildMsg(p: (String, Int), args: List[String], path: String, outDir: St
   }
 
 def parseRun(args: List[String], i: Int, json: Bool, path: String, outDir: String, headless: Bool, watch: Bool, script: String, dump: String): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Run(path, outDir, headless, watch, script, dump), json) else parseRunTok(args, i, json, path, outDir, headless, watch, script, dump, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Run(orDot(path), outDir, headless, watch, script, dump), json) else parseRunTok(args, i, json, path, outDir, headless, watch, script, dump, arg(args, i))
 
 def parseRunTok(args: List[String], i: Int, json: Bool, path: String, outDir: String, headless: Bool, watch: Bool, script: String, dump: String, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("run"), json) else if (a == "--headless") parseRun(args, i + 1, json, path, outDir, true, watch, script, dump) else if (a == "--watch") parseRun(args, i + 1, json, path, outDir, headless, true, script, dump) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parseRunOut(takeVal(args, i, "--out-dir"), args, json, path, headless, watch, script, dump) else if (a == "--script" || flagPref(a, "--script")) parseRunScript(takeVal(args, i, "--script"), args, json, path, outDir, headless, watch, dump) else if (a == "--dump" || flagPref(a, "--dump")) parseRunDump(takeVal(args, i, "--dump"), args, json, path, outDir, headless, watch, script) else if (a == "--message-format" || flagPref(a, "--message-format")) parseRunMsg(takeVal(args, i, "--message-format"), args, path, outDir, headless, watch, script, dump) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz run [OPTIONS] [PATH]")) else parseRun(args, i + 1, json, a, outDir, headless, watch, script, dump)
+  if (isHelp(a)) gateJson(Cmd.Help("run"), json) else if (a == "--headless") parseRun(args, i + 1, json, path, outDir, true, watch, script, dump) else if (a == "--watch") parseRun(args, i + 1, json, path, outDir, headless, true, script, dump) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parseRunOut(takeVal(args, i, "--out-dir"), args, json, path, headless, watch, script, dump) else if (a == "--script" || flagPref(a, "--script")) parseRunScript(takeVal(args, i, "--script"), args, json, path, outDir, headless, watch, dump) else if (a == "--dump" || flagPref(a, "--dump")) parseRunDump(takeVal(args, i, "--dump"), args, json, path, outDir, headless, watch, script) else if (a == "--message-format" || flagPref(a, "--message-format")) parseRunMsg(takeVal(args, i, "--message-format"), args, path, outDir, headless, watch, script, dump) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz run [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz run [OPTIONS] [PATH]")) else parseRun(args, i + 1, json, a, outDir, headless, watch, script, dump)
 
 def parseRunOut(p: (String, Int), args: List[String], json: Bool, path: String, headless: Bool, watch: Bool, script: String, dump: String): Cmd =
   p match {
@@ -232,10 +325,10 @@ def parseRunMsg(p: (String, Int), args: List[String], path: String, outDir: Stri
   }
 
 def parseWatch(args: List[String], i: Int, json: Bool, path: String, outDir: String): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Watch(path, outDir), json) else parseWatchTok(args, i, json, path, outDir, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Watch(orDot(path), outDir), json) else parseWatchTok(args, i, json, path, outDir, arg(args, i))
 
 def parseWatchTok(args: List[String], i: Int, json: Bool, path: String, outDir: String, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("watch"), json) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parseWatchOut(takeVal(args, i, "--out-dir"), args, json, path) else if (a == "--message-format" || flagPref(a, "--message-format")) parseWatchMsg(takeVal(args, i, "--message-format"), args, path, outDir) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz watch [OPTIONS] [PATH]")) else parseWatch(args, i + 1, json, a, outDir)
+  if (isHelp(a)) gateJson(Cmd.Help("watch"), json) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parseWatchOut(takeVal(args, i, "--out-dir"), args, json, path) else if (a == "--message-format" || flagPref(a, "--message-format")) parseWatchMsg(takeVal(args, i, "--message-format"), args, path, outDir) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz watch [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz watch [OPTIONS] [PATH]")) else parseWatch(args, i + 1, json, a, outDir)
 
 def parseWatchOut(p: (String, Int), args: List[String], json: Bool, path: String): Cmd =
   p match {
@@ -248,10 +341,10 @@ def parseWatchMsg(p: (String, Int), args: List[String], path: String, outDir: St
   }
 
 def parseTest(args: List[String], i: Int, json: Bool, path: String, update: Bool, pixels: Bool, differential: Bool): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Test(path, update, pixels, differential), json) else parseTestTok(args, i, json, path, update, pixels, differential, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Test(orDot(path), update, pixels, differential), json) else parseTestTok(args, i, json, path, update, pixels, differential, arg(args, i))
 
 def parseTestTok(args: List[String], i: Int, json: Bool, path: String, update: Bool, pixels: Bool, differential: Bool, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("test"), json) else if (a == "--update") parseTest(args, i + 1, json, path, true, pixels, differential) else if (a == "--pixels") parseTest(args, i + 1, json, path, update, true, differential) else if (a == "--differential") parseTest(args, i + 1, json, path, update, pixels, true) else if (a == "--message-format" || flagPref(a, "--message-format")) parseTestMsg(takeVal(args, i, "--message-format"), args, path, update, pixels, differential) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz test [OPTIONS] [PATH]")) else parseTest(args, i + 1, json, a, update, pixels, differential)
+  if (isHelp(a)) gateJson(Cmd.Help("test"), json) else if (a == "--update") parseTest(args, i + 1, json, path, true, pixels, differential) else if (a == "--pixels") parseTest(args, i + 1, json, path, update, true, differential) else if (a == "--differential") parseTest(args, i + 1, json, path, update, pixels, true) else if (a == "--message-format" || flagPref(a, "--message-format")) parseTestMsg(takeVal(args, i, "--message-format"), args, path, update, pixels, differential) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz test [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz test [OPTIONS] [PATH]")) else parseTest(args, i + 1, json, a, update, pixels, differential)
 
 def parseTestMsg(p: (String, Int), args: List[String], path: String, update: Bool, pixels: Bool, differential: Bool): Cmd =
   p match {
@@ -259,47 +352,58 @@ def parseTestMsg(p: (String, Int), args: List[String], path: String, update: Boo
   }
 
 def parseLsp(args: List[String], i: Int, json: Bool, path: String): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Lsp(path), json) else parseLspTok(args, i, json, path, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Lsp(orDot(path)), json) else parseLspTok(args, i, json, path, arg(args, i))
 
 def parseLspTok(args: List[String], i: Int, json: Bool, path: String, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("lsp"), json) else if (a == "--message-format" || flagPref(a, "--message-format")) parseLspMsg(takeVal(args, i, "--message-format"), args, path) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz lsp [OPTIONS] [PATH]")) else parseLsp(args, i + 1, json, a)
+  if (isHelp(a)) gateJson(Cmd.Help("lsp"), json) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz lsp [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz lsp [OPTIONS] [PATH]")) else parseLsp(args, i + 1, json, a)
+
+def parseFuzz(args: List[String], i: Int, json: Bool, path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool): Cmd =
+  if (i >= List.len(args)) fuzzDone(args, json, path, iterations, seed, replay, oracles, noFailFast, relate) else parseFuzzTok(args, i, json, path, iterations, seed, replay, oracles, noFailFast, relate, arg(args, i))
+
+def fuzzDone(args: List[String], json: Bool, path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool): Cmd =
+  if (relate && fuzzHasCamp(args, 0)) Cmd.Fail(relateOnly()) else gateJson(Cmd.Fuzz(orDot(path), iterations, seed, replay, oracles, noFailFast, relate), json)
+
+def parseFuzzTok(args: List[String], i: Int, json: Bool, path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool, a: String): Cmd =
+  if (isHelp(a)) gateJson(Cmd.Help("fuzz"), json) else if (a == "--oracles") parseFuzz(args, i + 1, json, path, iterations, seed, replay, true, noFailFast, relate) else if (a == "--no-fail-fast") parseFuzz(args, i + 1, json, path, iterations, seed, replay, oracles, true, relate) else if (a == "--relate") parseFuzz(args, i + 1, json, path, iterations, seed, replay, oracles, noFailFast, true) else if (a == "--iterations" || flagPref(a, "--iterations")) parseFuzzIter(takeVal(args, i, "--iterations"), args, json, path, seed, replay, oracles, noFailFast, relate) else if (a == "--seed" || flagPref(a, "--seed")) parseFuzzSeed(takeVal(args, i, "--seed"), args, json, path, iterations, replay, oracles, noFailFast, relate) else if (a == "--replay" || flagPref(a, "--replay")) parseFuzzReplay(takeVal(args, i, "--replay"), args, json, path, iterations, seed, oracles, noFailFast, relate) else if (a == "--message-format" || flagPref(a, "--message-format")) parseFuzzMsg(takeVal(args, i, "--message-format"), args, path, iterations, seed, replay, oracles, noFailFast, relate) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz fuzz [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz fuzz [OPTIONS] [PATH]")) else parseFuzz(args, i + 1, json, a, iterations, seed, replay, oracles, noFailFast, relate)
 
-def parseLspMsg(p: (String, Int), args: List[String], path: String): Cmd =
+def parseFuzzIter(p: (String, Int), args: List[String], json: Bool, path: String, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool): Cmd =
   p match {
-    case (v, n) => if (n < 0) Cmd.Fail(needVal("--message-format")) else if (v == "json") parseLsp(args, n, true, path) else if (v == "human") parseLsp(args, n, false, path) else Cmd.Fail(badFmt(v))
+    case (v, n) => if (n < 0) Cmd.Fail(needVal("--iterations")) else parseFuzzIterGot(parseFlagNat(v), v, n, args, json, path, seed, replay, oracles, noFailFast, relate)
   }
 
-def parseFuzz(args: List[String], i: Int, json: Bool, path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, minimize: Bool, relate: Bool): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Fuzz(path, iterations, seed, replay, oracles, noFailFast, minimize, relate), json) else parseFuzzTok(args, i, json, path, iterations, seed, replay, oracles, noFailFast, minimize, relate, arg(args, i))
-
-def parseFuzzTok(args: List[String], i: Int, json: Bool, path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, minimize: Bool, relate: Bool, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("fuzz"), json) else if (a == "--oracles") parseFuzz(args, i + 1, json, path, iterations, seed, replay, true, noFailFast, minimize, relate) else if (a == "--no-fail-fast") parseFuzz(args, i + 1, json, path, iterations, seed, replay, oracles, true, minimize, relate) else if (a == "--minimize-corpus") parseFuzz(args, i + 1, json, path, iterations, seed, replay, oracles, noFailFast, true, relate) else if (a == "--relate") parseFuzz(args, i + 1, json, path, iterations, seed, replay, oracles, noFailFast, minimize, true) else if (a == "--iterations" || flagPref(a, "--iterations")) parseFuzzIter(takeVal(args, i, "--iterations"), args, json, path, seed, replay, oracles, noFailFast, minimize, relate) else if (a == "--seed" || flagPref(a, "--seed")) parseFuzzSeed(takeVal(args, i, "--seed"), args, json, path, iterations, replay, oracles, noFailFast, minimize, relate) else if (a == "--replay" || flagPref(a, "--replay")) parseFuzzReplay(takeVal(args, i, "--replay"), args, json, path, iterations, seed, oracles, noFailFast, minimize, relate) else if (a == "--message-format" || flagPref(a, "--message-format")) parseFuzzMsg(takeVal(args, i, "--message-format"), args, path, iterations, seed, replay, oracles, noFailFast, minimize, relate) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz fuzz [OPTIONS] [PATH]")) else parseFuzz(args, i + 1, json, a, iterations, seed, replay, oracles, noFailFast, minimize, relate)
+def parseFuzzIterGot(p: (Bool, Int), v: String, n: Int, args: List[String], json: Bool, path: String, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool): Cmd =
+  p match {
+    case (ok, it) => if (!ok) Cmd.Fail(badInt("--iterations", v)) else parseFuzz(args, n, json, path, it, seed, replay, oracles, noFailFast, relate)
+  }
 
-def parseFuzzIter(p: (String, Int), args: List[String], json: Bool, path: String, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, minimize: Bool, relate: Bool): Cmd =
+def parseFuzzSeed(p: (String, Int), args: List[String], json: Bool, path: String, iterations: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool): Cmd =
   p match {
-    case (v, n) => if (n < 0) Cmd.Fail(needVal("--iterations")) else parseFuzz(args, n, json, path, Str.toInt(v, 32), seed, replay, oracles, noFailFast, minimize, relate)
+    case (v, n) => if (n < 0) Cmd.Fail(needVal("--seed")) else parseFuzzSeedGot(parseFlagInt(v), v, n, args, json, path, iterations, replay, oracles, noFailFast, relate)
   }
 
-def parseFuzzSeed(p: (String, Int), args: List[String], json: Bool, path: String, iterations: Int, replay: String, oracles: Bool, noFailFast: Bool, minimize: Bool, relate: Bool): Cmd =
+def parseFuzzSeedGot(p: (Bool, Int), v: String, n: Int, args: List[String], json: Bool, path: String, iterations: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool): Cmd =
   p match {
-    case (v, n) => if (n < 0) Cmd.Fail(needVal("--seed")) else parseFuzz(args, n, json, path, iterations, Str.toInt(v, 42), replay, oracles, noFailFast, minimize, relate)
+    case (ok, seed) => if (!ok) Cmd.Fail(badInt("--seed", v)) else parseFuzz(args, n, json, path, iterations, seed, replay, oracles, noFailFast, relate)
   }
 
-def parseFuzzReplay(p: (String, Int), args: List[String], json: Bool, path: String, iterations: Int, seed: Int, oracles: Bool, noFailFast: Bool, minimize: Bool, relate: Bool): Cmd =
+def parseFuzzReplay(p: (String, Int), args: List[String], json: Bool, path: String, iterations: Int, seed: Int, oracles: Bool, noFailFast: Bool, relate: Bool): Cmd =
   p match {
-    case (v, n) => if (n < 0) Cmd.Fail(needVal("--replay")) else parseFuzz(args, n, json, path, iterations, seed, v, oracles, noFailFast, minimize, relate)
+    case (v, n) => if (n < 0) Cmd.Fail(needVal("--replay")) else parseFuzz(args, n, json, path, iterations, seed, v, oracles, noFailFast, relate)
   }
 
-def parseFuzzMsg(p: (String, Int), args: List[String], path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, minimize: Bool, relate: Bool): Cmd =
+def parseFuzzMsg(p: (String, Int), args: List[String], path: String, iterations: Int, seed: Int, replay: String, oracles: Bool, noFailFast: Bool, relate: Bool): Cmd =
   p match {
-    case (v, n) => if (n < 0) Cmd.Fail(needVal("--message-format")) else if (v == "json") parseFuzz(args, n, true, path, iterations, seed, replay, oracles, noFailFast, minimize, relate) else if (v == "human") parseFuzz(args, n, false, path, iterations, seed, replay, oracles, noFailFast, minimize, relate) else Cmd.Fail(badFmt(v))
+    case (v, n) => if (n < 0) Cmd.Fail(needVal("--message-format")) else if (v == "json") parseFuzz(args, n, true, path, iterations, seed, replay, oracles, noFailFast, relate) else if (v == "human") parseFuzz(args, n, false, path, iterations, seed, replay, oracles, noFailFast, relate) else Cmd.Fail(badFmt(v))
   }
 
 def parseNew(args: List[String], i: Int, json: Bool, name: String, path: String, ui: Bool): Cmd =
-  if (i >= List.len(args)) if (name == "") Cmd.Fail(missName()) else gateJson(Cmd.New(name, path, ui), json) else parseNewTok(args, i, json, name, path, ui, arg(args, i))
+  if (i >= List.len(args)) newDone(json, name, path, ui) else parseNewTok(args, i, json, name, path, ui, arg(args, i))
+
+def newDone(json: Bool, name: String, path: String, ui: Bool): Cmd =
+  if (name == "") Cmd.Fail(missName()) else if (!okPkgName(name)) Cmd.Fail(badName(name)) else gateJson(Cmd.New(name, path, ui), json)
 
 def parseNewTok(args: List[String], i: Int, json: Bool, name: String, path: String, ui: Bool, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("new"), json) else if (a == "--ui") parseNew(args, i + 1, json, name, path, true) else if (a == "--path" || flagPref(a, "--path")) parseNewPath(takeVal(args, i, "--path"), args, json, name, ui) else if (a == "--message-format" || flagPref(a, "--message-format")) parseNewMsg(takeVal(args, i, "--message-format"), args, name, path, ui) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz new [OPTIONS] <NAME>")) else parseNew(args, i + 1, json, a, path, ui)
+  if (isHelp(a)) gateJson(Cmd.Help("new"), json) else if (a == "--ui") parseNew(args, i + 1, json, name, path, true) else if (a == "--path" || flagPref(a, "--path")) parseNewPath(takeVal(args, i, "--path"), args, json, name, ui) else if (a == "--message-format" || flagPref(a, "--message-format")) parseNewMsg(takeVal(args, i, "--message-format"), args, name, path, ui) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz new [OPTIONS] <NAME>")) else if (name != "") Cmd.Fail(extraArg(a, "scuzz new [OPTIONS] <NAME>")) else parseNew(args, i + 1, json, a, path, ui)
 
 def parseNewPath(p: (String, Int), args: List[String], json: Bool, name: String, ui: Bool): Cmd =
   p match {
@@ -312,10 +416,10 @@ def parseNewMsg(p: (String, Int), args: List[String], name: String, path: String
   }
 
 def parseIde(args: List[String], i: Int, json: Bool, path: String, outDir: String, headless: Bool): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Ide(path, outDir, headless), json) else parseIdeTok(args, i, json, path, outDir, headless, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Ide(orDot(path), outDir, headless), json) else parseIdeTok(args, i, json, path, outDir, headless, arg(args, i))
 
 def parseIdeTok(args: List[String], i: Int, json: Bool, path: String, outDir: String, headless: Bool, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("ide"), json) else if (a == "--headless") parseIde(args, i + 1, json, path, outDir, true) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parseIdeOut(takeVal(args, i, "--out-dir"), args, json, path, headless) else if (a == "--message-format" || flagPref(a, "--message-format")) parseIdeMsg(takeVal(args, i, "--message-format"), args, path, outDir, headless) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz ide [OPTIONS] [PATH]")) else parseIde(args, i + 1, json, a, outDir, headless)
+  if (isHelp(a)) gateJson(Cmd.Help("ide"), json) else if (a == "--headless") parseIde(args, i + 1, json, path, outDir, true) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parseIdeOut(takeVal(args, i, "--out-dir"), args, json, path, headless) else if (a == "--message-format" || flagPref(a, "--message-format")) parseIdeMsg(takeVal(args, i, "--message-format"), args, path, outDir, headless) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz ide [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz ide [OPTIONS] [PATH]")) else parseIde(args, i + 1, json, a, outDir, headless)
 
 def parseIdeOut(p: (String, Int), args: List[String], json: Bool, path: String, headless: Bool): Cmd =
   p match {
@@ -328,16 +432,19 @@ def parseIdeMsg(p: (String, Int), args: List[String], path: String, outDir: Stri
   }
 
 def parsePkg(args: List[String], i: Int, json: Bool, path: String, outDir: String, target: String): Cmd =
-  if (i >= List.len(args)) gateJson(Cmd.Package(path, outDir, target), json) else parsePkgTok(args, i, json, path, outDir, target, arg(args, i))
+  if (i >= List.len(args)) gateJson(Cmd.Package(orDot(path), outDir, target), json) else parsePkgTok(args, i, json, path, outDir, target, arg(args, i))
 
 def parsePkgTok(args: List[String], i: Int, json: Bool, path: String, outDir: String, target: String, a: String): Cmd =
-  if (isHelp(a)) gateJson(Cmd.Help("package"), json) else if (a == "--target" || flagPref(a, "--target")) parsePkgTarget(takeVal(args, i, "--target"), args, json, path, outDir) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parsePkgOut(takeVal(args, i, "--out-dir"), args, json, path, target) else if (a == "--message-format" || flagPref(a, "--message-format")) parsePkgMsg(takeVal(args, i, "--message-format"), args, path, outDir, target) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz package [OPTIONS] [PATH]")) else parsePkg(args, i + 1, json, a, outDir, target)
+  if (isHelp(a)) gateJson(Cmd.Help("package"), json) else if (a == "--target" || flagPref(a, "--target")) parsePkgTarget(takeVal(args, i, "--target"), args, json, path, outDir) else if (a == "--out-dir" || flagPref(a, "--out-dir")) parsePkgOut(takeVal(args, i, "--out-dir"), args, json, path, target) else if (a == "--message-format" || flagPref(a, "--message-format")) parsePkgMsg(takeVal(args, i, "--message-format"), args, path, outDir, target) else if (isFlag(a)) Cmd.Fail(unexp(a, "scuzz package [OPTIONS] [PATH]")) else if (path != "") Cmd.Fail(extraArg(a, "scuzz package [OPTIONS] [PATH]")) else parsePkg(args, i + 1, json, a, outDir, target)
 
 def parsePkgTarget(p: (String, Int), args: List[String], json: Bool, path: String, outDir: String): Cmd =
   p match {
-    case (v, n) => if (n < 0) Cmd.Fail(needVal("--target")) else parsePkg(args, n, json, path, outDir, v)
+    case (v, n) => if (n < 0) Cmd.Fail(needVal("--target")) else parsePkgTargetVal(v, n, args, json, path, outDir)
   }
 
+def parsePkgTargetVal(v: String, n: Int, args: List[String], json: Bool, path: String, outDir: String): Cmd =
+  if (v == "host" || v == "android" || v == "ios" || v == "all") parsePkg(args, n, json, path, outDir, v) else Cmd.Fail(Drive.badTarget(v))
+
 def parsePkgOut(p: (String, Int), args: List[String], json: Bool, path: String, target: String): Cmd =
   p match {
     case (v, n) => if (n < 0) Cmd.Fail(needVal("--out-dir")) else parsePkg(args, n, json, path, v, target)
@@ -356,14 +463,14 @@ def runCmd(c: Cmd, src: String): String =
     case Cmd.Check(_, json) => if (json) Check.check(src) else Check.human(src)
     case Cmd.Fmt(_, _) => fmtSrc(src)
     case Cmd.Test(_, _, _, _) => Verify.testOut(Check.check(src) == "[]")
-    case Cmd.Fuzz(_, it, seed, _, _, _, _, _) => Verify.fuzzOut(it, seed, 0, 0, 0, 0)
+    case Cmd.Fuzz(_, it, seed, _, _, _, _) => Verify.fuzzOut(it, seed, 0, 0, 0, 0)
     case Cmd.Build(_, outDir, _, _) => Drive.showPkg(Drive.compilePkg("[package]\nname = \"hello\"\nversion = \"0.1.0\"\n", src, outDir, "clang", "crates/runtime/build/libscuzz_rt.a"))
     case _ => render(c)
   }
 
 def dispatch(c: Cmd): IO[Unit] =
   c match {
-    case Cmd.Build(path, outDir, full, _) => dispatchBuild(path, outDir, full)
+    case Cmd.Build(path, outDir, full, verify) => dispatchBuild(path, outDir, full, verify)
     case Cmd.Run(path, outDir, headless, watch, script, dump) => dispatchRunCmd(path, outDir, headless, watch, script, dump)
     case Cmd.Watch(path, outDir) => dispatchWatch(path, outDir)
     case Cmd.Check(path, json) => Drive.checkDir(path, json)
@@ -371,12 +478,12 @@ def dispatch(c: Cmd): IO[Unit] =
     case Cmd.Test(path, update, pixels, differential) => dispatchTest(path, update, pixels, differential)
     case Cmd.New(name, path, ui) => dispatchNew(name, path, ui)
     case Cmd.Package(path, outDir, target) => dispatchPkg(path, outDir, target)
-    case Cmd.Fuzz(path, it, seed, replay, oracles, noFailFast, _, relate) => dispatchFuzz(path, it, seed, replay, relate, noFailFast, oracles)
+    case Cmd.Fuzz(path, it, seed, replay, oracles, noFailFast, relate) => dispatchFuzz(path, it, seed, replay, relate, noFailFast, oracles)
     case Cmd.Ide(path, outDir, headless) => dispatchIde(path, outDir, headless)
     case Cmd.Lsp(path) => Lsp.run(path)
     case Cmd.Help(t) => IO.println(helpOf(t))
     case Cmd.Version => IO.println(Version.banner())
-    case Cmd.Fail(m) => IO.println(m)
+    case Cmd.Fail(m) => IO.println(m).flatMap(_ => IO.fail("scuzz"))
   }
 
 def dispatchPkg(path: String, outDir: String, target: String): IO[Unit] =
@@ -388,17 +495,29 @@ def dispatchFuzz(path: String, it: Int, seed: Int, replay: String, relate: Bool,
 def dispatchFuzz2(path: String, it: Int, seed: Int, replay: String, relate: Bool, noFailFast: Bool, oracles: Bool): IO[Unit] =
   if (relate) Drive.fuzzRelate(path, Drive.joinSlash(path, "build")) else Drive.fuzzDir(path, Drive.joinSlash(path, "build"), it, seed, replay, noFailFast, oracles)
 
-def dispatchIde(_path: String, outDir: String, headless: Bool): IO[Unit] =
-  dispatchRun("examples/editor", outDir, headless, "", "")
+def dispatchIde(path: String, outDir: String, headless: Bool): IO[Unit] =
+  Sys.getenv("SCUZZ_IDE").flatMap(ide => Sys.getenv("SCUZZ_HOME").flatMap(home => dispatchIdeEnv(path, outDir, headless, ide, home)))
+
+def dispatchIdeEnv(path: String, outDir: String, headless: Bool, ide: String, home: String): IO[Unit] =
+  homeIdeOf(home).flatMap(homeIde => Fs.exists("examples/editor/scuzz.toml").flatMap(co => dispatchIdeGot(path, outDir, headless, resolveIdeDir(ide, homeIde, if (co != 0) "examples/editor" else ""))))
+
+def homeIdeOf(home: String): IO[String] =
+  if (home == "") IO.pure("") else Fs.exists(Drive.joinSlash(Drive.joinSlash(home, "ide"), "scuzz.toml")).flatMap(hit => IO.pure(if (hit != 0) Drive.joinSlash(home, "ide") else ""))
+
+def dispatchIdeGot(path: String, outDir: String, headless: Bool, ideDir: String): IO[Unit] =
+  if (ideDir == "") IO.println(missIde()).flatMap(_ => IO.fail("scuzz")) else Fs.exists(Drive.joinSlash(ideDir, "scuzz.toml")).flatMap(hit => if (hit != 0) dispatchRun(ideDir, outDir, headless, "", "", runExtra(path)) else IO.println(missIde()).flatMap(_ => IO.fail("scuzz")))
 
-def dispatchBuild(path: String, outDir: String, full: Bool): IO[Unit] =
-  dispatchBuildOut(path, pkgOut(path, outDir), full)
+def dispatchBuild(path: String, outDir: String, full: Bool, verify: Bool): IO[Unit] =
+  dispatchBuildOut(path, pkgOut(path, outDir), full, verify)
 
-def dispatchBuildOut(path: String, out: String, full: Bool): IO[Unit] =
-  Fs.mkdirs(out).flatMap(_ => Drive.emitDir(path, out, full))
+def dispatchBuildOut(path: String, out: String, full: Bool, verify: Bool): IO[Unit] =
+  Fs.mkdirs(out).flatMap(_ => if (verify) dispatchBuildVerify(path, out) else Drive.emitDir(path, out, full))
+
+def dispatchBuildVerify(path: String, out: String): IO[Unit] =
+  Drive.fuzzCollect(path).flatMap(files => Drive.emitDirAlways(path, out, files))
 
 def dispatchRunCmd(path: String, outDir: String, headless: Bool, watch: Bool, script: String, dump: String): IO[Unit] =
-  if (watch && (script != "" || dump != "")) IO.println("scuzz run --watch does not accept --script or --dump. Run without --watch: scuzz run --headless --script PATH --dump PATH") else if (watch) dispatchRunWatch(path, outDir, headless) else dispatchRun(path, outDir, headless, script, dump)
+  if (watch && (script != "" || dump != "")) IO.println("scuzz run --watch does not accept --script or --dump. Run without --watch: scuzz run --headless --script PATH --dump PATH") else if (watch) dispatchRunWatch(path, outDir, headless) else dispatchRun(path, outDir, headless, script, dump, "")
 
 def dispatchWatch(path: String, outDir: String): IO[Unit] =
   IO.println(Str.concat("scuzz watch ", Str.concat(path, " (rebuild on change; not hot reload)"))).flatMap(_ => watchBuild(path, pkgOut(path, outDir)))
@@ -410,7 +529,7 @@ def dispatchRunWatch(path: String, outDir: String, headless: Bool): IO[Unit] =
   Fs.read(Drive.joinSlash(path, "scuzz.toml")).flatMap(toml => dispatchRunWatchMan(path, pkgOut(path, outDir), headless, Manifest.parse(toml)))
 
 def dispatchRunWatchMan(path: String, out: String, headless: Bool, m: Man): IO[Unit] =
-  if (!m.ok) IO.println(m.err) else if (m.hasUi) watchUi(path, out, headless, m.name) else watchIo(path, out, m.name)
+  Drive.manNeed(m).flatMap(_ => if (m.hasUi) watchUi(path, out, headless, m.name) else watchIo(path, out, m.name))
 
 def watchIo(path: String, out: String, name: String): IO[Unit] =
   IO.println(Str.concat("scuzz run --watch ", Str.concat(path, " (rebuild and rerun on source change; kills a still-running process; not hot reload)"))).flatMap(_ => Fs.mkdirs(out).flatMap(_ => Drive.emitDir(path, out, false).flatMap(_ => Drive.linkOnly(false, name, out).flatMap(_ => watchIoLoop(path, out, name)))))
@@ -419,7 +538,13 @@ def watchIoLoop(path: String, out: String, name: String): IO[Unit] =
   Sys.spawn(Drive.exeName(out, name)).flatMap(pid => watchIoPoll(path, out, name, pid))
 
 def watchIoPoll(path: String, out: String, name: String, pid: Int): IO[Unit] =
-  Fs.read(Drive.fpPath(path)).handleErrorWith(_ => IO.pure("")).flatMap(old => IO.sleep(400).flatMap(_ => watchIoTick(path, out, name, pid, old)))
+  Fs.read(Drive.fpPath(path)).handleErrorWith(_ => IO.pure("")).flatMap(old => watchIoDrain(pid).flatMap(_ => watchIoTick(path, out, name, pid, old)))
+
+def watchIoDrain(pid: Int): IO[Unit] =
+  IO.timeout(400, Sys.childRead(pid, 4096)).flatMap(s => Sys.write(s).flatMap(_ => watchIoDrainMore(pid, s))).handleErrorWith(_ => IO.pure(()))
+
+def watchIoDrainMore(pid: Int, s: String): IO[Unit] =
+  if (Str.byteLen(s) < 4096) IO.pure(()) else IO.timeout(50, Sys.childRead(pid, 4096)).flatMap(t => Sys.write(t).flatMap(_ => watchIoDrainMore(pid, t))).handleErrorWith(_ => IO.pure(()))
 
 def watchIoTick(path: String, out: String, name: String, pid: Int, old: String): IO[Unit] =
   Drive.emitDir(path, out, false).flatMap(_ => Fs.read(Drive.fpPath(path)).handleErrorWith(_ => IO.pure("")).flatMap(now => watchIoTick2(path, out, name, pid, old, now)))
@@ -428,7 +553,13 @@ def watchIoTick2(path: String, out: String, name: String, pid: Int, old: String,
   Sys.alive(pid).flatMap(live => watchIoTick3(path, out, name, pid, old, now, live))
 
 def watchIoTick3(path: String, out: String, name: String, pid: Int, old: String, now: String, live: Int): IO[Unit] =
-  if (now != old) Sys.kill(pid).flatMap(_ => Drive.linkOnly(false, name, out).flatMap(_ => watchIoLoop(path, out, name))) else if (live == 0) IO.sleep(60000).flatMap(_ => watchIoLoop(path, out, name)) else watchIoPoll(path, out, name, pid)
+  if (now != old) Sys.kill(pid).flatMap(_ => Drive.linkOnly(false, name, out).flatMap(_ => watchIoLoop(path, out, name))) else if (live == 0) watchIoIdle(path, out, name) else watchIoPoll(path, out, name, pid)
+
+def watchIoIdle(path: String, out: String, name: String): IO[Unit] =
+  Fs.read(Drive.fpPath(path)).handleErrorWith(_ => IO.pure("")).flatMap(old => IO.sleep(400).flatMap(_ => Drive.emitDir(path, out, false).flatMap(_ => Fs.read(Drive.fpPath(path)).handleErrorWith(_ => IO.pure("")).flatMap(now => watchIoIdle2(path, out, name, old, now)))))
+
+def watchIoIdle2(path: String, out: String, name: String, old: String, now: String): IO[Unit] =
+  if (now != old) Drive.linkOnly(false, name, out).flatMap(_ => watchIoLoop(path, out, name)) else watchIoIdle(path, out, name)
 
 def watchUi(path: String, out: String, headless: Bool, name: String): IO[Unit] =
   IO.println(Str.concat("scuzz run --watch ", Str.concat(path, " (hot reload: recompiles build/reload.dylib then stamp-reloads View tree)"))).flatMap(_ => Fs.mkdirs(out).flatMap(_ => Fs.write(Drive.joinSlash(out, "reload.stamp"), """0
@@ -438,13 +569,13 @@ def watchUiBoot(path: String, out: String, headless: Bool, name: String, gen: In
   Drive.emitDir(path, out, false).flatMap(_ => Drive.linkOnly(true, name, out).flatMap(_ => Drive.linkReload(Drive.llName(out, name), out).flatMap(_ => watchUiSpawn(path, out, headless, name, gen))))
 
 def watchUiSpawn(path: String, out: String, headless: Bool, name: String, gen: Int): IO[Unit] =
-  Sys.spawn(Str.concat(watchUiEnv(out, headless), Drive.exeName(out, name))).flatMap(pid => watchUiPoll(path, out, headless, name, gen, pid))
+  Fs.read(Drive.joinSlash(path, "scuzz.toml")).flatMap(toml => Sys.spawn(Str.concat(watchUiEnv(out, headless, toml), Drive.exeName(out, name))).flatMap(pid => watchUiPoll(path, out, headless, name, gen, pid)))
 
-def watchUiEnv(out: String, headless: Bool): String =
-  Str.concat(if (headless) Drive.snapEnv(out) else "", Str.concat("SCUZZ_UI_RELOAD_STAMP=", Str.concat(Drive.joinSlash(out, "reload.stamp"), Str.concat(" SCUZZ_UI_RELOAD_CODE=", Str.concat(Drive.joinSlash(out, "reload.dylib"), Str.concat(" SCUZZ_UI_DEBUG_DUMP=", Str.concat(Drive.joinSlash(out, "debug.dump"), Str.concat(" SCUZZ_UI_INJECT=", Str.concat(Drive.joinSlash(out, "inject.script"), " ")))))))))
+def watchUiEnv(out: String, headless: Bool, toml: String): String =
+  Str.concat(Drive.runEnvOf(out, headless, toml), Str.concat("SCUZZ_UI_RELOAD_STAMP=", Str.concat(Drive.joinSlash(out, "reload.stamp"), Str.concat(" SCUZZ_UI_RELOAD_CODE=", Str.concat(Drive.joinSlash(out, "reload.dylib"), Str.concat(" SCUZZ_UI_DEBUG_DUMP=", Str.concat(Drive.joinSlash(out, "debug.dump"), Str.concat(" SCUZZ_UI_INJECT=", Str.concat(Drive.joinSlash(out, "inject.script"), " ")))))))))
 
 def watchUiPoll(path: String, out: String, headless: Bool, name: String, gen: Int, pid: Int): IO[Unit] =
-  Fs.read(Drive.fpPath(path)).handleErrorWith(_ => IO.pure("")).flatMap(old => IO.sleep(400).flatMap(_ => watchUiTick(path, out, headless, name, gen, pid, old)))
+  Fs.read(Drive.fpPath(path)).handleErrorWith(_ => IO.pure("")).flatMap(old => watchIoDrain(pid).flatMap(_ => watchUiTick(path, out, headless, name, gen, pid, old)))
 
 def watchUiTick(path: String, out: String, headless: Bool, name: String, gen: Int, pid: Int, old: String): IO[Unit] =
   Drive.emitDir(path, out, false).flatMap(_ => Fs.read(Drive.fpPath(path)).handleErrorWith(_ => IO.pure("")).flatMap(now => watchUiTick2(path, out, headless, name, gen, pid, old, now)))
@@ -459,17 +590,23 @@ def watchUiReload(path: String, out: String, headless: Bool, name: String, gen:
   Drive.linkOnly(true, name, out).flatMap(_ => Drive.linkReload(Drive.llName(out, name), out).flatMap(_ => Fs.write(Drive.joinSlash(out, "reload.stamp"), Str.concat(Str.fromInt(gen), """
 """)).flatMap(_ => IO.println(Str.concat("scuzz: view reload stamp ", Str.fromInt(gen))).flatMap(_ => watchUiPoll(path, out, headless, name, gen, pid)))))
 
-def dispatchRun(path: String, outDir: String, headless: Bool, script: String, dump: String): IO[Unit] =
-  dispatchRunOut(path, pkgOut(path, outDir), headless, script, dump)
+def dispatchRun(path: String, outDir: String, headless: Bool, script: String, dump: String, extra: String): IO[Unit] =
+  dispatchRunOut(path, pkgOut(path, outDir), headless, script, dump, extra)
 
 def pkgOut(path: String, outDir: String): String =
   if (Str.startsWith(outDir, "/")) outDir else Drive.joinSlash(path, outDir)
 
-def dispatchRunOut(path: String, out: String, headless: Bool, script: String, dump: String): IO[Unit] =
-  Fs.mkdirs(out).flatMap(_ => Drive.runDir(path, out, runEnv(out, headless, script, dump)))
+def dispatchRunOut(path: String, out: String, headless: Bool, script: String, dump: String, extra: String): IO[Unit] =
+  Fs.mkdirs(out).flatMap(_ => Fs.read(Drive.joinSlash(path, "scuzz.toml")).flatMap(toml => dispatchRunEnv(path, out, runEnvOf(out, headless, script, dump, toml), extra)))
+
+def dispatchRunEnv(path: String, out: String, env: String, extra: String): IO[Unit] =
+  Drive.runDir(path, out, env, extra)
 
-def runEnv(out: String, headless: Bool, script: String, dump: String): String =
-  Str.concat(if (headless) Drive.snapEnv(out) else "", Str.concat(if (script == "") "" else Str.concat("SCUZZ_UI_SCRIPT=", Str.concat(script, " ")), if (dump == "") "" else Str.concat("SCUZZ_FUZZ_DUMP=", Str.concat(dump, " "))))
+def runEnvOf(out: String, headless: Bool, script: String, dump: String, toml: String): String =
+  Str.concat(Drive.runEnvOf(out, headless, toml), Str.concat(runRecordEnv(out, headless, toml), Str.concat(if (script == "") "" else Str.concat("SCUZZ_UI_SCRIPT=", Str.concat(script, " ")), if (dump == "") "" else Str.concat("SCUZZ_FUZZ_DUMP=", Str.concat(dump, " ")))))
+
+def runRecordEnv(out: String, headless: Bool, toml: String): String =
+  if (Drive.uiEnvKind(headless, Manifest.uiRuntime(Manifest.manUi(Manifest.parse(toml)))) == "headless") "" else Str.concat("SCUZZ_UI_RECORD=", Str.concat(Drive.shQuote(Drive.joinSlash(out, "record.script")), Str.concat(" SCUZZ_UI_DEBUG_DUMP=", Str.concat(Drive.shQuote(Drive.joinSlash(out, "debug.dump")), " "))))
 
 def dispatchTest(path: String, update: Bool, pixels: Bool, differential: Bool): IO[Unit] =
   Fs.mkdirs(Drive.joinSlash(path, "build")).flatMap(_ => Drive.testDir(path, Drive.joinSlash(path, "build"), update, pixels, differential))
@@ -492,7 +629,19 @@ def fmtOnePath(check: Bool, path: String, src: String): IO[Int] =
   fmtOneGot(check, path, src, fmtSrc(src))
 
 def fmtOneGot(check: Bool, path: String, src: String, pretty: String): IO[Int] =
-  if (pretty == src) IO.pure(0) else if (check) IO.println(Str.concat("would reformat ", path)).map(_ => 1) else Fs.write(path, pretty).flatMap(_ => IO.println(Str.concat("formatted ", path)).map(_ => 1))
+  if (pretty == src) IO.pure(0) else fmtOneDirty(check, path, pretty)
+
+def fmtOneDirty(check: Bool, path: String, pretty: String): IO[Int] =
+  if (check) fmtOneWould(path) else fmtOneWrite(path, pretty)
+
+def fmtOneWould(path: String): IO[Int] =
+  IO.println(Str.concat("would reformat ", path)).flatMap(_ => IO.pure(1))
+
+def fmtOneWrite(path: String, pretty: String): IO[Int] =
+  Fs.write(path, pretty).flatMap(_ => fmtOneWrote(path))
+
+def fmtOneWrote(path: String): IO[Int] =
+  IO.println(Str.concat("formatted ", path)).flatMap(_ => IO.pure(1))
 
 def fmtDone(check: Bool, dirty: Int): IO[Unit] =
   if (check && dirty > 0) IO.println(Str.concat(Str.fromInt(dirty), " file(s) need formatting")).flatMap(_ => IO.fail("scuzz fmt")) else IO.println("scuzz fmt ok")
@@ -513,7 +662,7 @@ def dispatchNew(name: String, path: String, ui: Bool): IO[Unit] =
   dispatchNewDir(Drive.joinSlash(path, name), name, ui)
 
 def dispatchNewDir(dir: String, name: String, ui: Bool): IO[Unit] =
-  Fs.mkdirs(Drive.joinSlash(dir, "src")).flatMap(_ => writeNew(dir, name, ui))
+  Fs.exists(Drive.joinSlash(dir, "scuzz.toml")).flatMap(hit => if (hit != 0) IO.println(existNew(dir)).flatMap(_ => IO.fail("scuzz")) else Fs.mkdirs(Drive.joinSlash(dir, "src")).flatMap(_ => writeNew(dir, name, ui)))
 
 def writeNew(dir: String, name: String, ui: Bool): IO[Unit] =
   Fs.write(Drive.joinSlash(dir, "scuzz.toml"), if (ui) newTomlUi(name) else newTomlIo(name)).flatMap(_ => writeNewMain(dir, ui))
diff --git a/examples/cli/src/Help.scuzz b/examples/cli/src/Help.scuzz
index ae0157ff..6c2a4849 100644
--- a/examples/cli/src/Help.scuzz
+++ b/examples/cli/src/Help.scuzz
@@ -122,7 +122,7 @@ Arguments:
 
 Options:
       --headless
-          Force Headless UiRuntime (no display needed)
+          Force Headless UiRuntime (overrides [ui].default_runtime; no display needed)
       --message-format <MESSAGE_FORMAT>
           Diagnostic format: human (default) or json (`scuzz check` only) [default: human] [possible values: human, json]
       --out-dir <OUT_DIR>
@@ -147,7 +147,7 @@ Desktop/Mobile `run` writes build/record.script (live OS input; keys as `key`; a
 """
 
 def helpFuzz(): String =
-  """Search in-source properties, drivers, and [taps] events under TestRuntime; mix coverage-guided search and mutation
+  """Replay corpus and seeds under TestRuntime, then walk schedule and fault seeds; then mutation
 
 Usage: scuzz fuzz [OPTIONS] [PATH]
 
@@ -167,8 +167,6 @@ Options:
           Mutate residual Property.check / Property.assert / .require predicates
       --no-fail-fast
           Finish search and still mutate after the first search failure
-      --minimize-corpus
-          Greedily minimize corpus/*.toml entries (keep pass/fail + declared sometimes coverage), then exit
       --relate
           Judge (Timeline, Timeline) => Verdict relation claims: replay each corpus entry under its own and a perturbed schedule, then exit
   -h, --help
@@ -180,10 +178,9 @@ Examples:
   scuzz fuzz --iterations 0
   scuzz fuzz --oracles examples/counter
   scuzz fuzz --replay build/fuzz/repro.toml
-  scuzz fuzz --minimize-corpus
   scuzz fuzz --no-fail-fast --iterations 8 examples/bad-example
 
-`scuzz fuzz` loads `<pkg>/corpus/*.toml` (sibling of goldens/) and replays those entries before search. `--iterations 0` is corpus-only: replay, then stop. A missing or empty corpus/ is a no-op. `examples/bad-example` is an expected fuzz failure (known-wrong `bump`). `examples/bad-fault` is an expected fuzz failure (swallowed `Fs.write` under a fault seed). `examples/bad-adt` is an expected fuzz failure (wrong `record` area). `examples/bad-sched` is an expected fuzz failure (lost Queue offer order under PCT). `examples/bad-intent` is an expected check failure (empty `*.scuzz_verify`). `examples/bad-split` is an expected fuzz failure (silent live/verify dump mismatch). Default stops at the first search failure. `--no-fail-fast` finishes search and still mutates. `scuzz check` and `scuzz test` still pass on the other expected-fail packages.
+`scuzz fuzz` loads `<pkg>/corpus/*.toml` (sibling of goldens/) and `build/seeds.txt`, then replays those entries. `--iterations 0` is corpus-only: replay, then stop. A missing or empty corpus/ is a no-op. Search after replay does not mutate `run.script`. It repeats that same seed/corpus script while `SCUZZ_SCHED_SEED` walks 0, 1, 2, … for the remaining budget. Iter 0 keeps no fault. Later iters set `SCUZZ_FAULT_SEED` to that same counter. `examples/bad-example` is an expected fuzz failure (known-wrong `bump`). `examples/bad-fault` is an expected fuzz failure (swallowed `Fs.write` under a fault seed). `examples/bad-adt` is an expected fuzz failure (wrong `record` area). `examples/bad-sched` is an expected fuzz failure (lost Queue offer order under PCT). `examples/bad-intent` is an expected check failure (empty `*.scuzz_verify` or leftover `*.scuzz_intent`). `examples/bad-split` is an expected fuzz failure (silent live/verify dump mismatch). Default stops at the first search failure. `--no-fail-fast` finishes search and still mutates. `scuzz check` and `scuzz test` still pass on the other expected-fail packages.
 """
 
 def helpNew(): String =
@@ -219,8 +216,6 @@ Arguments:
   [PATH]  [default: .]
 
 Options:
-      --message-format <MESSAGE_FORMAT>
-          Diagnostic format: human (default) or json (`scuzz check` only) [default: human] [possible values: human, json]
   -h, --help
           Print help
 
@@ -288,7 +283,7 @@ Arguments:
 
 Options:
       --headless
-          Force Headless UiRuntime
+          Force Headless UiRuntime (overrides [ui].default_runtime)
       --out-dir <OUT_DIR>
           [default: build]
       --message-format <MESSAGE_FORMAT>
@@ -299,6 +294,8 @@ Options:
 Examples:
   scuzz ide
   scuzz ide --headless .
+
+The CLI uses SCUZZ_IDE, else SCUZZ_HOME/ide when that package exists, else examples/editor. It passes PATH to the editor as Sys.args. There is no scuzz-ide binary.
 """
 
 def helpPkg(): String =
diff --git a/examples/cli/src/Main.scuzz b/examples/cli/src/Main.scuzz
index f73cd235..2fd53de4 100644
--- a/examples/cli/src/Main.scuzz
+++ b/examples/cli/src/Main.scuzz
@@ -56,6 +56,49 @@ def wantNeedIter(): String =
 For more information, try '--help'.
 """
 
+def wantBadIter(): String =
+  """error: invalid value 'abc' for '--iterations'
+
+For more information, try '--help'.
+"""
+
+def wantNegIter(): String =
+  """error: invalid value '-1' for '--iterations'
+
+For more information, try '--help'.
+"""
+
+def wantBadSeed(): String =
+  """error: invalid value 'nope' for '--seed'
+
+For more information, try '--help'.
+"""
+
+def wantRelate(): String =
+  """error: --relate does not accept --iterations, --seed, --replay, --oracles, or --no-fail-fast
+
+Usage: scuzz fuzz [OPTIONS] [PATH]
+
+For more information, try '--help'.
+"""
+
+def wantExtra(): String =
+  """error: unexpected argument 'examples/cli' found
+
+Usage: scuzz check [OPTIONS] [PATH]
+
+For more information, try '--help'.
+"""
+
+def wantBadName(): String =
+  """error: invalid project name '123app'; use [A-Za-z_][A-Za-z0-9_-]*
+
+For more information, try '--help'.
+"""
+
+def cliMoreOk(): Bool =
+  cliDiff(Cli.render(Cli.parse(a3("fuzz", "--iterations", "abc"))), wantBadIter()) && cliDiff(Cli.render(Cli.parse(a3("fuzz", "--iterations", "-1"))), wantNegIter()) && cliDiff(Cli.render(Cli.parse(a3("fuzz", "--seed", "nope"))), wantBadSeed()) && cliDiff(Cli.show(Cli.parse(a3("fuzz", "--seed", "-7"))), "fuzz path=. iterations=32 seed=-7 replay= oracles=false noFailFast=false relate=false") && cliDiff(Cli.render(Cli.parse(a3("fuzz", "--relate", "--iterations"))), wantNeedIter()) && cliDiff(Cli.render(Cli.parse(a4("fuzz", "--relate", "--iterations", "8"))), wantRelate()) && cliDiff(Cli.show(Cli.parse(a2("fuzz", "--relate"))), "fuzz path=. iterations=32 seed=42 replay= oracles=false noFailFast=false relate=true") && cliDiff(Cli.render(Cli.parse(a3("check", "examples/hello", "examples/cli"))), wantExtra()) && cliDiff(Cli.render(Cli.parse(a2("new", "123app"))), wantBadName()) && cliDiff(Cli.show(Cli.parse(a2("new", "my_app"))), "new name=my_app path=. ui=false") && Cli.showFlagNat("16") == "16" && Cli.showFlagNat("abc") == "fail" && Cli.showFlagNat("00") == "fail" && Cli.showFlagNat("") == "fail" && Cli.showFlagNat("32") == "32" && Cli.showFlagInt("-7") == "-7" && Cli.showFlagInt("nope") == "fail" && Cli.showFlagInt("+7") == "fail" && Cli.resolveIdeDir("/opt/ide", "/home/ide", "examples/editor") == "/opt/ide" && Cli.resolveIdeDir("", "/home/ide", "examples/editor") == "/home/ide" && Cli.resolveIdeDir("", "", "examples/editor") == "examples/editor" && Cli.resolveIdeDir("", "", "") == "" && Drive.shQuote("src/Main.scuzz") == "'src/Main.scuzz'" && Drive.shQuote("") == "''"
+
 def srcIrHi(): String =
   "@main def main: IO[Unit] =\n  IO.println(\"Hi\")\n"
 
@@ -127,6 +170,81 @@ def wantEmptyBundle(): String =
 def tomlBundle(): String =
   "[package]\nname = \"app\"\n[ui]\nbundle_id = \"dev.scuzz.hello\"\n"
 
+def tomlBadRt(): String =
+  "[package]\nname = \"app\"\n[ui]\ndefault_runtime = \"web\"\n"
+
+def wantBadRt(): String =
+  "default_runtime must be headless, desktop, or mobile"
+
+def tomlBadSize(): String =
+  "[package]\nname = \"app\"\n[ui]\nheadless_size = [0, 120]\n"
+
+def wantBadSize(): String =
+  "headless_size must be a pair of positive integers"
+
+def tomlStudio(): String =
+  "[package]\nname = \"studio\"\nversion = \"0.1.0\"\n\n[ui]\ndefault_runtime = \"desktop\"\nheadless_size = [400, 560]\nheadless_scale = 1.0\ntap_button = 1\n"
+
+def wantStudioMan(): String =
+  "name=studio ver=0.1.0 ui=true runtime=desktop size=400x560 scale=1.0 tap=1 bundle=dev.scuzz.app deps="
+
+def wantHelloMan(): String =
+  "name=hello ver=0.1.0 ui=false runtime=headless size=200x120 scale=1 tap= bundle=dev.scuzz.app deps="
+
+def wantCliMan(): String =
+  "name=cli ver=0.1.0 ui=false runtime=headless size=200x120 scale=1 tap= bundle=dev.scuzz.app deps=syntax=../syntax,compiler=../compiler"
+
+def tomlScaleDots(): String =
+  "[package]\nname = \"app\"\n[ui]\nheadless_scale = 1.2.3\n"
+
+def tomlScaleTrail(): String =
+  "[package]\nname = \"app\"\n[ui]\nheadless_scale = 1.\n"
+
+def tomlDupDep(): String =
+  "[package]\nname = \"app\"\n[dependencies]\nshared = { path = \"../a\" }\nshared = { path = \"../b\" }\n"
+
+def wantDupDep(): String =
+  "duplicate dependency name `shared`"
+
+def tomlBadPkgName(): String =
+  "[package]\nname = \"123app\"\n"
+
+def wantBadPkgNameToml(): String =
+  "package name must be [A-Za-z_][A-Za-z0-9_-]*"
+
+def tomlKebab(): String =
+  "[package]\nname = \"bad-example\"\n"
+
+def wantKebabMan(): String =
+  "name=bad-example ver=0.0.0 ui=false runtime=headless size=200x120 scale=1 tap= bundle=dev.scuzz.app deps="
+
+def tomlInlineRt(): String =
+  "[package]\nname = \"app\"\n[ui]\ndefault_runtime = \"desktop\"   # or \"headless\" / \"mobile\"\n"
+
+def wantInlineRt(): String =
+  "name=app ver=0.0.0 ui=true runtime=desktop size=200x120 scale=1 tap= bundle=dev.scuzz.app deps="
+
+def tomlCommaPath(): String =
+  "[package]\nname = \"app\"\n[dependencies]\nshared = { path = \"../a,b\" }\n"
+
+def wantCommaPath(): String =
+  "name=app ver=0.0.0 ui=false runtime=headless size=200x120 scale=1 tap= bundle=dev.scuzz.app deps=shared=../a,b"
+
+def tomlKeyOut(): String =
+  "name = \"app\"\n"
+
+def wantKeyOut(): String =
+  "key outside a table"
+
+def tomlUnclosed(): String =
+  "[package]\nname = \"app\"\n[dependencies]\nshared = { path = \"../a\"\n"
+
+def wantUnclosed(): String =
+  "unclosed `{` in dependency"
+
+def manUiOk(): Bool =
+  Manifest.uiRuntime(Manifest.manUi(Manifest.parse(tomlStudio()))) == "desktop" && Drive.showMan(Manifest.parse(tomlStudio())) == wantStudioMan() && Str.contains(Drive.runEnvOf("build", false, tomlStudio()), "SCUZZ_UI_RUNTIME=desktop") && Str.contains(Drive.runEnvOf("build", true, tomlStudio()), "SCUZZ_UI_RUNTIME=headless") && Str.contains(Cli.runEnvOf("build", false, "", "", tomlStudio()), "SCUZZ_UI_RUNTIME=desktop") && Str.contains(Cli.runEnvOf("build", true, "", "", tomlStudio()), "SCUZZ_UI_RUNTIME=headless") && Str.contains(Cli.runEnvOf("build", false, "", "", tomlStudio()), "SCUZZ_UI_RECORD='build/record.script'") && Str.contains(Cli.runEnvOf("build", false, "", "", tomlStudio()), "SCUZZ_UI_DEBUG_DUMP='build/debug.dump'") && !Str.contains(Cli.runEnvOf("build", true, "", "", tomlStudio()), "SCUZZ_UI_RECORD") && !Str.contains(Cli.runEnvOf("build", false, "", "", tomlHello()), "SCUZZ_UI_RECORD") && Str.contains(Drive.runEnvOf("build", false, tomlStudio()), "SCUZZ_UI_WIDTH=400") && Str.contains(Drive.runEnvOf("build", true, tomlStudio()), "SCUZZ_SNAPSHOT_PATH=build/snapshot.png") && !Str.contains(Drive.runEnvOf("build", false, tomlStudio()), "SCUZZ_SNAPSHOT_PATH") && Drive.showMan(Manifest.parse(tomlScaleDots())) == Str.concat("err:", Manifest.badScale()) && Drive.showMan(Manifest.parse(tomlScaleTrail())) == Str.concat("err:", Manifest.badScale()) && Drive.showMan(Manifest.parse(tomlDupDep())) == Str.concat("err:", wantDupDep()) && Drive.showMan(Manifest.parse(tomlBadPkgName())) == Str.concat("err:", wantBadPkgNameToml()) && Drive.showMan(Manifest.parse(tomlKebab())) == wantKebabMan() && Drive.showMan(Manifest.parse(tomlInlineRt())) == wantInlineRt() && Drive.showMan(Manifest.parse(tomlCommaPath())) == wantCommaPath() && Drive.showMan(Manifest.parse(tomlKeyOut())) == Str.concat("err:", wantKeyOut()) && Drive.showMan(Manifest.parse(tomlUnclosed())) == Str.concat("err:", wantUnclosed()) && Drive.seenHas("a" :: Manifest.noLines(), "a") && !Drive.seenHas(Manifest.noLines(), "a") && Drive.cycleErr("p") == "dependency cycle: p"
+
 def wantLink(): String =
   "clang -O0 -Wno-override-module build/hello.ll crates/runtime/build/libscuzz_rt.a -lpthread -lssl -lcrypto -o build/hello"
 
@@ -151,6 +269,7 @@ def sumToDiff(n: Int where n >= 0): Bool =
 
 def sumToTen(): Bool =
   true
+
 """
 
 def wantAddSeeds(): String =
@@ -198,7 +317,25 @@ IO smoke ok
 scuzz test ok"""
 
 def wantEmptyVerify(): String =
-  "bad-intent/empty.scuzz_verify:1:1: error: bad-intent/empty.scuzz_verify: verify file needs a Timeline => Verdict claim or a drive oracle; write a claim or delete the file"
+  "bad-intent/empty.scuzz_verify:1:1: error: verify file needs a Timeline => Verdict claim or a drive oracle; write a claim or delete the file"
+
+def srcBadDrive(): String =
+  """def notADrive(n: Int): Int =
+  n
+
+"""
+
+def wantBadDrive(): String =
+  "bad.scuzz_verify:1:5: error: public def notADrive is not a drive oracle or a Timeline => Verdict claim"
+
+def srcOpaqueDrive(): String =
+  """def hold(r: Ref[Int]): Bool =
+  true
+
+"""
+
+def wantOpaqueDrive(): String =
+  "bad.scuzz_verify:1:5: error: drive hold params must be generator-friendly (at most 3; ADT or List only as the sole param)"
 
 def srcBumpRepro(): String =
   "[fuzz]\nseed = 42\nschedule_seed = \"42\"\nevents = [\"drive bump 0\"]\n"
@@ -207,8 +344,17 @@ def wantBumpEvents(): String =
   """drive bump 0
 """
 
+def srcQuoteEv(): List[String] =
+  "drive bump \"x\"" :: Verify.noStr()
+
+def wantQuoteEv(): String =
+  "drive bump \"x\"\n"
+
+def campReproOk(): Bool =
+  Verify.searchN(8) == 5 && Verify.mutateN(8) == 3 && Verify.decodeD(Verify.parseSeed("1344")) == 2 && Verify.decodeK(Verify.parseSeed("1344")) == 0 && Str.contains(Verify.reproText(42, "1344", "", srcQuoteEv()), "pct_d = 2") && Str.contains(Verify.reproText(42, "1344", "", srcQuoteEv()), "pct_k = 0") && Verify.nls(Verify.parseEvents(Verify.reproText(42, "1344", "", srcQuoteEv()))) == wantQuoteEv()
+
 def campaignOk(): Bool =
-  Verify.seeds(srcAddVerify()) == wantAddSeeds() && Verify.drivers(srcAddVerify()) == wantAddDrivers() && Verify.wrapSrc("bump", srcBumpVerify()) == wantWrapBump() && Verify.nls(Verify.parseEvents(srcBumpRepro())) == wantBumpEvents() && Verify.nls(Verify.linesOf(wantBumpEvents())) == wantBumpEvents() && Verify.tomlQuoted(srcBumpRepro(), "schedule_seed") == "42" && Verify.fuzzOut(0, 42, 0, 0, 0, 0) == wantFuzzHello0() && Verify.fuzzOut(8, 42, 0, 0, 0, 0) == wantFuzzHello8() && Cli.runCmd(Cli.parse(a1("test")), srcIrHi()) == wantTestOk() && Cli.runCmd(Cli.parse(a3("fuzz", "--iterations", "0")), srcIrHi()) == wantFuzzHello0() && Cli.runCmd(Cli.parse(a3("fuzz", "--iterations", "8")), srcIrHi()) == wantFuzzHello8() && Verify.checkVerify("", "bad-intent/empty.scuzz_verify") == wantEmptyVerify() && Verify.checkVerify(srcAddVerify(), "add.scuzz_verify") == "scuzz check ok"
+  Verify.seeds(srcAddVerify()) == wantAddSeeds() && Verify.drivers(srcAddVerify()) == wantAddDrivers() && Verify.wrapSrc("bump", srcBumpVerify()) == wantWrapBump() && Verify.nls(Verify.parseEvents(srcBumpRepro())) == wantBumpEvents() && Verify.nls(Verify.linesOf(wantBumpEvents())) == wantBumpEvents() && Verify.tomlQuoted(srcBumpRepro(), "schedule_seed") == "42" && campReproOk() && Cli.runCmd(Cli.parse(a1("test")), srcIrHi()) == wantTestOk() && Verify.checkVerify("", "bad-intent/empty.scuzz_verify") == wantEmptyVerify() && Verify.checkVerify(srcAddVerify(), "add.scuzz_verify") == "scuzz check ok" && Verify.checkVerify(srcBadDrive(), "bad.scuzz_verify") == wantBadDrive() && Verify.checkVerify(srcOpaqueDrive(), "bad.scuzz_verify") == wantOpaqueDrive() && Verify.checkVerify("nope", "junk.scuzz_verify") != wantEmptyVerify()
 
 def verifyOk(): Bool =
   Cli.runCmd(Cli.parse(a2("check", "--message-format=json")), srcTyUnbound()) == wantTyUnbound() && Cli.runCmd(Cli.parse(a1("check")), srcTyUnbound()) == wantHumanUnbound() && Cli.runCmd(Cli.parse(a1("check")), srcIrHi()) == "scuzz check ok" && Cli.runCmd(Cli.parse(a1("fmt")), srcHi()) == wantHi() && campaignOk()
@@ -216,8 +362,26 @@ def verifyOk(): Bool =
 def wantPkg(): String =
   "ok name=hello ll=build/hello.ll link=clang -O0 -Wno-override-module build/hello.ll crates/runtime/build/libscuzz_rt.a -lpthread -lssl -lcrypto -o build/hello"
 
+def pkgEnvOk(): Bool =
+  Str.contains(Drive.pkgScuzzEnv("/opt/scuzz"), "SCUZZ=") && Str.contains(Drive.pkgScuzzEnv("/opt/scuzz"), "bin/scuzz") && Drive.pkgScuzzEnv("") == ""
+
+def pkgIdOk(): Bool =
+  Drive.pkgEnvId("dev.scuzz.x y") == "SCUZZ_BUNDLE_ID='dev.scuzz.x y' " && Drive.pkgEnvId("a;true") == "SCUZZ_BUNDLE_ID='a;true' "
+
+def pkgAndroidCmdGot(cmd: String): Bool =
+  Str.startsWith(cmd, Drive.pkgScuzzEnv("/opt/scuzz")) && Str.contains(cmd, "bash") && Str.contains(cmd, "/opt/scuzz/crates/embedder-mobile/shells/android/build_ndk.sh")
+
+def pkgAndroidCmdOk(): Bool =
+  pkgAndroidCmdGot(Drive.pkgAndroidCmd("/opt/scuzz", "examples/counter", "dev.scuzz.app")) && Str.contains(Drive.pkgAndroidCmd("/opt/scuzz", "my app", "dev.scuzz.app"), "'my app'") && Str.contains(Drive.pkgIosCmd("/opt/scuzz", "my app", "dev.scuzz.app"), "'my app'")
+
+def pkgParseOk(): Bool =
+  cliDiff(Cli.render(Cli.parse(a3("package", "--target", "foo"))), Drive.badTarget("foo")) && cliDiff(Cli.show(Cli.parse(a2("package", "--target=ios"))), "package path=. out=build target=ios") && cliDiff(Cli.show(Cli.parse(a1("package"))), "package path=. out=build target=host")
+
+def pkgOk(): Bool =
+  pkgEnvOk() && pkgIdOk() && pkgAndroidCmdOk() && pkgParseOk()
+
 def driveOk(): Bool =
-  Drive.showMan(Manifest.parse(tomlHello())) == "name=hello ver=0.1.0 ui=false deps=0" && Drive.showMan(Manifest.parse(tomlCli())) == "name=cli ver=0.1.0 ui=false deps=2" && Drive.showMan(Manifest.parse(tomlPlugins())) == Str.concat("err:", wantPlugins()) && Drive.showMan(Manifest.parse(tomlLicense())) == Str.concat("err:", wantLicense()) && Drive.showMan(Manifest.parse(tomlStrDep())) == Str.concat("err:", wantStrDep()) && Drive.showMan(Manifest.parse(tomlGit())) == Str.concat("err:", wantGit()) && Drive.showMan(Manifest.parse(tomlNoName())) == Str.concat("err:", wantNoName()) && Drive.showMan(Manifest.parse(tomlEmptyPath())) == Str.concat("err:", wantEmptyPath()) && Drive.showMan(Manifest.parse(tomlNeedPath())) == Str.concat("err:", wantNeedPathToml()) && Drive.showMan(Manifest.parse(tomlEmptyBundle())) == Str.concat("err:", wantEmptyBundle()) && Drive.bundleIdOf(tomlHello()) == "dev.scuzz.app" && Drive.bundleIdOf(tomlBundle()) == "dev.scuzz.hello" && Drive.compileSrc(srcIrHi()).ok && Drive.compileSrc(srcIrHi()).ir == wantIrHi() && !Drive.compileSrc(srcTyUnbound()).ok && Drive.compileSrc(srcTyUnbound()).diags == wantTyUnbound() && Drive.compileSrc(srcIrHi()).ir == Drive.compileSrc(srcIrHi()).ir && Drive.linkLine("clang", Drive.llName("build", "hello"), "crates/runtime/build/libscuzz_rt.a", Drive.exeName("build", "hello")) == wantLink() && Drive.linkLineHost(true, false, "clang", "a.ll", "rt.a", "app", ".", false) == wantLinkUi() && Drive.linkLineHost(true, true, "clang", "a.ll", "rt.a", "app", ".", false) == wantLinkMacUi() && Drive.missToml("/tmp/empty") == "missing scuzz.toml in /tmp/empty" && Drive.showPkg(Drive.compilePkg(tomlHello(), srcIrHi(), "build", "clang", "crates/runtime/build/libscuzz_rt.a")) == wantPkg() && Drive.showPkg(Drive.compileFiles(tomlHello(), ("Main", srcIrHi()) :: Manifest.noPairs(), "build", "clang", "crates/runtime/build/libscuzz_rt.a")) == wantPkg() && Cli.runCmd(Cli.parse(a1("build")), srcIrHi()) == wantPkg()
+  manUiOk() && Mutate.sitesOk() && Drive.showMan(Manifest.parse(tomlHello())) == wantHelloMan() && Drive.showMan(Manifest.parse(tomlCli())) == wantCliMan() && Drive.showMan(Manifest.parse(tomlPlugins())) == Str.concat("err:", wantPlugins()) && Drive.showMan(Manifest.parse(tomlLicense())) == Str.concat("err:", wantLicense()) && Drive.showMan(Manifest.parse(tomlStrDep())) == Str.concat("err:", wantStrDep()) && Drive.showMan(Manifest.parse(tomlGit())) == Str.concat("err:", wantGit()) && Drive.showMan(Manifest.parse(tomlNoName())) == Str.concat("err:", wantNoName()) && Drive.showMan(Manifest.parse(tomlEmptyPath())) == Str.concat("err:", wantEmptyPath()) && Drive.showMan(Manifest.parse(tomlNeedPath())) == Str.concat("err:", wantNeedPathToml()) && Drive.showMan(Manifest.parse(tomlEmptyBundle())) == Str.concat("err:", wantEmptyBundle()) && Drive.showMan(Manifest.parse(tomlBadRt())) == Str.concat("err:", wantBadRt()) && Drive.showMan(Manifest.parse(tomlBadSize())) == Str.concat("err:", wantBadSize()) && Drive.bundleIdOf(tomlHello()) == "dev.scuzz.app" && Drive.bundleIdOf(tomlBundle()) == "dev.scuzz.hello" && Drive.compileSrc(srcIrHi()).ok && Drive.compileSrc(srcIrHi()).ir == wantIrHi() && !Drive.compileSrc(srcTyUnbound()).ok && Drive.compileSrc(srcTyUnbound()).diags == wantTyUnbound() && Drive.compileSrc(srcIrHi()).ir == Drive.compileSrc(srcIrHi()).ir && Drive.linkLine("clang", Drive.llName("build", "hello"), "crates/runtime/build/libscuzz_rt.a", Drive.exeName("build", "hello")) == wantLink() && Drive.linkLineHost(true, false, "clang", "a.ll", "rt.a", "app", ".", false) == wantLinkUi() && Drive.linkLineHost(true, true, "clang", "a.ll", "rt.a", "app", ".", false) == wantLinkMacUi() && Drive.missToml("/tmp/empty") == "missing scuzz.toml in /tmp/empty" && Drive.showPkg(Drive.compilePkg(tomlHello(), srcIrHi(), "build", "clang", "crates/runtime/build/libscuzz_rt.a")) == wantPkg() && Drive.showPkg(Drive.compileFiles(tomlHello(), ("Main", srcIrHi()) :: Manifest.noPairs(), "build", "clang", "crates/runtime/build/libscuzz_rt.a")) == wantPkg() && !Drive.compileFiles(tomlHello(), ("Main", srcTyUnbound()) :: Manifest.noPairs(), "build", "clang", "crates/runtime/build/libscuzz_rt.a").ok && Cli.runCmd(Cli.parse(a1("build")), srcIrHi()) == wantPkg() && pkgOk()
 
 def cliDiff(got: String, want: String): Bool =
   got == want
@@ -254,8 +418,67 @@ def food(): Int =
   bar(1)
 """
 
+def lspHelpSrc(): String =
+  """def g(x: Int): Int =
+  x
+"""
+
+def lspMainCall(): String =
+  """def f(): Int =
+  Help.g(1)
+"""
+
+def lspMainTy(): String =
+  "def f(): Int =\n  Help.g(\"x\")\n"
+
+def lspOpenJ(): String =
+  "{\"params\":{\"textDocument\":{\"text\":\"abc\"}}}"
+
+def lspChangeJ(): String =
+  "{\"params\":{\"textDocument\":{\"text\":\"wrong\"},\"contentChanges\":[{\"text\":\"old\"},{\"text\":\"new\"}]}}"
+
+def overlaySrcOf(files: List[(String, String)]): String =
+  overlaySrcHd(List.at(files, 0))
+
+def overlaySrcHd(h: (String, String)): String =
+  h match {
+    case (_, src) => src
+  }
+
+def lspSpanOk(): Bool =
+  Lsp.identAt(lspSrc(), 4) == "foo" && Lsp.hoverAt(lspSrc(), 0, 4) == "def foo(x: Int): Int" && Lsp.qualIdentAt("IO.println(1)", 3) == "IO.println" && Lsp.hoverAt("IO.println(1)", 0, 3) == "IO.println: IO[Unit]" && Lsp.hoverAt(lspSrc(), 1, 0) == "" && Str.contains(Lsp.defJson("file://x", lspSrc(), 0, 4), "\"character\":4") && Str.contains(Lsp.defJson("file://x", lspSrc(), 0, 4), "\"character\":7") && Str.contains(Lsp.defJson("file://x", lspUseSrc(), 4, 2), "\"character\":4") && Lsp.renameIdents(lspRenameSrc(), "foo", "bar") == lspRenameWant() && Str.contains(Lsp.completeJson(lspSrc(), "fo"), "foo") && Str.contains(Lsp.completeJson("", "IO.prin"), "IO.println") && Lsp.completeJson(lspSrc(), "zzz") == "{\"isIncomplete\":false,\"items\":[]}" && Str.contains(Lsp.tokensJson(lspSrc()), "0,0,3,0,0") && Str.contains(Lsp.frame("é"), "Content-Length: 2") && Lsp.offsetOf("""ab
+cd""", 0, 99) == 2
+
+def lspWireOpen(): Bool =
+  Lsp.openSrc(Lsp.parseJson(lspOpenJ())) == "abc" && Lsp.changeSrc(Lsp.parseJson(lspChangeJ())) == "new"
+
+def lspWireOver(): Bool =
+  Lsp.overlayHas(Lsp.overlayPut([], "/x", ""), "/x") && Lsp.overlayGet(Lsp.overlayPut([], "/x", ""), "/x") == "" && !Lsp.overlayHas([], "/x")
+
+def lspWireCaps(): Bool =
+  Str.contains(Lsp.renameJson("file://x", lspRenameSrc(), 0, 4, "bar"), "\"file://x\"") && Str.contains(Lsp.renameJson("file://x", lspRenameSrc(), 0, 4, "bar"), "bar") && !Str.contains(Lsp.caps(), "prepareProvider") && !Str.contains(Lsp.caps(), "documentSymbol") && !Str.contains(Lsp.caps(), "inlayHint") && !Str.contains(Lsp.caps(), "foldingRange") && !Str.contains(Lsp.caps(), "codeAction") && !Str.contains(Lsp.caps(), "declarationProvider") && !Str.contains(Lsp.caps(), "triggerCharacters") && Str.contains(Lsp.caps(), "utf-8")
+
+def lspWirePath(): Bool =
+  Lsp.pathOfUri("file:///tmp/a%20b.scuzz") == "/tmp/a b.scuzz" && Str.contains(Lsp.errorMsg("1", 0 - 32601, "MethodNotFound"), "-32601") && Str.contains(Check.jsonStr("a\tb"), "\\t") && overlaySrcOf(Drive.substOverlay(("Main", "disk") :: Manifest.noPairs(), ("/pkg/src/Main.scuzz", "") :: Manifest.noPairs())) == "" && overlaySrcOf(Drive.substOverlay(("Main", "disk") :: Manifest.noPairs(), ("/pkg/src/Main.scuzz", "open") :: Manifest.noPairs())) == "open"
+
+def lspWireOk(): Bool =
+  lspWireOpen() && lspWireOver() && lspWireCaps() && lspWirePath()
+
+def lspHelpBad(): String =
+  """def g(): Int =
+  true
+"""
+
+def lspMainOk(): String =
+  """def f(): Int =
+  1
+"""
+
+def lspDiagOk(): Bool =
+  Str.contains(Check.check(lspHelpBad()), "Main.scuzz") && !Str.contains(Check.check(lspHelpBad()), "Help.scuzz") && Str.contains(Check.checkFilesOwn(("Help", lspHelpBad()) :: ("Main", lspMainOk()) :: Manifest.noPairs(), "Help" :: "Main" :: []), "Help.scuzz") && Check.checkFilesOwn(("Main", lspMainCall()) :: ("Help", lspHelpSrc()) :: Manifest.noPairs(), "Main" :: "Help" :: []) == "[]" && Str.contains(Check.checkFilesOwn(("Main", lspMainTy()) :: ("Help", lspHelpSrc()) :: Manifest.noPairs(), "Main" :: "Help" :: []), "type error")
+
 def lspOk(): Bool =
-  Lsp.identAt(lspSrc(), 4) == "foo" && Lsp.hoverAt(lspSrc(), 0, 4) == "def foo(x: Int): Int" && Lsp.qualIdentAt("IO.println(1)", 3) == "IO.println" && Lsp.hoverAt(lspSrc(), 1, 0) == "" && Str.contains(Lsp.defJson("file://x", lspSrc(), 0, 4), "\"character\":4") && Str.contains(Lsp.defJson("file://x", lspSrc(), 0, 4), "\"character\":7") && Str.contains(Lsp.defJson("file://x", lspUseSrc(), 4, 2), "\"character\":4") && Lsp.renameIdents(lspRenameSrc(), "foo", "bar") == lspRenameWant() && Str.contains(Lsp.completeJson(lspSrc(), "fo"), "foo") && Lsp.completeJson(lspSrc(), "zzz") == "{\"isIncomplete\":false,\"items\":[]}" && Str.contains(Lsp.tokensJson(lspSrc()), "0,0,3,0,0") && Str.contains(Lsp.frame("é"), "Content-Length: 2")
+  lspSpanOk() && lspWireOk() && lspDiagOk()
 
 def srcPanic(): String =
   """def boom(): Int =
@@ -266,7 +489,7 @@ def panicOk(): Bool =
   Str.contains(Drive.compileSrc(srcPanic()).ir, "sz_panic_push_src") && Str.contains(Drive.compileSrc(srcPanic()).ir, "Main.scuzz:")
 
 def allOk(): Bool =
-  panicOk() && lspOk() && cliDiff(Cli.render(Cli.parse(a1("--help"))), Help.helpRoot()) && cliDiff(Cli.render(Cli.parse(a2("fmt", "--help"))), Help.helpFmt()) && cliDiff(Cli.render(Cli.parse(a2("check", "--help"))), Help.helpCheck()) && cliDiff(Cli.render(Cli.parse(a2("build", "--help"))), Help.helpBuild()) && cliDiff(Cli.render(Cli.parse(a2("run", "--help"))), Help.helpRun()) && cliDiff(Cli.render(Cli.parse(a2("fuzz", "--help"))), Help.helpFuzz()) && cliDiff(Cli.render(Cli.parse(a2("new", "--help"))), Help.helpNew()) && cliDiff(Cli.render(Cli.parse(a1("-V"))), Version.line()) && cliDiff(Cli.show(Cli.parse(a1("fmt"))), "fmt path=. check=false") && cliDiff(Cli.show(Cli.parse(a2("fmt", "--check"))), "fmt path=. check=true") && cliDiff(Cli.show(Cli.parse(a3("fmt", "--check", "examples/hello"))), "fmt path=examples/hello check=true") && cliDiff(Cli.show(Cli.parse(a2("check", "examples/kernel"))), "check path=examples/kernel json=false") && cliDiff(Cli.show(Cli.parse(a2("check", "--message-format=json"))), "check path=. json=true") && cliDiff(Cli.show(Cli.parse(a2("--message-format=json", "check"))), "check path=. json=true") && cliDiff(Cli.show(Cli.parse(a3("build", "--full", "examples/hello"))), "build path=examples/hello out=build full=true verify=false") && cliDiff(Cli.show(Cli.parse(a3("run", "--headless", "examples/studio"))), "run path=examples/studio out=build headless=true watch=false script= dump=") && cliDiff(Cli.show(Cli.parse(a3("fuzz", "--iterations", "16"))), "fuzz path=. iterations=16 seed=42 replay= oracles=false noFailFast=false minimize=false relate=false") && cliDiff(Cli.show(Cli.parse(a4("fuzz", "--iterations", "0", "examples/counter"))), "fuzz path=examples/counter iterations=0 seed=42 replay= oracles=false noFailFast=false minimize=false relate=false") && cliDiff(Cli.show(Cli.parse(a3("new", "myapp", "--ui"))), "new name=myapp path=. ui=true") && cliDiff(Cli.show(Cli.parse(a2("package", "--target=ios"))), "package path=. out=build target=ios") && cliDiff(Cli.show(Cli.parse(a2("ide", "--headless"))), "ide path=. out=build headless=true") && cliDiff(Cli.render(Cli.parse(a1("nope"))), wantUnrec()) && cliDiff(Cli.render(Cli.parse(a2("fmt", "--nope"))), wantUnexp()) && cliDiff(Cli.render(Cli.parse(a2("--message-format=json", "fmt"))), wantJsonOnly()) && cliDiff(Cli.render(Cli.parse(a1("new"))), wantMissName()) && cliDiff(Cli.render(Cli.parse(a2("fuzz", "--iterations"))), wantNeedIter()) && cliDiff(Cli.render(Cli.parse(noArgs())), Help.helpRoot()) && cliDiff(Cli.fmtSrc(srcHi()), wantHi()) && cliIdem(a1("fmt")) && cliIdem(a2("fuzz", "--oracles")) && driveOk() && verifyOk()
+  cliMoreOk() && panicOk() && lspOk() && cliDiff(Cli.render(Cli.parse(a1("--help"))), Help.helpRoot()) && cliDiff(Cli.render(Cli.parse(a2("fmt", "--help"))), Help.helpFmt()) && cliDiff(Cli.render(Cli.parse(a2("check", "--help"))), Help.helpCheck()) && cliDiff(Cli.render(Cli.parse(a2("build", "--help"))), Help.helpBuild()) && cliDiff(Cli.render(Cli.parse(a2("run", "--help"))), Help.helpRun()) && cliDiff(Cli.render(Cli.parse(a2("fuzz", "--help"))), Help.helpFuzz()) && cliDiff(Cli.render(Cli.parse(a2("new", "--help"))), Help.helpNew()) && cliDiff(Cli.render(Cli.parse(a2("lsp", "--help"))), Help.helpLsp()) && cliDiff(Cli.render(Cli.parse(a1("-V"))), Version.line()) && cliDiff(Cli.show(Cli.parse(a1("fmt"))), "fmt path=. check=false") && cliDiff(Cli.show(Cli.parse(a2("fmt", "--check"))), "fmt path=. check=true") && cliDiff(Cli.show(Cli.parse(a3("fmt", "--check", "examples/hello"))), "fmt path=examples/hello check=true") && cliDiff(Cli.show(Cli.parse(a2("check", "examples/kernel"))), "check path=examples/kernel json=false") && cliDiff(Cli.show(Cli.parse(a2("check", "--message-format=json"))), "check path=. json=true") && cliDiff(Cli.show(Cli.parse(a2("--message-format=json", "check"))), "check path=. json=true") && cliDiff(Cli.show(Cli.parse(a3("build", "--full", "examples/hello"))), "build path=examples/hello out=build full=true verify=false") && cliDiff(Cli.show(Cli.parse(a3("run", "--headless", "examples/studio"))), "run path=examples/studio out=build headless=true watch=false script= dump=") && cliDiff(Cli.show(Cli.parse(a3("fuzz", "--iterations", "16"))), "fuzz path=. iterations=16 seed=42 replay= oracles=false noFailFast=false relate=false") && cliDiff(Cli.show(Cli.parse(a4("fuzz", "--iterations", "0", "examples/counter"))), "fuzz path=examples/counter iterations=0 seed=42 replay= oracles=false noFailFast=false relate=false") && cliDiff(Cli.show(Cli.parse(a2("build", "--verify"))), "build path=. out=build full=false verify=true") && cliDiff(Cli.show(Cli.parse(a3("new", "myapp", "--ui"))), "new name=myapp path=. ui=true") && cliDiff(Cli.show(Cli.parse(a2("package", "--target=ios"))), "package path=. out=build target=ios") && cliDiff(Cli.show(Cli.parse(a1("package"))), "package path=. out=build target=host") && cliDiff(Cli.render(Cli.parse(a3("package", "--target", "foo"))), Drive.badTarget("foo")) && cliDiff(Cli.show(Cli.parse(a2("ide", "--headless"))), "ide path=. out=build headless=true") && cliDiff(Cli.render(Cli.parse(a1("nope"))), wantUnrec()) && cliDiff(Cli.render(Cli.parse(a2("fmt", "--nope"))), wantUnexp()) && cliDiff(Cli.render(Cli.parse(a2("--message-format=json", "fmt"))), wantJsonOnly()) && cliDiff(Cli.render(Cli.parse(a1("new"))), wantMissName()) && cliDiff(Cli.render(Cli.parse(a2("fuzz", "--iterations"))), wantNeedIter()) && cliDiff(Cli.render(Cli.parse(noArgs())), Help.helpRoot()) && cliDiff(Cli.fmtSrc(srcHi()), wantHi()) && cliIdem(a1("fmt")) && cliIdem(a2("fuzz", "--oracles")) && driveOk() && verifyOk()
 
 def go(args: List[String]): IO[Unit] =
   if (List.isEmpty(args)) IO.println(if (allOk()) "cli-ok" else "cli-bad") else Cli.dispatch(Cli.parse(args))
diff --git a/examples/codegen/src/Main.scuzz b/examples/codegen/src/Main.scuzz
index c4ed210b..165d06bd 100644
--- a/examples/codegen/src/Main.scuzz
+++ b/examples/codegen/src/Main.scuzz
@@ -393,6 +393,24 @@ def srcTup3(): String =
   IO.println(Str.fromInt((1, 2, 3)._3))
 """
 
+def srcTup5(): String =
+  """@main def main: IO[Unit] =
+  IO.println(Str.fromInt((1, 2, 3, 4, 5)._5))
+"""
+
+def srcTup8(): String =
+  """@main def main: IO[Unit] =
+  IO.println(Str.fromInt((1, 2, 3, 4, 5, 6, 7, 8)._8))
+"""
+
+def srcMixed(): String =
+  """def addDefault(n: Int, m: Int = 1): Int =
+  n + m
+
+@main def main: IO[Unit] =
+  IO.println(Str.fromInt(addDefault(3, m = 4)))
+"""
+
 def wantTup3(): String =
   "@.str0 = private unnamed_addr constant [15 x i8] c\"Main.scuzz:2:3\\00\", align 1\n\ndefine i32 @main(i32 %argc, ptr %argv) {\nentry:\n  %szlocg0 = getelementptr inbounds [15 x i8], ptr @.str0, i64 0, i64 0\n  call void @sz_panic_push_src(ptr %szlocg0)\n  %build_e_arg0_sc_1_lb = call ptr @sz_box_i64(i64 2)\n  %build_e_arg0_sc_1_rb = call ptr @sz_box_i64(i64 3)\n  %build_e_arg0_sc_1_v = call ptr @sz_pair_new(ptr %build_e_arg0_sc_1_lb, ptr %build_e_arg0_sc_1_rb)\n  call void @sz_release(ptr %build_e_arg0_sc_1_lb)\n  call void @sz_release(ptr %build_e_arg0_sc_1_rb)\n  %build_e_arg0_sc_p0_lb = call ptr @sz_box_i64(i64 1)\n  %build_e_arg0_sc_p0_v = call ptr @sz_pair_new(ptr %build_e_arg0_sc_p0_lb, ptr %build_e_arg0_sc_1_v)\n  call void @sz_release(ptr %build_e_arg0_sc_p0_lb)\n  call void @sz_release(ptr %build_e_arg0_sc_1_v)\n  br label %build_e_arg0_try_0_0\nbuild_e_arg0_try_0_0:\n  %build_e_arg0_p0_0_tl1 = call ptr @sz_pair_left(ptr %build_e_arg0_sc_p0_v)\n  %build_e_arg0_p0_0_tr1 = call ptr @sz_pair_right(ptr %build_e_arg0_sc_p0_v)\n  br label %build_e_arg0_p0_0_tn1\nbuild_e_arg0_p0_0_tn1:\n  %build_e_arg0_p0_0_tvl1 = call i64 @sz_unbox_i64(ptr %build_e_arg0_p0_0_tl1)\n  %build_e_arg0_p0_0_n1_tl2 = call ptr @sz_pair_left(ptr %build_e_arg0_p0_0_tr1)\n  %build_e_arg0_p0_0_n1_tr2 = call ptr @sz_pair_right(ptr %build_e_arg0_p0_0_tr1)\n  br label %build_e_arg0_p0_0_n1_tn2\nbuild_e_arg0_p0_0_n1_tn2:\n  %build_e_arg0_p0_0_n1_tvl2 = call i64 @sz_unbox_i64(ptr %build_e_arg0_p0_0_n1_tl2)\n  %build_e_arg0_p0_0_n1_tv2 = call i64 @sz_unbox_i64(ptr %build_e_arg0_p0_0_n1_tr2)\n  br label %build_e_arg0_ok_0_0\nbuild_e_arg0_default_0:\n  %build_e_arg0_dflt = add i64 0, 0\n  br label %build_e_arg0_merge_0\nbuild_e_arg0_ok_0_0:\n  br label %build_e_arg0_aj_0_0\nbuild_e_arg0_aj_0_0:\n  br label %build_e_arg0_merge_0\nbuild_e_arg0_merge_0:\n  %build_e_arg0_phi = phi i64 [ %build_e_arg0_p0_0_n1_tv2, %build_e_arg0_aj_0_0 ], [ %build_e_arg0_dflt, %build_e_arg0_default_0 ]\n  %build_e_v = call ptr @sz_string_from_int(i64 %build_e_arg0_phi)\n  %build_io = call ptr @sz_io_println(ptr %build_e_v)\n  call void @sz_release(ptr %build_e_v)\n  %rc = call i32 @sz_runtime_main_args(ptr %build_io, i32 %argc, ptr %argv)\n  call void @sz_panic_pop_src()\n  ret i32 %rc\n}"
 
@@ -515,7 +533,7 @@ def okPair(): Bool =
   irDiff(srcToInt(), wantToInt()) && irIdem(srcToInt()) && irDiff(srcPair(), wantPair()) && irIdem(srcPair()) && Check.check(srcToInt()) == "[]" && Check.check(srcPair()) == "[]" && irDiff(srcAt(), wantAt()) && irIdem(srcAt()) && irDiff(srcRec(), wantRec()) && irIdem(srcRec()) && Check.check(srcAt()) == "[]" && Check.check(srcRec()) == "[]"
 
 def okMod(): Bool =
-  irDiffFiles(srcModFiles(), wantMod()) && irIdemFiles(srcModFiles()) && Check.checkFiles(srcModFiles()) == "[]" && Check.check(srcNil()) == "[]" && Check.check(srcFld()) == "[]" && irDiff(srcFld(), wantFld()) && irIdem(srcFld()) && irDiff(srcCopyFld(), wantCopyFld()) && irIdem(srcCopyFld()) && Check.check(srcCopyFld()) == "[]" && irDiff(srcCopyRec(), wantCopyRec()) && irIdem(srcCopyRec()) && Check.check(srcCopyRec()) == "[]" && irDiff(srcFieldCall(), wantFieldCall()) && irIdem(srcFieldCall()) && Check.check(srcFieldCall()) == "[]" && irDiff(srcFieldIf(), wantFieldIf()) && irIdem(srcFieldIf()) && Check.check(srcFieldIf()) == "[]" && irDiff(srcTup1(), wantTup1()) && irIdem(srcTup1()) && Check.check(srcTup1()) == "[]" && irDiff(srcTup3(), wantTup3()) && irIdem(srcTup3()) && Check.check(srcTup3()) == "[]" && irDiff(srcMatchX(), wantMatchX()) && irIdem(srcMatchX()) && Check.check(srcMatchX()) == "[]" && irDiff(srcRep(), wantRep()) && irIdem(srcRep()) && Check.check(srcRep()) == "[]"
+  irDiffFiles(srcModFiles(), wantMod()) && irIdemFiles(srcModFiles()) && Check.checkFiles(srcModFiles()) == "[]" && Check.check(srcNil()) == "[]" && Check.check(srcFld()) == "[]" && irDiff(srcFld(), wantFld()) && irIdem(srcFld()) && irDiff(srcCopyFld(), wantCopyFld()) && irIdem(srcCopyFld()) && Check.check(srcCopyFld()) == "[]" && irDiff(srcCopyRec(), wantCopyRec()) && irIdem(srcCopyRec()) && Check.check(srcCopyRec()) == "[]" && irDiff(srcFieldCall(), wantFieldCall()) && irIdem(srcFieldCall()) && Check.check(srcFieldCall()) == "[]" && irDiff(srcFieldIf(), wantFieldIf()) && irIdem(srcFieldIf()) && Check.check(srcFieldIf()) == "[]" && irDiff(srcTup1(), wantTup1()) && irIdem(srcTup1()) && Check.check(srcTup1()) == "[]" && irDiff(srcTup3(), wantTup3()) && irIdem(srcTup3()) && Check.check(srcTup3()) == "[]" && Check.check(srcTup5()) == "[]" && Check.check(srcTup8()) == "[]" && Check.check(srcMixed()) == "[]" && irDiff(srcMatchX(), wantMatchX()) && irIdem(srcMatchX()) && Check.check(srcMatchX()) == "[]" && irDiff(srcRep(), wantRep()) && irIdem(srcRep()) && Check.check(srcRep()) == "[]"
 
 def okPtr(): Bool =
   irDiff(srcIfPtr(), wantIfPtr()) && irIdem(srcIfPtr()) && Check.check(srcIfPtr()) == "[]" && irDiff(srcTCons(), wantTCons()) && irIdem(srcTCons()) && Check.check(srcTCons()) == "[]" && irDiff(srcTupPtr(), wantTupPtr()) && irIdem(srcTupPtr()) && Check.check(srcTupPtr()) == "[]" && irDiff(srcT3(), wantT3()) && irIdem(srcT3()) && Check.check(srcT3()) == "[]" && irDiff(srcIfTup(), wantIfTup()) && irIdem(srcIfTup()) && Check.check(srcIfTup()) == "[]" && irDiff(srcNestTup(), wantNestTup()) && irIdem(srcNestTup()) && Check.check(srcNestTup()) == "[]"
@@ -524,7 +542,7 @@ def srcJoin(): String =
   "@main def main: IO[Unit] =\n  IO.println(List.join([\"a\", \"b\"], \",\"))\n"
 
 def wantJoin(): String =
-  "@.str0 = private unnamed_addr constant [2 x i8] c\"a\\00\", align 1\n@.str1 = private unnamed_addr constant [2 x i8] c\"b\\00\", align 1\n@.str2 = private unnamed_addr constant [2 x i8] c\",\\00\", align 1\n@.str3 = private unnamed_addr constant [15 x i8] c\"Main.scuzz:2:3\\00\", align 1\n\ndefine i32 @main(i32 %argc, ptr %argv) {\nentry:\n  %szlocg0 = getelementptr inbounds [15 x i8], ptr @.str3, i64 0, i64 0\n  call void @sz_panic_push_src(ptr %szlocg0)\n  %build_e_arg0_0 = call ptr @sz_list_nil()\n  %build_e_arg0_e1_gep = getelementptr inbounds [2 x i8], ptr @.str1, i64 0, i64 0\n  %build_e_arg0_e1_s = call ptr @sz_string_from_cstr(ptr %build_e_arg0_e1_gep)\n  %build_e_arg0_2 = call ptr @sz_list_cons(ptr %build_e_arg0_e1_s, ptr %build_e_arg0_0)\n  call void @sz_release(ptr %build_e_arg0_0)\n  call void @sz_release(ptr %build_e_arg0_e1_s)\n  %build_e_arg0_e0_gep = getelementptr inbounds [2 x i8], ptr @.str0, i64 0, i64 0\n  %build_e_arg0_e0_s = call ptr @sz_string_from_cstr(ptr %build_e_arg0_e0_gep)\n  %build_e_arg0_1 = call ptr @sz_list_cons(ptr %build_e_arg0_e0_s, ptr %build_e_arg0_2)\n  call void @sz_release(ptr %build_e_arg0_2)\n  call void @sz_release(ptr %build_e_arg0_e0_s)\n  %build_e_arg1_gep = getelementptr inbounds [2 x i8], ptr @.str2, i64 0, i64 0\n  %build_e_arg1_s = call ptr @sz_string_from_cstr(ptr %build_e_arg1_gep)\n  %build_e_sep = call ptr @sz_string_cstr(ptr %build_e_arg1_s)\n  %build_e_v = call ptr @sz_list_join(ptr %build_e_arg0_1, ptr %build_e_sep)\n  call void @sz_release(ptr %build_e_arg0_1)\n  call void @sz_release(ptr %build_e_arg1_s)\n  %build_io = call ptr @sz_io_println(ptr %build_e_v)\n  call void @sz_release(ptr %build_e_v)\n  %rc = call i32 @sz_runtime_main_args(ptr %build_io, i32 %argc, ptr %argv)\n  call void @sz_panic_pop_src()\n  ret i32 %rc\n}"
+  "@.str0 = private unnamed_addr constant [2 x i8] c\"a\\00\", align 1\n@.str1 = private unnamed_addr constant [2 x i8] c\"b\\00\", align 1\n@.str2 = private unnamed_addr constant [2 x i8] c\",\\00\", align 1\n@.str3 = private unnamed_addr constant [15 x i8] c\"Main.scuzz:2:3\\00\", align 1\n\ndefine i32 @main(i32 %argc, ptr %argv) {\nentry:\n  %szlocg0 = getelementptr inbounds [15 x i8], ptr @.str3, i64 0, i64 0\n  call void @sz_panic_push_src(ptr %szlocg0)\n  %build_e_arg0_0 = call ptr @sz_list_nil()\n  %build_e_arg0_e1_gep = getelementptr inbounds [2 x i8], ptr @.str1, i64 0, i64 0\n  %build_e_arg0_e1_s = call ptr @sz_string_from_cstr(ptr %build_e_arg0_e1_gep)\n  %build_e_arg0_2 = call ptr @sz_list_cons(ptr %build_e_arg0_e1_s, ptr %build_e_arg0_0)\n  call void @sz_release(ptr %build_e_arg0_0)\n  call void @sz_release(ptr %build_e_arg0_e1_s)\n  %build_e_arg0_e0_gep = getelementptr inbounds [2 x i8], ptr @.str0, i64 0, i64 0\n  %build_e_arg0_e0_s = call ptr @sz_string_from_cstr(ptr %build_e_arg0_e0_gep)\n  %build_e_arg0_1 = call ptr @sz_list_cons(ptr %build_e_arg0_e0_s, ptr %build_e_arg0_2)\n  call void @sz_release(ptr %build_e_arg0_2)\n  call void @sz_release(ptr %build_e_arg0_e0_s)\n  %build_e_arg1_gep = getelementptr inbounds [2 x i8], ptr @.str2, i64 0, i64 0\n  %build_e_arg1_s = call ptr @sz_string_from_cstr(ptr %build_e_arg1_gep)\n  %build_e_v = call ptr @sz_list_join(ptr %build_e_arg0_1, ptr %build_e_arg1_s)\n  call void @sz_release(ptr %build_e_arg0_1)\n  call void @sz_release(ptr %build_e_arg1_s)\n  %build_io = call ptr @sz_io_println(ptr %build_e_v)\n  call void @sz_release(ptr %build_e_v)\n  %rc = call i32 @sz_runtime_main_args(ptr %build_io, i32 %argc, ptr %argv)\n  call void @sz_panic_pop_src()\n  ret i32 %rc\n}"
 
 def srcApply(): String =
   """def applyInt(f: Int => Int, n: Int): Int =
diff --git a/examples/compiler/src/Check.scuzz b/examples/compiler/src/Check.scuzz
index 4f84b39a..220ee07a 100644
--- a/examples/compiler/src/Check.scuzz
+++ b/examples/compiler/src/Check.scuzz
@@ -10,6 +10,7 @@ import Parse.Arm
 import Parse.Bind
 import Parse.Alias
 import Parse.Imp
+import Lexer.lex
 
 def noStr(): List[String] =
   []
@@ -51,8 +52,11 @@ def bindParamsHd(p: Param, rest: List[Param], acc: List[(String, String)]): List
     case Param(n, ty, _, _) => bindParams(rest, (n, ty) :: acc)
   }
 
-def bindLam(p: String, env: List[(String, String)]): List[(String, String)] =
-  if (p == "") env else (p, "Any") :: env
+def bindLam(p: String, ty: String, env: List[(String, String)]): List[(String, String)] =
+  if (p == "") env else (p, if (ty == "") "Any" else ty) :: env
+
+def annOk(ann: String, expect: String, span: (String, Int)): Out =
+  if (ann == "" || tyEq(ann, expect)) ok(expect) else bad(Str.concat("type mismatch: expected ", Str.concat(ann, Str.concat(", got ", expect))), span)
 
 def lookupEnv(env: List[(String, String)], n: String): String =
   if (List.isEmpty(env)) "" else lookupEnv1(List.at(env, 0), List.tail(env), n)
@@ -125,6 +129,110 @@ def stripNamed(e: Expr): Expr =
     case _ => e
   }
 
+def noExpr(): List[Expr] =
+  []
+
+def hasNamedArg(xs: List[Expr]): Bool =
+  !List.isEmpty(xs) && (isNamedArg(List.at(xs, 0)) || hasNamedArg(List.tail(xs)))
+
+def isNamedArg(e: Expr): Bool =
+  e match {
+    case Expr.ENamed(_, _) => true
+    case _ => false
+  }
+
+def dfltExpr(d: String): Expr =
+  dfltExprOf(Parse.parseExprList(lex(d), 0))
+
+def dfltExprOf(p: (Expr, Int)): Expr =
+  p match {
+    case (e, _) => e
+  }
+
+def namedHas(n: String, args: List[Expr]): Bool =
+  !List.isEmpty(args) && namedHas1(List.at(args, 0), List.tail(args), n)
+
+def namedHas1(h: Expr, rest: List[Expr], n: String): Bool =
+  h match {
+    case Expr.ENamed(nm, _) => nm == n || namedHas(n, rest)
+    case _ => namedHas(n, rest)
+  }
+
+def namedLookup(n: String, args: List[Expr]): Expr =
+  if (List.isEmpty(args)) Expr.EUnit else namedLookup1(List.at(args, 0), List.tail(args), n)
+
+def namedLookup1(h: Expr, rest: List[Expr], n: String): Expr =
+  h match {
+    case Expr.ENamed(nm, inner) => if (nm == n) inner else namedLookup(n, rest)
+    case _ => namedLookup(n, rest)
+  }
+
+def paramHasName(ps: List[Param], n: String): Bool =
+  if (List.isEmpty(ps)) false else paramHasName1(List.at(ps, 0), List.tail(ps), n)
+
+def paramHasName1(p: Param, rest: List[Param], n: String): Bool =
+  p match {
+    case Param(nm, _, _, _) => nm == n || paramHasName(rest, n)
+  }
+
+def alignCall(ps: List[Param], args: List[Expr]): (List[Expr], String) =
+  if (List.isEmpty(ps)) (args, "") else alignAfterSplit(ps, alignSplit(args, noExpr(), noExpr(), false))
+
+def alignSplit(args: List[Expr], pos: List[Expr], named: List[Expr], seenN: Bool): (List[Expr], List[Expr], String) =
+  if (List.isEmpty(args)) (List.reverse(pos), List.reverse(named), "") else alignSplit1(List.at(args, 0), List.tail(args), pos, named, seenN)
+
+def alignSplit1(h: Expr, rest: List[Expr], pos: List[Expr], named: List[Expr], seenN: Bool): (List[Expr], List[Expr], String) =
+  h match {
+    case Expr.ENamed(_, _) => alignSplit(rest, pos, h :: named, true)
+    case _ => if (seenN) (List.reverse(pos), List.reverse(named), "positional argument after named argument") else alignSplit(rest, h :: pos, named, false)
+  }
+
+def alignAfterSplit(ps: List[Param], sp: (List[Expr], List[Expr], String)): (List[Expr], String) =
+  sp match {
+    case (pos, named, err) => if (err != "") (noExpr(), err) else alignAfterUnknown(ps, pos, named, alignUnknown(named, ps))
+  }
+
+def alignUnknown(named: List[Expr], ps: List[Param]): String =
+  if (List.isEmpty(named)) "" else alignUnknown1(List.at(named, 0), List.tail(named), ps)
+
+def alignUnknown1(h: Expr, rest: List[Expr], ps: List[Param]): String =
+  h match {
+    case Expr.ENamed(nm, _) => if (paramHasName(ps, nm)) alignUnknown(rest, ps) else Str.concat("unknown argument ", nm)
+    case _ => alignUnknown(rest, ps)
+  }
+
+def alignAfterUnknown(ps: List[Param], pos: List[Expr], named: List[Expr], err: String): (List[Expr], String) =
+  if (err != "") (noExpr(), err) else alignFillPs(ps, pos, named, 0, noExpr())
+
+def alignFillPs(ps: List[Param], pos: List[Expr], named: List[Expr], i: Int, acc: List[Expr]): (List[Expr], String) =
+  if (List.isEmpty(ps)) alignDone(pos, i, acc) else alignFillHd(List.at(ps, 0), List.tail(ps), pos, named, i, acc)
+
+def alignDone(pos: List[Expr], i: Int, acc: List[Expr]): (List[Expr], String) =
+  if (i < List.len(pos)) (List.reverse(acc), "too many arguments") else (List.reverse(acc), "")
+
+def alignFillHd(p: Param, rest: List[Param], pos: List[Expr], named: List[Expr], i: Int, acc: List[Expr]): (List[Expr], String) =
+  p match {
+    case Param(n, _, _, d) => alignFillOne(n, d, rest, pos, named, i, acc)
+  }
+
+def alignFillOne(n: String, d: String, rest: List[Param], pos: List[Expr], named: List[Expr], i: Int, acc: List[Expr]): (List[Expr], String) =
+  if (i < List.len(pos)) alignFillPos(n, rest, pos, named, i, acc) else alignFillNamed(n, d, rest, pos, named, i, acc)
+
+def alignFillPos(n: String, rest: List[Param], pos: List[Expr], named: List[Expr], i: Int, acc: List[Expr]): (List[Expr], String) =
+  if (namedHas(n, named)) (noExpr(), Str.concat("duplicate argument ", n)) else alignFillPs(rest, pos, named, i + 1, List.at(pos, i) :: acc)
+
+def alignFillNamed(n: String, d: String, rest: List[Param], pos: List[Expr], named: List[Expr], i: Int, acc: List[Expr]): (List[Expr], String) =
+  if (namedHas(n, named)) alignFillPs(rest, pos, named, i, namedLookup(n, named) :: acc) else alignFillDflt(n, d, rest, pos, named, i, acc)
+
+def alignFillDflt(n: String, d: String, rest: List[Param], pos: List[Expr], named: List[Expr], i: Int, acc: List[Expr]): (List[Expr], String) =
+  if (d != "") alignFillPs(rest, pos, named, i, dfltExpr(d) :: acc) else (noExpr(), Str.concat("missing argument ", n))
+
+def alignErr(f: String, err: String, ps: List[Param], args: List[Expr]): String =
+  if (arityErr(err, args)) Str.concat(f, Str.concat(" expects ", Str.concat(Str.fromInt(List.len(ps)), Str.concat(" args, got ", Str.fromInt(List.len(args)))))) else err
+
+def arityErr(err: String, args: List[Expr]): Bool =
+  (err == "too many arguments" || Str.startsWith(err, "missing argument ")) && !hasNamedArg(args)
+
 def isKit(f: String): Bool =
   isKitA(f) || isKitB(f) || isKitC(f) || isKitD(f) || isKitE(f) || isKitF(f) || isKitG(f)
 
@@ -132,13 +240,13 @@ def isKitA(f: String): Bool =
   f == "Str.fromInt" || f == "Str.concat" || f == "Str.len" || f == "Str.byteLen" || f == "Str.byteSlice" || f == "Str.fromBool" || f == "Str.charAt" || f == "Str.slice" || f == "Str.toInt" || f == "Str.repeat" || f == "List.len" || f == "List.concat" || f == "List.reverse" || f == "List.head" || f == "List.tail" || f == "List.isEmpty" || f == "List.cons" || f == "List.at" || f == "List.join" || f == "List.take" || f == "List.drop" || f == "List.takeRight" || f == "List.dropRight" || f == "List.init" || f == "List.last" || f == "List.flatten"
 
 def isKitB(f: String): Bool =
-  f == "Builder.empty" || f == "Builder.append" || f == "Builder.result" || f == "Fs.read" || f == "Fs.write" || f == "Fs.list" || f == "Fs.mkdirs" || f == "Sys.args" || f == "Sys.getenv" || f == "Sys.write" || f == "Sys.read" || f == "Sys.readLine" || f == "Sys.spawn" || f == "Sys.alive" || f == "Sys.kill" || f == "Impurity.runKit" || f == "IO.pure" || f == "IO.println" || f == "Clock.monotonic" || f == "Clock.realTime" || f == "Map.empty" || f == "Map.set" || f == "Map.keys" || f == "Map.values" || f == "Map.size" || f == "Map.contains" || f == "Map.getOrElse" || f == "Map.remove" || f == "Map.toList"
+  f == "Builder.empty" || f == "Builder.append" || f == "Builder.result" || f == "Fs.read" || f == "Fs.write" || f == "Fs.list" || f == "Fs.mkdirs" || f == "Sys.args" || f == "Sys.getenv" || f == "Sys.write" || f == "Sys.read" || f == "Sys.readLine" || f == "Sys.spawn" || f == "Sys.exec" || f == "Sys.alive" || f == "Sys.kill" || f == "Impurity.runKit" || f == "IO.pure" || f == "IO.println" || f == "Clock.monotonic" || f == "Clock.realTime" || f == "Map.empty" || f == "Map.set" || f == "Map.keys" || f == "Map.values" || f == "Map.size" || f == "Map.contains" || f == "Map.get" || f == "Map.getOrElse" || f == "Map.remove" || f == "Map.toList"
 
 def isKitC(f: String): Bool =
-  f == "Set.empty" || f == "Set.add" || f == "Set.toList" || f == "Set.size" || f == "Set.contains" || f == "Set.remove" || f == "Set.union" || f == "Set.intersect" || f == "Set.diff" || f == "Json.keys" || f == "Json.get" || f == "Json.has" || f == "Json.parse" || f == "Json.getStr" || f == "Json.getBool" || f == "Json.getInt" || f == "Json.intOr" || f == "Json.arr" || f == "Json.at" || f == "Json.isNull" || f == "Json.isObj" || f == "Json.isArr" || f == "Json.pairs" || f == "Json.set" || f == "Json.remove" || f == "Json.append" || f == "Json.prepend" || f == "Json.setAt" || f == "Json.dropAt" || f == "Json.merge" || f == "Json.Int" || f == "Json.Null" || f == "Json.asInt" || f == "Json.asBool" || f == "Json.asStr" || f == "Json.asFloat" || f == "Json.Float" || f == "Json.floatOr" || f == "Json.Obj" || f == "Json.Str" || f == "Json.Bool" || f == "Json.Arr" || isSysProc(f)
+  f == "Set.empty" || f == "Set.add" || f == "Set.toList" || f == "Set.size" || f == "Set.contains" || f == "Set.remove" || f == "Set.union" || f == "Set.intersect" || f == "Set.diff" || f == "Json.keys" || f == "Json.get" || f == "Json.has" || f == "Json.parse" || f == "Json.stringify" || f == "Json.getStr" || f == "Json.getBool" || f == "Json.getInt" || f == "Json.getFloat" || f == "Json.intOr" || f == "Json.boolOr" || f == "Json.strOr" || f == "Json.arr" || f == "Json.at" || f == "Json.isNull" || f == "Json.isObj" || f == "Json.isArr" || f == "Json.isBool" || f == "Json.isInt" || f == "Json.isStr" || f == "Json.isFloat" || f == "Json.pairs" || f == "Json.set" || f == "Json.remove" || f == "Json.append" || f == "Json.prepend" || f == "Json.setAt" || f == "Json.dropAt" || f == "Json.merge" || f == "Json.Int" || f == "Json.Null" || f == "Json.asInt" || f == "Json.asBool" || f == "Json.asStr" || f == "Json.asFloat" || f == "Json.Float" || f == "Json.floatOr" || f == "Json.Obj" || f == "Json.Str" || f == "Json.Bool" || f == "Json.Arr" || isSysProc(f)
 
 def isKitD(f: String): Bool =
-  f == "Str.startsWith" || f == "Str.endsWith" || f == "Str.contains" || f == "Str.eq" || f == "Str.isEmpty" || f == "Str.nonEmpty" || f == "Str.isBlank" || f == "Str.lines" || f == "Str.trim" || f == "Str.indexOf" || f == "Str.lastIndexOf" || f == "Str.take" || f == "Str.drop" || f == "Str.takeRight" || f == "Str.dropRight" || f == "Str.stripPrefix" || f == "Str.stripSuffix" || f == "Str.split" || f == "Fs.join" || f == "Fs.dirname" || f == "Fs.basename"
+  f == "Str.startsWith" || f == "Str.endsWith" || f == "Str.contains" || f == "Str.eq" || f == "Str.isEmpty" || f == "Str.nonEmpty" || f == "Str.isBlank" || f == "Str.lines" || f == "Str.trim" || f == "Str.indexOf" || f == "Str.lastIndexOf" || f == "Str.take" || f == "Str.drop" || f == "Str.takeRight" || f == "Str.dropRight" || f == "Str.stripPrefix" || f == "Str.stripSuffix" || f == "Str.split" || f == "Str.reverse" || f == "Str.toLower" || f == "Str.toUpper" || f == "Str.capitalize" || f == "Str.padLeft" || f == "Str.padRight" || f == "Str.replace" || f == "Fs.join" || f == "Fs.dirname" || f == "Fs.basename"
 
 def isKitE(f: String): Bool =
   f == "Fs.exists" || f == "Fs.delete" || f == "Fs.walk" || f == "Fs.canonicalize" || f == "Fs.rename" || f == "Random.nextInt" || f == "Sys.childWrite" || f == "Sys.childRead" || f == "Sys.childClose"
@@ -147,7 +255,7 @@ def isKitF(f: String): Bool =
   isNetHttp(f) || isNetServe(f) || isNetTcp(f) || isNetUdp(f)
 
 def isKitG(f: String): Bool =
-  f == "Timeline.signalInt" || f == "Timeline.signalListLen" || f == "Timeline.signalStrHas" || f == "Property.signalInt" || f == "Property.signalStr" || f == "Property.signalListLen" || f == "Property.signalListAt" || f == "Verdict.alwaysHas" || f == "Verdict.afterHit"
+  f == "Timeline.signalInt" || f == "Timeline.signalListLen" || f == "Timeline.signalStrHas" || f == "Property.signalInt" || f == "Property.signalStr" || f == "Property.signalListLen" || f == "Property.signalListAt" || f == "Verdict.alwaysHas" || f == "Verdict.afterHit" || f == "Resource.make" || f == "Resource.use" || f == "Deferred.empty" || f == "Deferred.get" || f == "Deferred.complete" || f == "Deferred.fail"
 
 def isNetHttp(f: String): Bool =
   f == "Net.httpGet" || f == "Net.httpPost" || f == "Net.httpPut" || f == "Net.httpPatch" || f == "Net.httpDelete" || f == "Net.httpHead"
@@ -162,22 +270,46 @@ def isNetUdp(f: String): Bool =
   f == "Net.udpBind" || f == "Net.udpSend" || f == "Net.udpRecv" || f == "Net.udpClose"
 
 def isSysProc(f: String): Bool =
-  Str.startsWith(f, "Sys.e") && f != "Sys.error"
+  f == "Sys.exec"
 
 def kitParams(f: String): List[String] =
-  if (f == "Str.fromInt") "Int" :: noStr() else if (f == "Str.concat") "String" :: "String" :: noStr() else if (f == "Str.len") "String" :: noStr() else if (f == "Str.fromBool") "Bool" :: noStr() else if (f == "Str.charAt") "String" :: "Int" :: noStr() else if (f == "Str.slice") "String" :: "Int" :: "Int" :: noStr() else if (f == "Str.toInt") "String" :: "Int" :: noStr() else if (f == "Str.repeat") "String" :: "Int" :: noStr() else if (f == "Str.startsWith" || f == "Str.endsWith" || f == "Str.contains" || f == "Str.eq" || f == "Str.indexOf" || f == "Str.lastIndexOf") "String" :: "String" :: noStr() else if (f == "Str.isEmpty" || f == "Str.nonEmpty" || f == "Str.isBlank" || f == "Str.lines" || f == "Str.trim" || f == "Str.byteLen") "String" :: noStr() else if (f == "Str.take" || f == "Str.drop" || f == "Str.takeRight" || f == "Str.dropRight") "String" :: "Int" :: noStr() else if (f == "Str.byteSlice") "String" :: "Int" :: "Int" :: noStr() else if (f == "Str.stripPrefix" || f == "Str.stripSuffix" || f == "Str.split" || f == "Fs.join") "String" :: "String" :: noStr() else if (f == "Fs.dirname" || f == "Fs.basename") "String" :: noStr() else if (f == "List.len" || f == "List.reverse" || f == "List.head" || f == "List.tail" || f == "List.isEmpty" || f == "List.init" || f == "List.last" || f == "List.flatten") "List" :: noStr() else if (f == "List.concat") "List" :: "List" :: noStr() else if (f == "List.join") "Any" :: "String" :: noStr() else if (f == "List.cons") "Any" :: "List" :: noStr() else if (f == "List.at" || f == "List.take" || f == "List.drop" || f == "List.takeRight" || f == "List.dropRight") "List" :: "Int" :: noStr() else if (f == "Builder.empty" || f == "Clock.monotonic" || f == "Clock.realTime" || f == "Map.empty" || f == "Set.empty" || f == "Impurity.runKit" || f == "Sys.readLine") noStr() else if (f == "Sys.read" || f == "Sys.alive" || f == "Sys.kill" || f == "Sys.childClose" || f == "Random.nextInt") "Int" :: noStr() else if (f == "Sys.spawn") "String" :: noStr() else if (f == "Builder.append") "Builder" :: "String" :: noStr() else if (f == "Builder.result") "Builder" :: noStr() else if (f == "Fs.read" || f == "Fs.list" || f == "Fs.mkdirs" || f == "Fs.exists" || f == "Fs.delete" || f == "Fs.walk" || f == "Fs.canonicalize" || f == "Sys.getenv" || f == "Sys.write" || isSysProc(f)) "String" :: noStr() else if (f == "Fs.write" || f == "Fs.rename") "String" :: "String" :: noStr() else if (f == "IO.pure") "Any" :: noStr() else kitParams2(f)
+  if (f == "Str.fromInt") "Int" :: noStr() else if (f == "Str.concat") "String" :: "String" :: noStr() else if (f == "Str.len") "String" :: noStr() else if (f == "Str.fromBool") "Bool" :: noStr() else if (f == "Str.charAt") "String" :: "Int" :: noStr() else if (f == "Str.slice") "String" :: "Int" :: "Int" :: noStr() else if (f == "Str.toInt") "String" :: "Int" :: noStr() else if (f == "Str.repeat") "String" :: "Int" :: noStr() else if (f == "Str.startsWith" || f == "Str.endsWith" || f == "Str.contains" || f == "Str.eq" || f == "Str.indexOf" || f == "Str.lastIndexOf") "String" :: "String" :: noStr() else if (f == "Str.isEmpty" || f == "Str.nonEmpty" || f == "Str.isBlank" || f == "Str.lines" || f == "Str.trim" || f == "Str.byteLen" || f == "Str.reverse" || f == "Str.toLower" || f == "Str.toUpper" || f == "Str.capitalize") "String" :: noStr() else if (f == "Str.take" || f == "Str.drop" || f == "Str.takeRight" || f == "Str.dropRight") "String" :: "Int" :: noStr() else if (f == "Str.byteSlice") "String" :: "Int" :: "Int" :: noStr() else if (f == "Str.padLeft" || f == "Str.padRight") "String" :: "Int" :: "String" :: noStr() else if (f == "Str.replace") "String" :: "String" :: "String" :: noStr() else if (f == "Str.stripPrefix" || f == "Str.stripSuffix" || f == "Str.split" || f == "Fs.join") "String" :: "String" :: noStr() else if (f == "Fs.dirname" || f == "Fs.basename") "String" :: noStr() else if (f == "List.len" || f == "List.reverse" || f == "List.head" || f == "List.tail" || f == "List.isEmpty" || f == "List.init" || f == "List.last" || f == "List.flatten") "List" :: noStr() else if (f == "List.concat") "List" :: "List" :: noStr() else if (f == "List.join") "List[String]" :: "String" :: noStr() else if (f == "List.cons") "Any" :: "List" :: noStr() else if (f == "List.at" || f == "List.take" || f == "List.drop" || f == "List.takeRight" || f == "List.dropRight") "List" :: "Int" :: noStr() else if (f == "Builder.empty" || f == "Clock.monotonic" || f == "Clock.realTime" || f == "Map.empty" || f == "Set.empty" || f == "Impurity.runKit" || f == "Sys.readLine") noStr() else if (f == "Sys.read" || f == "Sys.alive" || f == "Sys.kill" || f == "Sys.childClose" || f == "Random.nextInt") "Int" :: noStr() else if (f == "Sys.spawn") "String" :: noStr() else if (f == "Builder.append") "Builder" :: "String" :: noStr() else if (f == "Builder.result") "Builder" :: noStr() else if (f == "Fs.read" || f == "Fs.list" || f == "Fs.mkdirs" || f == "Fs.exists" || f == "Fs.delete" || f == "Fs.walk" || f == "Fs.canonicalize" || f == "Sys.getenv" || f == "Sys.write" || isSysProc(f)) "String" :: noStr() else if (f == "Fs.write" || f == "Fs.rename") "String" :: "String" :: noStr() else if (f == "IO.pure") "Any" :: noStr() else kitParams2(f)
 
 def kitParams2(f: String): List[String] =
-  if (f == "Sys.childWrite") "Int" :: "String" :: noStr() else if (f == "Sys.childRead") "Int" :: "Int" :: noStr() else if (f == "IO.println") "String" :: noStr() else if (f == "Map.set") "Map" :: "String" :: "Any" :: noStr() else if (f == "Map.keys" || f == "Map.values" || f == "Map.size" || f == "Map.toList") "Map" :: noStr() else if (f == "Map.contains" || f == "Map.remove") "Map" :: "String" :: noStr() else if (f == "Map.getOrElse") "Map" :: "String" :: "Any" :: noStr() else if (f == "Set.add" || f == "Set.contains" || f == "Set.remove") "Set" :: "String" :: noStr() else if (f == "Set.toList" || f == "Set.size") "Set" :: noStr() else if (f == "Set.union" || f == "Set.intersect" || f == "Set.diff") "Set" :: "Set" :: noStr() else if (f == "Json.keys" || f == "Json.parse" || f == "Json.arr" || f == "Json.pairs" || f == "Json.isNull" || f == "Json.isObj" || f == "Json.isArr" || f == "Json.asInt" || f == "Json.asBool" || f == "Json.asStr" || f == "Json.asFloat") "Any" :: noStr() else if (f == "Json.get" || f == "Json.has" || f == "Json.remove") "Any" :: "String" :: noStr() else if (f == "Json.getStr") "Any" :: "String" :: "String" :: noStr() else if (f == "Json.getBool") "Any" :: "String" :: "Bool" :: noStr() else if (f == "Json.getInt") "Any" :: "String" :: "Int" :: noStr() else if (f == "Json.intOr" || f == "Json.at" || f == "Json.dropAt") "Any" :: "Int" :: noStr() else if (f == "Json.set") "Any" :: "String" :: "Any" :: noStr() else if (f == "Json.append" || f == "Json.prepend" || f == "Json.merge") "Any" :: "Any" :: noStr() else if (f == "Json.setAt") "Any" :: "Int" :: "Any" :: noStr() else if (f == "Json.Int") "Int" :: noStr() else if (f == "Json.Float") "Float" :: noStr() else if (f == "Json.floatOr") "Any" :: "Float" :: noStr() else if (f == "Json.Obj" || f == "Json.Arr") "List" :: noStr() else if (f == "Json.Str") "String" :: noStr() else if (f == "Json.Bool") "Bool" :: noStr() else if (f == "Json.Null") noStr() else kitParams3(f)
+  if (f == "Sys.childWrite") "Int" :: "String" :: noStr() else if (f == "Sys.childRead") "Int" :: "Int" :: noStr() else if (f == "IO.println") "String" :: noStr() else if (f == "Map.set") "Map" :: "String" :: "Any" :: noStr() else if (f == "Map.keys" || f == "Map.values" || f == "Map.size" || f == "Map.toList") "Map" :: noStr() else if (f == "Map.contains" || f == "Map.remove" || f == "Map.get") "Map" :: "String" :: noStr() else if (f == "Map.getOrElse") "Map" :: "String" :: "Any" :: noStr() else if (f == "Set.add" || f == "Set.remove") "Set" :: "String" :: noStr() else if (f == "Set.contains") "Set" :: "Any" :: noStr() else if (f == "Set.toList" || f == "Set.size") "Set" :: noStr() else if (f == "Set.union" || f == "Set.intersect" || f == "Set.diff") "Set" :: "Set" :: noStr() else if (f == "Json.parse") "String" :: noStr() else if (f == "Json.keys" || f == "Json.stringify" || f == "Json.arr" || f == "Json.pairs" || f == "Json.isNull" || f == "Json.isObj" || f == "Json.isArr" || f == "Json.isBool" || f == "Json.isInt" || f == "Json.isStr" || f == "Json.isFloat" || f == "Json.asInt" || f == "Json.asBool" || f == "Json.asStr" || f == "Json.asFloat") "Any" :: noStr() else if (f == "Json.get" || f == "Json.has" || f == "Json.remove" || f == "Json.strOr") "Any" :: "String" :: noStr() else if (f == "Json.getStr") "Any" :: "String" :: "String" :: noStr() else if (f == "Json.getBool") "Any" :: "String" :: "Bool" :: noStr() else if (f == "Json.getInt") "Any" :: "String" :: "Int" :: noStr() else if (f == "Json.getFloat") "Any" :: "String" :: "Float" :: noStr() else if (f == "Json.intOr" || f == "Json.at" || f == "Json.dropAt") "Any" :: "Int" :: noStr() else if (f == "Json.boolOr") "Any" :: "Bool" :: noStr() else if (f == "Json.set") "Any" :: "String" :: "Any" :: noStr() else if (f == "Json.append" || f == "Json.prepend" || f == "Json.merge") "Any" :: "Any" :: noStr() else if (f == "Json.setAt") "Any" :: "Int" :: "Any" :: noStr() else if (f == "Json.Int") "Int" :: noStr() else if (f == "Json.Float") "Float" :: noStr() else if (f == "Json.floatOr") "Any" :: "Float" :: noStr() else if (f == "Json.Obj" || f == "Json.Arr") "List" :: noStr() else if (f == "Json.Str") "String" :: noStr() else if (f == "Json.Bool") "Bool" :: noStr() else if (f == "Json.Null") noStr() else kitParams3(f)
 
 def kitParams3(f: String): List[String] =
   if (f == "Net.httpGet" || f == "Net.httpDelete" || f == "Net.httpHead") "String" :: noStr() else if (f == "Net.httpPost" || f == "Net.httpPut" || f == "Net.httpPatch") "String" :: "String" :: noStr() else if (f == "Net.serve" || f == "Net.serveOnce") "Int" :: "Any" :: noStr() else if (f == "Net.tcpConnect") "String" :: "Int" :: noStr() else if (f == "Net.tcpListen" || f == "Net.udpBind") "Int" :: noStr() else if (f == "Net.tcpAccept" || f == "Net.tcpClose" || f == "Net.udpClose") "Any" :: noStr() else if (f == "Net.tcpRead" || f == "Net.udpRecv") "Any" :: "Int" :: noStr() else if (f == "Net.tcpWrite") "Any" :: "String" :: noStr() else if (f == "Net.udpSend") "Any" :: "String" :: "Int" :: "String" :: noStr() else kitParams4(f)
 
 def kitParams4(f: String): List[String] =
-  if (f == "Timeline.signalInt" || f == "Timeline.signalListLen") "Timeline" :: "Int" :: "String" :: noStr() else if (f == "Timeline.signalStrHas") "Timeline" :: "Int" :: "String" :: "String" :: noStr() else if (f == "Property.signalInt" || f == "Property.signalStr" || f == "Property.signalListLen") "String" :: noStr() else if (f == "Property.signalListAt") "String" :: "Int" :: noStr() else if (f == "Verdict.alwaysHas") "Timeline" :: "String" :: noStr() else if (f == "Verdict.afterHit") "Timeline" :: "String" :: "String" :: noStr() else noStr()
+  if (f == "Timeline.signalInt" || f == "Timeline.signalListLen") "Timeline" :: "Int" :: "String" :: noStr() else if (f == "Timeline.signalStrHas") "Timeline" :: "Int" :: "String" :: "String" :: noStr() else if (f == "Property.signalInt" || f == "Property.signalStr" || f == "Property.signalListLen") "String" :: noStr() else if (f == "Property.signalListAt") "String" :: "Int" :: noStr() else if (f == "Verdict.alwaysHas") "Timeline" :: "String" :: noStr() else if (f == "Verdict.afterHit") "Timeline" :: "String" :: "String" :: noStr() else if (f == "Resource.make") "IO" :: "Any" :: noStr() else if (f == "Resource.use") "Resource" :: "Any" :: noStr() else if (f == "Deferred.empty") noStr() else if (f == "Deferred.get") "Deferred" :: noStr() else if (f == "Deferred.complete") "Deferred" :: "Any" :: noStr() else if (f == "Deferred.fail") "Deferred" :: "String" :: noStr() else noStr()
+
+def kitNames(): List[String] =
+  List.concat(kitNamesA(), List.concat(kitNamesB(), List.concat(kitNamesC(), List.concat(kitNamesD(), List.concat(kitNamesE(), List.concat(kitNamesF(), kitNamesG()))))))
+
+def kitNamesA(): List[String] =
+  "Str.fromInt" :: "Str.concat" :: "Str.len" :: "Str.byteLen" :: "Str.byteSlice" :: "Str.fromBool" :: "Str.charAt" :: "Str.slice" :: "Str.toInt" :: "Str.repeat" :: "List.len" :: "List.concat" :: "List.reverse" :: "List.head" :: "List.tail" :: "List.isEmpty" :: "List.cons" :: "List.at" :: "List.join" :: "List.take" :: "List.drop" :: "List.takeRight" :: "List.dropRight" :: "List.init" :: "List.last" :: "List.flatten" :: noStr()
+
+def kitNamesB(): List[String] =
+  "Builder.empty" :: "Builder.append" :: "Builder.result" :: "Fs.read" :: "Fs.write" :: "Fs.list" :: "Fs.mkdirs" :: "Sys.args" :: "Sys.getenv" :: "Sys.write" :: "Sys.read" :: "Sys.readLine" :: "Sys.spawn" :: "Sys.exec" :: "Sys.alive" :: "Sys.kill" :: "Impurity.runKit" :: "IO.pure" :: "IO.println" :: "Clock.monotonic" :: "Clock.realTime" :: "Map.empty" :: "Map.set" :: "Map.keys" :: "Map.values" :: "Map.size" :: "Map.contains" :: "Map.get" :: "Map.getOrElse" :: "Map.remove" :: "Map.toList" :: noStr()
+
+def kitNamesC(): List[String] =
+  "Set.empty" :: "Set.add" :: "Set.toList" :: "Set.size" :: "Set.contains" :: "Set.remove" :: "Set.union" :: "Set.intersect" :: "Set.diff" :: "Json.keys" :: "Json.get" :: "Json.has" :: "Json.parse" :: "Json.stringify" :: "Json.getStr" :: "Json.getBool" :: "Json.getInt" :: "Json.getFloat" :: "Json.intOr" :: "Json.boolOr" :: "Json.strOr" :: "Json.arr" :: "Json.at" :: "Json.isNull" :: "Json.isObj" :: "Json.isArr" :: "Json.isBool" :: "Json.isInt" :: "Json.isStr" :: "Json.isFloat" :: "Json.pairs" :: "Json.set" :: "Json.remove" :: "Json.append" :: "Json.prepend" :: "Json.setAt" :: "Json.dropAt" :: "Json.merge" :: "Json.Int" :: "Json.Null" :: "Json.asInt" :: "Json.asBool" :: "Json.asStr" :: "Json.asFloat" :: "Json.Float" :: "Json.floatOr" :: "Json.Obj" :: "Json.Str" :: "Json.Bool" :: "Json.Arr" :: noStr()
+
+def kitNamesD(): List[String] =
+  "Str.startsWith" :: "Str.endsWith" :: "Str.contains" :: "Str.eq" :: "Str.isEmpty" :: "Str.nonEmpty" :: "Str.isBlank" :: "Str.lines" :: "Str.trim" :: "Str.indexOf" :: "Str.lastIndexOf" :: "Str.take" :: "Str.drop" :: "Str.takeRight" :: "Str.dropRight" :: "Str.stripPrefix" :: "Str.stripSuffix" :: "Str.split" :: "Str.reverse" :: "Str.toLower" :: "Str.toUpper" :: "Str.capitalize" :: "Str.padLeft" :: "Str.padRight" :: "Str.replace" :: "Fs.join" :: "Fs.dirname" :: "Fs.basename" :: noStr()
+
+def kitNamesE(): List[String] =
+  "Fs.exists" :: "Fs.delete" :: "Fs.walk" :: "Fs.canonicalize" :: "Fs.rename" :: "Random.nextInt" :: "Sys.childWrite" :: "Sys.childRead" :: "Sys.childClose" :: noStr()
+
+def kitNamesF(): List[String] =
+  "Net.httpGet" :: "Net.httpPost" :: "Net.httpPut" :: "Net.httpPatch" :: "Net.httpDelete" :: "Net.httpHead" :: "Net.serve" :: "Net.serveOnce" :: "Net.tcpConnect" :: "Net.tcpListen" :: "Net.tcpAccept" :: "Net.tcpRead" :: "Net.tcpWrite" :: "Net.tcpClose" :: "Net.udpBind" :: "Net.udpSend" :: "Net.udpRecv" :: "Net.udpClose" :: noStr()
+
+def kitNamesG(): List[String] =
+  "Timeline.signalInt" :: "Timeline.signalListLen" :: "Timeline.signalStrHas" :: "Property.signalInt" :: "Property.signalStr" :: "Property.signalListLen" :: "Property.signalListAt" :: "Verdict.alwaysHas" :: "Verdict.afterHit" :: "Resource.make" :: "Resource.use" :: "Deferred.empty" :: "Deferred.get" :: "Deferred.complete" :: "Deferred.fail" :: noStr()
 
 def kitRet(f: String): String =
-  if (f == "Timeline.signalInt" || f == "Timeline.signalListLen" || f == "Property.signalInt" || f == "Property.signalListLen") "Int" else if (f == "Timeline.signalStrHas") "Bool" else if (f == "Property.signalStr" || f == "Property.signalListAt") "String" else if (f == "Verdict.alwaysHas" || f == "Verdict.afterHit") "Verdict" else if (f == "Str.len" || f == "Str.byteLen" || f == "List.len" || f == "Str.charAt" || f == "Str.toInt" || f == "Str.indexOf" || f == "Str.lastIndexOf" || f == "Map.size" || f == "Set.size" || f == "Json.getInt" || f == "Json.intOr") "Int" else if (f == "List.head") "Option" else if (f == "List.at" || f == "List.last" || f == "Map.getOrElse") "Any" else if (f == "List.isEmpty" || f == "Map.contains" || f == "Set.contains" || f == "Json.has" || f == "Json.getBool" || f == "Json.isNull" || f == "Json.isObj" || f == "Json.isArr" || f == "Str.startsWith" || f == "Str.endsWith" || f == "Str.contains" || f == "Str.eq" || f == "Str.isEmpty" || f == "Str.nonEmpty" || f == "Str.isBlank") "Bool" else if (f == "List.concat" || f == "List.reverse" || f == "List.tail" || f == "List.cons" || f == "List.take" || f == "List.drop" || f == "List.takeRight" || f == "List.dropRight" || f == "List.init" || f == "List.flatten" || f == "Str.lines" || f == "Str.split") "List" else if (f == "Json.floatOr" || f == "Json.Float" || f == "Json.asFloat") "Float" else if (f == "Map.keys" || f == "Map.values" || f == "Map.toList" || f == "Set.toList" || f == "Json.keys" || f == "Json.arr" || f == "Json.at" || f == "Json.pairs" || f == "Json.asInt" || f == "Json.asBool" || f == "Json.asStr" || f == "Json.asFloat") "List" else if (f == "Builder.empty" || f == "Builder.append") "Builder" else if (f == "Fs.read" || f == "Sys.getenv" || f == "Sys.read" || f == "Sys.readLine" || f == "Fs.canonicalize" || f == "Sys.childRead" || isNetHttp(f) || f == "Net.tcpRead") "IO[String]" else if (f == "Fs.write" || f == "Fs.mkdirs" || f == "Fs.delete" || f == "Fs.rename" || f == "Impurity.runKit" || f == "Sys.write" || f == "Sys.kill" || f == "Sys.childWrite" || f == "Sys.childClose" || f == "IO.println" || isNetServe(f) || f == "Net.tcpWrite" || f == "Net.tcpClose" || f == "Net.udpSend" || f == "Net.udpClose") "IO[Unit]" else if (f == "Fs.list" || f == "Fs.walk") "IO[List[(String, Bool)]]" else if (f == "Sys.args") "IO[List[String]]" else if (f == "Sys.spawn" || f == "Sys.alive" || f == "Fs.exists" || f == "Random.nextInt") "IO[Int]" else if (isSysProc(f)) "IO[(Int, String, String)]" else if (f == "Net.udpRecv") "IO[(String, Int, String)]" else if (f == "Net.tcpConnect" || f == "Net.tcpListen" || f == "Net.tcpAccept" || f == "Net.udpBind") "IO[Any]" else if (f == "IO.pure") "IO[Any]" else if (f == "Clock.monotonic" || f == "Clock.realTime") "IO[Int]" else if (f == "Map.empty" || f == "Map.set" || f == "Map.remove") "Map" else if (f == "Set.empty" || f == "Set.add" || f == "Set.remove" || f == "Set.union" || f == "Set.intersect" || f == "Set.diff") "Set" else if (f == "Json.parse" || f == "Json.get" || f == "Json.set" || f == "Json.remove" || f == "Json.append" || f == "Json.prepend" || f == "Json.setAt" || f == "Json.dropAt" || f == "Json.merge" || f == "Json.Int" || f == "Json.Null" || f == "Json.Float" || f == "Json.Obj" || f == "Json.Str" || f == "Json.Bool" || f == "Json.Arr") "Any" else "Any"
+  if (f == "Timeline.signalInt" || f == "Timeline.signalListLen" || f == "Property.signalInt" || f == "Property.signalListLen") "Int" else if (f == "Timeline.signalStrHas") "Bool" else if (f == "Property.signalStr" || f == "Property.signalListAt" || f == "List.join" || f == "Json.getStr" || f == "Json.strOr") "String" else if (f == "Verdict.alwaysHas" || f == "Verdict.afterHit") "Verdict" else if (f == "Str.len" || f == "Str.byteLen" || f == "List.len" || f == "Str.charAt" || f == "Str.toInt" || f == "Str.indexOf" || f == "Str.lastIndexOf" || f == "Map.size" || f == "Set.size" || f == "Json.getInt" || f == "Json.intOr") "Int" else if (f == "List.head" || f == "Map.get") "Option" else if (f == "List.at" || f == "Map.getOrElse") "Any" else if (f == "List.isEmpty" || f == "Map.contains" || f == "Set.contains" || f == "Json.has" || f == "Json.getBool" || f == "Json.boolOr" || f == "Json.isNull" || f == "Json.isObj" || f == "Json.isArr" || f == "Json.isBool" || f == "Json.isInt" || f == "Json.isStr" || f == "Json.isFloat" || f == "Str.startsWith" || f == "Str.endsWith" || f == "Str.contains" || f == "Str.eq" || f == "Str.isEmpty" || f == "Str.nonEmpty" || f == "Str.isBlank") "Bool" else if (f == "List.concat" || f == "List.reverse" || f == "List.tail" || f == "List.cons" || f == "List.take" || f == "List.drop" || f == "List.takeRight" || f == "List.dropRight" || f == "List.init" || f == "List.last" || f == "List.flatten" || f == "Str.lines" || f == "Str.split") "List" else if (f == "Json.floatOr" || f == "Json.Float" || f == "Json.getFloat") "Float" else if (f == "Map.keys" || f == "Map.values" || f == "Map.toList" || f == "Set.toList" || f == "Json.keys" || f == "Json.arr" || f == "Json.at" || f == "Json.pairs" || f == "Json.asInt" || f == "Json.asBool" || f == "Json.asStr" || f == "Json.asFloat") "List" else if (f == "Builder.empty" || f == "Builder.append") "Builder" else if (f == "Fs.read" || f == "Sys.getenv" || f == "Sys.read" || f == "Sys.readLine" || f == "Fs.canonicalize" || f == "Sys.childRead" || isNetHttp(f) || f == "Net.tcpRead") "IO[String]" else if (f == "Fs.write" || f == "Fs.mkdirs" || f == "Fs.delete" || f == "Fs.rename" || f == "Impurity.runKit" || f == "Sys.write" || f == "Sys.kill" || f == "Sys.childWrite" || f == "Sys.childClose" || f == "IO.println" || isNetServe(f) || f == "Net.tcpWrite" || f == "Net.tcpClose" || f == "Net.udpSend" || f == "Net.udpClose") "IO[Unit]" else if (f == "Fs.list" || f == "Fs.walk") "IO[List[(String, Bool)]]" else if (f == "Sys.args") "IO[List[String]]" else if (f == "Sys.spawn" || f == "Sys.alive" || f == "Fs.exists" || f == "Random.nextInt") "IO[Int]" else if (isSysProc(f)) "IO[(Int, String, String)]" else if (f == "Net.udpRecv") "IO[(String, Int, String)]" else if (f == "Net.tcpConnect" || f == "Net.tcpListen" || f == "Net.tcpAccept" || f == "Net.udpBind") "IO[Any]" else if (f == "IO.pure") "IO[Any]" else if (f == "Clock.monotonic" || f == "Clock.realTime") "IO[Int]" else if (f == "Map.empty" || f == "Map.set" || f == "Map.remove") "Map" else if (f == "Set.empty" || f == "Set.add" || f == "Set.remove" || f == "Set.union" || f == "Set.intersect" || f == "Set.diff") "Set" else if (f == "Json.parse" || f == "Json.stringify") "Result" else if (f == "Json.get" || f == "Json.set" || f == "Json.remove" || f == "Json.append" || f == "Json.prepend" || f == "Json.setAt" || f == "Json.dropAt" || f == "Json.merge" || f == "Json.Int" || f == "Json.Null" || f == "Json.Float" || f == "Json.Obj" || f == "Json.Str" || f == "Json.Bool" || f == "Json.Arr") "Any" else strKitRet(f)
 
 def isArith(op: String): Bool =
   op == "+" || op == "-" || op == "*" || op == "/" || op == "%"
@@ -207,23 +339,26 @@ def zipCheckHd(callee: String, w: String, want: List[String], args: List[Expr],
   zipCheckArg(callee, w, want, List.at(args, 0), List.tail(args), env, funs, ens, span, acc)
 
 def zipCheckArg(callee: String, w: String, want: List[String], arg: Expr, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), acc: String): Out =
-  if (List.isEmpty(args)) zipCheckLast(infer(stripNamed(arg), env, funs, ens), callee, w, span, acc) else zipCheck2(callee, w, infer(stripNamed(arg), env, funs, ens), want, args, env, funs, ens, span, acc)
+  zipCheckGo(callee, w, want, arg, args, env, funs, ens, span, acc, spanPick(exprSpan(env, stripNamed(arg)), span))
+
+def zipCheckGo(callee: String, w: String, want: List[String], arg: Expr, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), acc: String, asp: (String, Int)): Out =
+  if (List.isEmpty(args)) zipCheckLast(infer(stripNamed(arg), env, funs, ens), callee, w, asp, acc) else zipCheck2(callee, w, infer(stripNamed(arg), env, funs, ens), want, args, env, funs, ens, span, acc, asp)
 
 def zipCheckLast(o: Out, callee: String, w: String, span: (String, Int), acc: String): Out =
   o match {
     case Out(ty, err, sp) => if (Str.len(err) > 0) Out(ty, err, sp) else if (tyEq(ty, w) || w == "Any") ok(if (acc == "") ty else acc) else argMismatch(callee, w, ty, span)
   }
 
-def zipCheck2(callee: String, w: String, o: Out, want: List[String], args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), acc: String): Out =
+def zipCheck2(callee: String, w: String, o: Out, want: List[String], args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), acc: String, asp: (String, Int)): Out =
   o match {
-    case Out(ty, err, sp) => zipCheckErr(callee, w, ty, err, sp, want, args, env, funs, ens, span, acc)
+    case Out(ty, err, sp) => zipCheckErr(callee, w, ty, err, sp, want, args, env, funs, ens, span, acc, asp)
   }
 
-def zipCheckErr(callee: String, w: String, ty: String, err: String, sp: (String, Int), want: List[String], args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), acc: String): Out =
-  if (Str.len(err) > 0) Out(ty, err, sp) else zipCheckEq(callee, w, ty, want, args, env, funs, ens, span, acc)
+def zipCheckErr(callee: String, w: String, ty: String, err: String, sp: (String, Int), want: List[String], args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), acc: String, asp: (String, Int)): Out =
+  if (Str.len(err) > 0) Out(ty, err, sp) else zipCheckEq(callee, w, ty, want, args, env, funs, ens, span, acc, asp)
 
-def zipCheckEq(callee: String, w: String, got: String, want: List[String], args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), acc: String): Out =
-  if (tyEq(got, w) || w == "Any") zipCheck(callee, want, args, env, funs, ens, span, if (acc == "") got else acc) else argMismatch(callee, w, got, span)
+def zipCheckEq(callee: String, w: String, got: String, want: List[String], args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), acc: String, asp: (String, Int)): Out =
+  if (tyEq(got, w) || w == "Any") zipCheck(callee, want, args, env, funs, ens, span, if (acc == "") got else acc) else argMismatch(callee, w, got, asp)
 
 def argMismatch(callee: String, w: String, got: String, span: (String, Int)): Out =
   bad(argMismatchMsg(argMismatchWant(callee, w), got), span)
@@ -303,11 +438,23 @@ def checkKnownRet(f: String, o: Out, ret: String): Out =
   }
 
 def kitRetFromTy(f: String, ty: String, ret: String): String =
-  if (f == "List.head") kitRetOption(ty) else if (f == "List.at") elemOf(ty) else if (f == "List.tail" || f == "List.reverse" || f == "List.concat") kitRetList(ty, ret) else if (f == "List.cons") kitRetCons(ty, ret) else if (f == "IO.pure") ioTy("Any", ty) else if (f == "IO.fail") ioTy(ty, "Any") else ret
+  if (f == "List.head") kitRetOption(ty) else if (f == "Map.get") kitRetMapOption(ty) else if (f == "List.at") elemOf(ty) else if (f == "List.tail" || f == "List.reverse" || f == "List.concat" || f == "List.last" || f == "List.find" || f == "List.findLast") kitRetList(ty, ret) else if (f == "List.cons") kitRetCons(ty, ret) else if (f == "IO.pure") ioTy("Any", ty) else if (f == "IO.fail") Str.concat("IO[", Str.concat(if (ty == "") "String" else ty, ", Any]")) else if (f == "Deferred.get") defGetRet(ty) else ret
+
+def defGetRet(ty: String): String =
+  if (Str.startsWith(ty, "Deferred[")) ioTy("Any", elemOf(ty)) else "IO[Any]"
 
 def kitRetOption(ty: String): String =
   Str.concat("Option[", Str.concat(elemOf(ty), "]"))
 
+def kitRetMapOption(ty: String): String =
+  Str.concat("Option[", Str.concat(mapValOf(ty), "]"))
+
+def mapValOf(ty: String): String =
+  mapValOf2(splitComma(elemOf(ty)))
+
+def mapValOf2(parts: List[String]): String =
+  if (List.isEmpty(parts) || List.isEmpty(List.tail(parts))) "Any" else List.at(parts, 1)
+
 def kitRetList(ty: String, ret: String): String =
   if (isListTy(ty)) ty else ret
 
@@ -321,7 +468,7 @@ def resolveCall2(f: String, args: List[Expr], env: List[(String, String)], funs:
   if (isKit(f) || isOpenKit(f)) resolveKit(f, args, env, funs, ens, span) else if (hasEn(ens, f)) inferCtor(f, args, env, funs, ens) else if (enOfCase(ens, f) != "") inferCtor(enOfCase(ens, f), args, env, funs, ens) else resolveFunOrUser(f, args, env, funs, ens, span, lookupEnv(env, f))
 
 def resolveKit(f: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
-  if (List.isEmpty(args) && isKit(f) && !List.isEmpty(kitParams(f))) ok(funTyFrom(kitParams(f), kitRet(f))) else if (isKit(f)) checkKnown(f, kitParams(f), kitRet(f), args, env, funs, ens, span) else checkKnown(f, anyParams(List.len(args)), openKitRet(f), args, env, funs, ens, span)
+  if (f == "Resource.make" || f == "Resource.use") resolveResource(f, args, env, funs, ens, span) else if (List.isEmpty(args) && isKit(f) && !List.isEmpty(kitParams(f))) ok(funTyFrom(kitParams(f), kitRet(f))) else if (isKit(f)) checkKnown(f, kitParams(f), kitRet(f), args, env, funs, ens, span) else checkKnown(f, anyParams(List.len(args)), openKitRet(f), args, env, funs, ens, span)
 
 def enOfCase(ens: List[En], ctor: String): String =
   if (List.isEmpty(ens)) "" else enOfCase1(List.at(ens, 0), List.tail(ens), ctor)
@@ -340,13 +487,65 @@ def hasCase1(c: EnCase, rest: List[EnCase], ctor: String): Bool =
   }
 
 def isOpenKit(f: String): Bool =
-  Str.startsWith(f, "List.") || Str.startsWith(f, "Map.") || Str.startsWith(f, "Set.") || Str.startsWith(f, "Str.") || Str.startsWith(f, "IO.") || Str.startsWith(f, "Json.") || Str.startsWith(f, "Float.") || Str.startsWith(f, "Signal.") || Str.startsWith(f, "Property.") || Str.startsWith(f, "View.") || Str.startsWith(f, "Ui.") || Str.startsWith(f, "Fiber.") || Str.startsWith(f, "Timeline.") || Str.startsWith(f, "Verdict.") || Str.startsWith(f, "Color.") || Str.startsWith(f, "Theme.") || Str.startsWith(f, "Ref.") || Str.startsWith(f, "Queue.") || Str.startsWith(f, "Deferred.") || Str.startsWith(f, "Stream.") || Str.startsWith(f, "Resource.") || Str.startsWith(f, "Builder.") || Str.startsWith(f, "Oracle.") || Str.startsWith(f, ".")
+  Str.startsWith(f, "List.") || Str.startsWith(f, "Map.") || Str.startsWith(f, "Set.") || Str.startsWith(f, "IO.") || Str.startsWith(f, "Float.") || Str.startsWith(f, "Signal.") || Str.startsWith(f, "Property.") || Str.startsWith(f, "View.") || Str.startsWith(f, "Ui.") || Str.startsWith(f, "Fiber.") || Str.startsWith(f, "Timeline.") || Str.startsWith(f, "Verdict.") || Str.startsWith(f, "Color.") || Str.startsWith(f, "Theme.") || Str.startsWith(f, "Ref.") || Str.startsWith(f, "Queue.") || Str.startsWith(f, "Stream.") || Str.startsWith(f, "Builder.") || Str.startsWith(f, "Oracle.") || Str.startsWith(f, ".") && f != ".apply"
 
 def anyParams(n: Int): List[String] =
   if (n <= 0) noStr() else "Any" :: anyParams(n - 1)
 
 def openKitRet(f: String): String =
-  if (openKitBool(f)) "Bool" else if (openKitInt(f) || Str.startsWith(f, "Color.") || Str.startsWith(f, "Theme.")) "Int" else if (f == "Property.sometimes") "Unit" else if (openKitAny(f) || Str.startsWith(f, "Signal.") || Str.startsWith(f, "View.") || Str.startsWith(f, "Property.") || Str.startsWith(f, "Json.")) "Any" else if (Str.startsWith(f, "Map.")) "Map" else if (Str.startsWith(f, "Set.")) "Set" else if (Str.startsWith(f, "IO.") || Str.startsWith(f, "Ui.") || Str.startsWith(f, "Fiber.") || Str.startsWith(f, "Ref.") || Str.startsWith(f, "Queue.") || Str.startsWith(f, "Deferred.") || Str.startsWith(f, "Stream.") || Str.startsWith(f, "Resource.")) "IO[Any]" else if (Str.startsWith(f, "Str.")) "String" else if (Str.startsWith(f, "Float.")) "Float" else if (Str.startsWith(f, "Builder.") || Str.startsWith(f, "Oracle.") || Str.startsWith(f, ".")) "Any" else "Any"
+  if (openKitBool(f)) "Bool" else if (openKitInt(f) || Str.startsWith(f, "Color.") || Str.startsWith(f, "Theme.")) "Int" else if (f == "Property.sometimes") "Unit" else if (openKitAny(f) || Str.startsWith(f, "Signal.") || Str.startsWith(f, "View.") || Str.startsWith(f, "Property.")) "Any" else if (Str.startsWith(f, "Map.")) "Map" else if (Str.startsWith(f, "Set.")) "Set" else if (Str.startsWith(f, "Stream.")) streamKitRet(f) else if (Str.startsWith(f, "IO.") || Str.startsWith(f, "Ui.") || Str.startsWith(f, "Fiber.") || Str.startsWith(f, "Ref.") || Str.startsWith(f, "Queue.")) "IO[Any]" else if (Str.startsWith(f, "Str.")) "String" else if (Str.startsWith(f, "Float.")) "Float" else if (Str.startsWith(f, "Builder.") || Str.startsWith(f, "Oracle.") || Str.startsWith(f, ".")) "Any" else "Any"
+
+def streamKitRet(f: String): String =
+  if (f == "Stream.exists" || f == "Stream.forall" || f == "Stream.none") "IO[Bool]" else if (f == "Stream.count") "IO[Int]" else if (f == "Stream.compileToList" || f == "Stream.drain" || f == "Stream.head" || f == "Stream.last" || f == "Stream.fold") "IO[Any]" else "Stream"
+
+def strKitRet(f: String): String =
+  if (f == "Str.concat" || f == "Str.fromInt" || f == "Str.fromBool" || f == "Str.slice" || f == "Str.byteSlice" || f == "Str.repeat" || f == "Str.take" || f == "Str.drop" || f == "Str.takeRight" || f == "Str.dropRight" || f == "Str.trim" || f == "Str.stripPrefix" || f == "Str.stripSuffix" || f == "Str.reverse" || f == "Str.toLower" || f == "Str.toUpper" || f == "Str.capitalize" || f == "Str.padLeft" || f == "Str.padRight" || f == "Str.replace") "String" else resourceKitRet(f)
+
+def resourceKitRet(f: String): String =
+  if (f == "Resource.make") "Resource" else if (f == "Resource.use") "IO[Any]" else deferredKitRet(f)
+
+def deferredKitRet(f: String): String =
+  if (f == "Deferred.empty") "IO[Deferred]" else if (f == "Deferred.get") "IO[Any]" else if (f == "Deferred.complete" || f == "Deferred.fail") "IO[Unit]" else "Any"
+
+def resolveResource(f: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
+  if (List.isEmpty(args)) ok(funTyFrom(kitParams(f), resourceKitRet(f))) else if (List.len(args) != 2) bad(Str.concat(f, Str.concat(" expects 2 args, got ", Str.fromInt(List.len(args)))), span) else resolveResource2(f, infer(stripNamed(List.at(args, 0)), env, funs, ens), List.at(args, 1), env, funs, ens, span)
+
+def resolveResource2(f: String, ao: Out, lam: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
+  if (hasErr(ao)) ao else if (f == "Resource.make") resolveResMake(ao, lam, env, funs, ens, span) else resolveResUse(ao, lam, env, funs, ens, span)
+
+def isRes(t: String): Bool =
+  t == "Resource" || Str.startsWith(t, "Resource[")
+
+def resTy(a: String): String =
+  if (a == "" || a == "Any") "Resource" else Str.concat("Resource[", Str.concat(a, "]"))
+
+def resPayload(t: String): String =
+  if (isRes(t) && brackAt(t, 0) >= 0) elemOf(t) else "Any"
+
+def bindRes(p: String, ty: String, env: List[(String, String)]): List[(String, String)] =
+  if (p == "_" || p == "") env else (p, ty) :: env
+
+def resolveResMake(ao: Out, lam: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
+  if (isIo(ao.ty) || ao.ty == "Any") resolveResLam(ao.ty, ioPayload(ao.ty), lam, env, funs, ens, span, resTy(ioPayload(ao.ty))) else bad(Str.concat("Resource.make needs IO, got ", ao.ty), span)
+
+def resolveResUse(ao: Out, lam: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
+  if (isRes(ao.ty) || ao.ty == "Any") resolveResLam(ao.ty, resPayload(ao.ty), lam, env, funs, ens, span, "") else bad(Str.concat("Resource.use needs Resource, got ", ao.ty), span)
+
+def resolveResLam(recv: String, bind: String, lam: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), makeRet: String): Out =
+  lam match {
+    case Expr.ELam(p, ty, body) => resolveResAnn(annOk(ty, bind, span), recv, p, body, env, funs, ens, span, makeRet)
+    case Expr.ENamed(_, inner) => resolveResLam(recv, bind, inner, env, funs, ens, span, makeRet)
+    case _ => bad(Str.concat(if (makeRet == "") "Resource.use" else "Resource.make", " needs a lambda"), span)
+  }
+
+def resolveResAnn(a: Out, recv: String, p: String, body: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), makeRet: String): Out =
+  if (hasErr(a)) a else resolveResBody(recv, infer(body, bindRes(p, bindOfAnn(a), env), funs, ens), span, makeRet)
+
+def bindOfAnn(a: Out): String =
+  a.ty
+
+def resolveResBody(recv: String, body: Out, span: (String, Int), makeRet: String): Out =
+  if (hasErr(body)) body else if (isIo(body.ty) || body.ty == "Any") ok(if (makeRet != "") makeRet else if (isIo(body.ty)) body.ty else "IO[Any]") else bad(Str.concat(if (makeRet == "") "Resource.use" else "Resource.make", Str.concat(" needs IO, got ", Str.concat(recv, Str.concat(" and ", body.ty)))), span)
 
 def openKitBool(f: String): Bool =
   f == "List.exists" || f == "List.forall" || f == "List.contains" || f == "List.nonEmpty" || f == "List.isEmpty"
@@ -355,19 +554,16 @@ def openKitInt(f: String): Bool =
   f == "List.count" || f == "List.indexWhere" || f == "List.lastIndexWhere" || f == "List.indexOf" || f == "List.lastIndexOf" || f == "Float.toInt"
 
 def openKitAny(f: String): Bool =
-  f == "List.foldLeft" || f == "List.foldRight" || f == "List.reduceLeft" || f == "List.reduceRight" || f == "List.getOrElse" || f == "List.last" || f == "List.at"
+  f == "List.foldLeft" || f == "List.foldRight" || f == "List.reduceLeft" || f == "List.reduceRight" || f == "List.getOrElse" || f == "List.at"
 
 def resolveFunOrUser(f: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), ty: String): Out =
   if (isFunTy(ty)) inferFunApply(ty, args, env, funs, ens, span) else resolveUser(f, args, env, funs, ens, span, findFunPrefer(funs, f, env))
 
 def inferFunApply(ty: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
-  inferFunApplyRet(funRetOf(ty), args, env, funs, ens, span)
-
-def inferFunApplyRet(ret: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
-  if (List.len(args) == 1) inferFunApply1(ret, infer(List.at(args, 0), env, funs, ens), span) else if (List.isEmpty(args)) bad("apply expects 1 arg", span) else inferFunApply1(ret, firstArgErr(args, env, funs, ens), span)
+  if (List.isEmpty(args)) bad("apply expects 1 arg", span) else if (List.len(args) == 1) inferFunApply1(ty, infer(List.at(args, 0), env, funs, ens), spanPick(exprSpan(env, List.at(args, 0)), span)) else inferFunApply1(ty, inferTuple(args, env, funs, ens), span)
 
-def inferFunApply1(ret: String, o: Out, _span: (String, Int)): Out =
-  if (hasErr(o)) o else ok(ret)
+def inferFunApply1(ty: String, o: Out, span: (String, Int)): Out =
+  if (hasErr(o)) o else if (tyEq(o.ty, funArgOf(ty))) ok(funRetOf(ty)) else argMismatch("apply", funArgOf(ty), o.ty, span)
 
 def elemOf(t: String): String =
   elemOf2(brackAt(t, 0), t)
@@ -383,18 +579,26 @@ def resolveUser(f: String, args: List[Expr], env: List[(String, String)], funs:
 
 def resolveUserHit(f: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), d: Fun): Out =
   d match {
-    case Fun(_, _, _, ps, ret, _, _, _) => checkKnown(f, paramTys(ps), ret, args, env, funs, ens, span)
+    case Fun(_, _, _, ps, ret, _, _, _) => checkUser(f, ps, ret, args, env, funs, ens, span)
+  }
+
+def checkUser(f: String, ps: List[Param], ret: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
+  checkUserAl(f, ps, ret, args, env, funs, ens, span, alignCall(ps, args))
+
+def checkUserAl(f: String, ps: List[Param], ret: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int), al: (List[Expr], String)): Out =
+  al match {
+    case (xs, err) => if (err != "") bad(alignErr(f, err, ps, args), span) else checkKnown(f, paramTys(ps), ret, xs, env, funs, ens, span)
   }
 
 def inferCall(f: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
   resolveCall(f, args, env, funs, ens, span)
 
 def inferPrint(inner: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
-  inferPrint2(infer(inner, env, funs, ens), env, e)
+  inferPrint2(infer(inner, env, funs, ens), env, inner, e)
 
-def inferPrint2(o: Out, env: List[(String, String)], e: Expr): Out =
+def inferPrint2(o: Out, env: List[(String, String)], inner: Expr, e: Expr): Out =
   o match {
-    case Out(ty, err, sp) => if (Str.len(err) > 0) o else if (ty == "String" || ty == "Any") ok("IO[Unit]") else bad(Str.concat("expected String, got ", ty), exprSpan(env, e))
+    case Out(ty, err, sp) => if (Str.len(err) > 0) o else if (ty == "String" || ty == "Any") ok("IO[Unit]") else bad(Str.concat("expected String, got ", ty), spanPick(exprSpan(env, inner), exprSpan(env, e)))
   }
 
 def inferBin(op: String, l: Expr, r: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
@@ -480,13 +684,20 @@ def infer(e: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En]):
     case Expr.ETuple(xs) => inferTuple(xs, env, funs, ens)
     case Expr.EMethod(recv, name, args, _) => inferMethod(recv, name, args, env, funs, ens, e)
     case Expr.EField(recv, name, _) => inferField(recv, name, env, funs, ens)
-    case Expr.ELam(p, body) => inferLam(infer(body, bindLam(p, env), funs, ens))
+    case Expr.ELam(p, ty, body) => inferLam(ty, infer(body, bindLam(p, ty, env), funs, ens))
     case Expr.EMatch(s, arms, _) => inferMatch(s, arms, env, funs, ens)
     case Expr.EFor(bs, body, _) => inferFor(bs, body, env, funs, ens)
+    case Expr.EAscribe(inner, ty, off) => inferAscribe(inner, ty, off, env, funs, ens)
   }
 
-def inferLam(o: Out): Out =
-  if (hasErr(o)) o else ok(Str.concat("Any => ", o.ty))
+def inferAscribe(inner: Expr, ty: String, off: Int, env: List[(String, String)], funs: List[Fun], ens: List[En]): Out =
+  inferAscribe2(infer(inner, env, funs, ens), ty, (modFile(env), off))
+
+def inferAscribe2(o: Out, ty: String, span: (String, Int)): Out =
+  if (hasErr(o)) o else if (tyEq(o.ty, ty)) ok(prefer(ty, o.ty)) else bad(Str.concat("type mismatch: expected ", Str.concat(ty, Str.concat(", got ", o.ty))), span)
+
+def inferLam(ty: String, o: Out): Out =
+  if (hasErr(o)) o else ok(Str.concat(if (ty == "") "Any" else ty, Str.concat(" => ", o.ty)))
 
 def inferFor(bs: List[Bind], body: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En]): Out =
   inferForGo(bs, body, env, funs, ens, "")
@@ -503,7 +714,7 @@ def inferForBind2(d: Bool, name: String, vo: Out, rest: List[Bind], body: Expr,
   if (hasErr(vo)) vo else if (d) inferForDraw(name, vo.ty, rest, body, env, funs, ens, errTy, span) else inferForGo(rest, body, bindFor(false, name, vo.ty, env, ens), funs, ens, errTy)
 
 def inferForDraw(name: String, ty: String, rest: List[Bind], body: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], errTy: String, span: (String, Int)): Out =
-  inferForDraw2(name, ty, rest, body, env, funs, ens, unifyErr(errTy, ioErr(ty), span))
+  if (Str.startsWith(ty, "Stream") || Str.startsWith(ty, "Resource")) bad(Str.concat("<- needs IO, got ", ty), span) else inferForDraw2(name, ty, rest, body, env, funs, ens, unifyErr(errTy, ioErr(ty), span))
 
 def inferForDraw2(name: String, ty: String, rest: List[Bind], body: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], u: Out): Out =
   if (hasErr(u)) u else inferForGo(rest, body, bindFor(true, name, ty, env, ens), funs, ens, u.ty)
@@ -544,22 +755,25 @@ def inferFieldHit(hit: List[Fun], en: String, name: String, env: List[(String, S
   if (List.isEmpty(hit)) fieldOf(inferVar(en, env, funs, ens, noSpan()), name, ens) else ok(funTyOf(List.at(hit, 0)))
 
 def fieldOf(o: Out, name: String, ens: List[En]): Out =
-  if (hasErr(o)) o else fieldOf2(o.ty, name, ens)
+  if (hasErr(o)) o else fieldOf2(o.ty, name, ens, o.span)
 
-def fieldOf2(ty: String, name: String, ens: List[En]): Out =
-  if (isTup(ty) && isTupField(name)) tupFieldOf(ty, name) else fieldOf3(fieldNamed(ens, ty, name), ty)
+def fieldOf2(ty: String, name: String, ens: List[En], span: (String, Int)): Out =
+  if (isTup(ty) && isTupField(name)) tupFieldAt(splitComma(tupleInner(ty)), tupIdx(name), name, span) else if (isTup(ty) && tupBadName(name)) bad(Str.concat("tuple has no field ", name), span) else fieldOf3(fieldNamed(ens, ty, name), ty)
 
 def isTupField(name: String): Bool =
-  name == "_1" || name == "_2" || name == "_3" || name == "_4"
-
-def tupFieldOf(ty: String, name: String): Out =
-  tupFieldAt(splitComma(tupleInner(ty)), tupIdx(name))
+  tupIdx(name) >= 0
 
 def tupIdx(name: String): Int =
-  if (name == "_1") 0 else if (name == "_2") 1 else if (name == "_3") 2 else 3
+  if (Str.len(name) == 2 && Str.charAt(name, 0) == 95) tupIdxDig(Str.charAt(name, 1)) else 0 - 1
+
+def tupIdxDig(c: Int): Int =
+  if (c >= 49 && c <= 56) c - 49 else 0 - 1
 
-def tupFieldAt(parts: List[String], i: Int): Out =
-  if (i < 0 || i >= List.len(parts)) ok("Any") else ok(List.at(parts, i))
+def tupBadName(name: String): Bool =
+  Str.len(name) >= 2 && Str.charAt(name, 0) == 95 && Str.charAt(name, 1) >= 48 && Str.charAt(name, 1) <= 57
+
+def tupFieldAt(parts: List[String], i: Int, name: String, span: (String, Int)): Out =
+  if (i < 0 || i >= List.len(parts)) bad(Str.concat("tuple has no field ", name), span) else ok(List.at(parts, i))
 
 def fieldOf3(ft: String, ty: String): Out =
   if (ft == "") ok(ty) else ok(ft)
@@ -812,7 +1026,13 @@ def caseFieldTys3(h: EnCase, rest: List[EnCase], ctor: String): List[String] =
   }
 
 def inferMethod(recv: Expr, name: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
-  if (name == "flatMap") inferFlatMap(recv, args, env, funs, ens, e) else if (name == "handleErrorWith") inferHandle(recv, args, env, funs, ens, e) else if (name == "map") inferIoMap(recv, args, env, funs, ens, e) else inferMethod2(recv, name, args, env, funs, ens, e)
+  if (name == "flatMap") inferFlatMap(recv, args, env, funs, ens, e) else if (name == "handleErrorWith") inferHandle(recv, args, env, funs, ens, e) else if (name == "map") inferIoMap(recv, args, env, funs, ens, e) else if (name == "apply") inferApply(recv, args, env, funs, ens, e) else inferMethod2(recv, name, args, env, funs, ens, e)
+
+def inferApply(recv: Expr, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
+  inferApply2(infer(recv, env, funs, ens), args, env, funs, ens, e)
+
+def inferApply2(o: Out, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
+  if (hasErr(o)) o else if (isFunTy(o.ty) || o.ty == "Any") inferFunApply(o.ty, args, env, funs, ens, exprSpan(env, e)) else bad(Str.concat("apply needs a function, got ", o.ty), exprSpan(env, e))
 
 def inferMethod2(recv: Expr, name: String, args: List[Expr], env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
   recv match {
@@ -893,10 +1113,14 @@ def inferIoMap2(o: Out, recv: Expr, args: List[Expr], env: List[(String, String)
 
 def inferIoMapLam(recv: Out, lam: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
   lam match {
-    case Expr.ELam(p, body) => inferIoMap3(recv, infer(body, bindIo(p, recv.ty, env), funs, ens), env, e)
-    case _ => inferIoMap3(recv, infer(lam, env, funs, ens), env, e)
+    case Expr.ELam(p, ty, body) => inferIoMapAnn(annOk(ty, ioPayload(recv.ty), exprSpan(env, e)), recv, p, body, env, funs, ens, e)
+    case Expr.EMatch(_, _, _) => inferIoMap3(recv, infer(lam, env, funs, ens), env, e)
+    case _ => bad("map needs a lambda", exprSpan(env, e))
   }
 
+def inferIoMapAnn(a: Out, recv: Out, p: String, body: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
+  if (hasErr(a)) a else inferIoMap3(recv, infer(body, bindIo(p, recv.ty, env), funs, ens), env, e)
+
 def inferIoMap3(recv: Out, body: Out, env: List[(String, String)], e: Expr): Out =
   if (hasErr(body)) body else ok(ioTy(ioErr(recv.ty), body.ty))
 
@@ -905,10 +1129,13 @@ def inferFlatMap2(o: Out, args: List[Expr], env: List[(String, String)], funs: L
 
 def inferFlatMapLam(recv: Out, lam: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
   lam match {
-    case Expr.ELam(p, body) => inferFlatMap3(recv, infer(body, bindIo(p, recv.ty, env), funs, ens), env, e)
+    case Expr.ELam(p, ty, body) => inferFlatMapAnn(annOk(ty, ioPayload(recv.ty), exprSpan(env, e)), recv, p, body, env, funs, ens, e)
     case _ => inferFlatMap3(recv, infer(lam, env, funs, ens), env, e)
   }
 
+def inferFlatMapAnn(a: Out, recv: Out, p: String, body: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
+  if (hasErr(a)) a else inferFlatMap3(recv, infer(body, bindIo(p, recv.ty, env), funs, ens), env, e)
+
 def bindIo(p: String, ioTy: String, env: List[(String, String)]): List[(String, String)] =
   if (p == "_" || p == "") env else (p, ioPayload(ioTy)) :: env
 
@@ -935,10 +1162,13 @@ def inferHandle2(o: Out, args: List[Expr], env: List[(String, String)], funs: Li
 
 def inferHandleLam(recv: Out, lam: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
   lam match {
-    case Expr.ELam(p, body) => inferHandle3(recv, infer(body, bindHandle(p, recv.ty, env), funs, ens), env, e)
+    case Expr.ELam(p, ty, body) => inferHandleAnn(annOk(ty, ioErr(recv.ty), exprSpan(env, e)), recv, p, body, env, funs, ens, e)
     case _ => inferHandle3(recv, infer(lam, env, funs, ens), env, e)
   }
 
+def inferHandleAnn(a: Out, recv: Out, p: String, body: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En], e: Expr): Out =
+  if (hasErr(a)) a else inferHandle3(recv, infer(body, bindHandle(p, recv.ty, env), funs, ens), env, e)
+
 def bindHandle(p: String, ioTy: String, env: List[(String, String)]): List[(String, String)] =
   if (p == "_" || p == "") env else (p, ioErr(ioTy)) :: env
 
@@ -952,7 +1182,7 @@ def inferVar(s: String, env: List[(String, String)], funs: List[Fun], ens: List[
   inferVar2(s, getTy(env, s), env, funs, ens, span)
 
 def inferVar2(s: String, t: String, env: List[(String, String)], funs: List[Fun], ens: List[En], span: (String, Int)): Out =
-  if (t == "") inferVarFun(s, findFunPrefer(funs, s, env), ens, span) else ok(t)
+  if (s == "") bad("unexpected token", span) else if (t == "") inferVarFun(s, findFunPrefer(funs, s, env), ens, span) else ok(t)
 
 def inferVarFun(s: String, hit: List[Fun], ens: List[En], span: (String, Int)): Out =
   if (List.isEmpty(hit)) inferVarCase(s, ens, span) else ok(funTyOf(List.at(hit, 0)))
@@ -1006,7 +1236,7 @@ def checkDefWrap(name: String, ret: String, body: Expr, o: Out, span: (String, I
   if (hasErr(o)) bad(Str.concat("in ", Str.concat(name, Str.concat(": ", o.err))), o.span) else checkDefGot(name, ret, body, o, span)
 
 def checkDefGot(name: String, ret: String, body: Expr, o: Out, span: (String, Int)): Out =
-  if (hasErr(o)) o else if (tyEq(o.ty, ret) || funBodyEq(o.ty, ret)) o else bad(Str.concat("def ", Str.concat(name, Str.concat(" body ", Str.concat(o.ty, Str.concat(" does not match declared ", ret))))), spanPick(Parse.spanOf(body), span))
+  if (hasErr(o)) o else if (tyEq(o.ty, ret)) o else bad(Str.concat("def ", Str.concat(name, Str.concat(" body ", Str.concat(o.ty, Str.concat(" does not match declared ", ret))))), spanPick(Parse.spanOf(body), span))
 
 def spanPick(a: (String, Int), b: (String, Int)): (String, Int) =
   a match {
@@ -1015,9 +1245,6 @@ def spanPick(a: (String, Int), b: (String, Int)): (String, Int) =
 }
   }
 
-def funBodyEq(got: String, ret: String): Bool =
-  isFunTy(ret) && tyEq(got, funRetOf(ret))
-
 def checkProg(p: Prog): Out =
   checkProgOwn(p, [])
 
@@ -1059,7 +1286,45 @@ def expandDefsGo(defs: List[Fun], als: List[Alias], acc: List[Fun]): List[Fun] =
 
 def expandDef(d: Fun, als: List[Alias]): Fun =
   d match {
-    case Fun(priv, name, ts, ps, ret, body, mod, off) => Fun(priv, name, ts, expandParams(ps, als), expandTy(ret, als), body, mod, off)
+    case Fun(priv, name, ts, ps, ret, body, mod, off) => Fun(priv, name, ts, expandParams(ps, als), expandTy(ret, als), expandExpr(body, als), mod, off)
+  }
+
+def expandExpr(e: Expr, als: List[Alias]): Expr =
+  e match {
+    case Expr.EAscribe(inner, ty, off) => Expr.EAscribe(expandExpr(inner, als), expandTy(ty, als), off)
+    case Expr.ELam(p, ty, body) => Expr.ELam(p, expandTy(ty, als), expandExpr(body, als))
+    case Expr.EPrint(inner, off) => Expr.EPrint(expandExpr(inner, als), off)
+    case Expr.ECall(f, args, off) => Expr.ECall(f, expandExprs(args, als), off)
+    case Expr.EMethod(recv, name, args, off) => Expr.EMethod(expandExpr(recv, als), name, expandExprs(args, als), off)
+    case Expr.EField(recv, name, off) => Expr.EField(expandExpr(recv, als), name, off)
+    case Expr.EBin(op, l, r, off) => Expr.EBin(op, expandExpr(l, als), expandExpr(r, als), off)
+    case Expr.EUn(op, inner, off) => Expr.EUn(op, expandExpr(inner, als), off)
+    case Expr.EIf(c, t, el, off) => Expr.EIf(expandExpr(c, als), expandExpr(t, als), expandExpr(el, als), off)
+    case Expr.EMatch(s, arms, off) => Expr.EMatch(expandExpr(s, als), expandArms(arms, als), off)
+    case Expr.EFor(bs, body, off) => Expr.EFor(expandBinds(bs, als), expandExpr(body, als), off)
+    case Expr.EList(xs) => Expr.EList(expandExprs(xs, als))
+    case Expr.ETuple(xs) => Expr.ETuple(expandExprs(xs, als))
+    case Expr.ENamed(n, inner) => Expr.ENamed(n, expandExpr(inner, als))
+    case _ => e
+  }
+
+def expandExprs(xs: List[Expr], als: List[Alias]): List[Expr] =
+  if (List.isEmpty(xs)) xs else expandExpr(List.at(xs, 0), als) :: expandExprs(List.tail(xs), als)
+
+def expandArms(xs: List[Arm], als: List[Alias]): List[Arm] =
+  if (List.isEmpty(xs)) xs else expandArm(List.at(xs, 0), als) :: expandArms(List.tail(xs), als)
+
+def expandArm(a: Arm, als: List[Alias]): Arm =
+  a match {
+    case Arm(pat, g, body) => Arm(pat, g, expandExpr(body, als))
+  }
+
+def expandBinds(xs: List[Bind], als: List[Alias]): List[Bind] =
+  if (List.isEmpty(xs)) xs else expandBind(List.at(xs, 0), als) :: expandBinds(List.tail(xs), als)
+
+def expandBind(b: Bind, als: List[Alias]): Bind =
+  b match {
+    case Bind(d, name, v) => Bind(d, name, expandExpr(v, als))
   }
 
 def expandParams(ps: List[Param], als: List[Alias]): List[Param] =
@@ -1116,7 +1381,7 @@ def checkDefsRest(all: List[Fun], rest: List[Fun], enums: List[En], main: String
 
 def checkDefsHit(d: Fun, all: List[Fun], rest: List[Fun], enums: List[En], main: String, body: Expr, stems: List[String]): Out =
   d match {
-    case Fun(_, _, _, _, _, _, mod, _) => if (inStems(stems, mod)) checkDefsAfter(checkDef(d, all, enums), all, rest, enums, main, body, stems) else checkDefsRest(all, rest, enums, main, body, stems)
+    case Fun(_, name, _, _, _, _, mod, off) => if (name == "#parse") bad("unexpected token", (mod, off)) else if (inStems(stems, mod)) checkDefsAfter(checkDef(d, all, enums), all, rest, enums, main, body, stems) else checkDefsRest(all, rest, enums, main, body, stems)
   }
 
 def checkDefsAfter(o: Out, all: List[Fun], rest: List[Fun], enums: List[En], main: String, body: Expr, stems: List[String]): Out =
@@ -1168,6 +1433,12 @@ def locOf2(p: (Int, Int), src: String, off: Int): (Int, Int, Int, Int) =
 def locOf3(line: Int, col: Int, n: Int): (Int, Int, Int, Int) =
   (line, col, line, col + (if (n < 1) 1 else n))
 
+def hexDigit(n: Int): String =
+  Str.slice("0123456789abcdef", n, n + 1)
+
+def hex2(n: Int): String =
+  Str.concat(hexDigit(n / 16), hexDigit(n % 16))
+
 def jsonStr(s: String): String =
   Str.concat("\"", Str.concat(_esc(s, 0, Builder.empty()), "\""))
 
@@ -1175,7 +1446,7 @@ def _esc(s: String, i: Int, b: Builder): String =
   if (i >= Str.len(s)) Builder.result(b) else _esc2(s, i, b, Str.charAt(s, i))
 
 def _esc2(s: String, i: Int, b: Builder, c: Int): String =
-  _esc(s, i + 1, Builder.append(b, if (c == 34) "\\\"" else if (c == 92) "\\\\" else if (c == 10) "\\n" else Str.slice(s, i, i + 1)))
+  _esc(s, i + 1, Builder.append(b, if (c == 34) "\\\"" else if (c == 92) "\\\\" else if (c == 10) "\\n" else if (c == 13) "\\r" else if (c == 9) "\\t" else if (c < 32) Str.concat("\\u00", hex2(c)) else Str.slice(s, i, i + 1)))
 
 def fileOf(stem: String): String =
   if (stem == "") "Main.scuzz" else Str.concat(stem, ".scuzz")
@@ -1201,8 +1472,11 @@ def diagJson2(o: Out, file: String, loc: (Int, Int, Int, Int)): String =
     case (line, col, eline, ecol) => diagJson3(o, file, line, col, eline, ecol)
   }
 
+def errMsg(o: Out): String =
+  if (o.err == "unexpected token") o.err else Str.concat("type error: ", o.err)
+
 def diagJson3(o: Out, file: String, line: Int, col: Int, eline: Int, ecol: Int): String =
-  Str.concat("{\"severity\":\"error\",\"message\":", Str.concat(jsonStr(Str.concat("type error: ", o.err)), Str.concat(",\"file\":", Str.concat(jsonStr(file), Str.concat(",\"line\":", Str.concat(Str.fromInt(line), Str.concat(",\"column\":", Str.concat(Str.fromInt(col), Str.concat(",\"end_line\":", Str.concat(Str.fromInt(eline), Str.concat(",\"end_column\":", Str.concat(Str.fromInt(ecol), "}"))))))))))))
+  Str.concat("{\"severity\":\"error\",\"message\":", Str.concat(jsonStr(errMsg(o)), Str.concat(",\"file\":", Str.concat(jsonStr(file), Str.concat(",\"line\":", Str.concat(Str.fromInt(line), Str.concat(",\"column\":", Str.concat(Str.fromInt(col), Str.concat(",\"end_line\":", Str.concat(Str.fromInt(eline), Str.concat(",\"end_column\":", Str.concat(Str.fromInt(ecol), "}"))))))))))))
 
 def check(src: String): String =
   checkFiles(("Main", src) :: [])
@@ -1239,7 +1513,7 @@ def humanLine2(o: Out, file: String, loc: (Int, Int, Int, Int)): String =
   }
 
 def humanLine3(o: Out, file: String, line: Int, col: Int): String =
-  Str.concat(file, Str.concat(":", Str.concat(Str.fromInt(line), Str.concat(":", Str.concat(Str.fromInt(col), Str.concat(": error: type error: ", o.err))))))
+  Str.concat(file, Str.concat(":", Str.concat(Str.fromInt(line), Str.concat(":", Str.concat(Str.fromInt(col), Str.concat(": error: ", errMsg(o)))))))
 
 def human(src: String): String =
   humanFiles(("Main", src) :: [])
diff --git a/examples/compiler/src/Drive.scuzz b/examples/compiler/src/Drive.scuzz
index 5c604ae0..4e432cd2 100644
--- a/examples/compiler/src/Drive.scuzz
+++ b/examples/compiler/src/Drive.scuzz
@@ -8,9 +8,12 @@ record FuzzAcc(fail: Int, corpFail: Int, repro: String)
 
 record FuzzMut(killed: Int, survived: Int, inert: Int, ran: Int, sites: Int)
 
-record FuzzJob(dir: String, outDir: String, exe: String, name: String, hasUi: Bool, iterations: Int, seed: Int, noFailFast: Bool, files: List[(String, String)], oracles: Bool)
+record MutBase(idle: String, tls: List[String], pass: List[FuzzRun])
+
+record FuzzJob(dir: String, outDir: String, exe: String, name: String, hasUi: Bool, iterations: Int, seed: Int, noFailFast: Bool, files: List[(String, String)], oracles: Bool, uiEnv: String)
 
 import Manifest.Man
+import Manifest.UiMan
 import Parse.En
 
 def compileSrc(src: String): Build =
@@ -22,17 +25,26 @@ def compileSrc2(diags: String, src: String): Build =
 def joinSlash(a: String, b: String): String =
   if (a == "") b else if (Str.charAt(a, Str.len(a) - 1) == 47) Str.concat(a, b) else Str.concat(a, Str.concat("/", b))
 
+def shQuote(s: String): String =
+  Str.concat("'", Str.concat(Str.replace(s, "'", "'\\''"), "'"))
+
 def llName(outDir: String, name: String): String =
   joinSlash(outDir, Str.concat(name, ".ll"))
 
 def exeName(outDir: String, name: String): String =
   joinSlash(outDir, name)
 
+def exeAfterCd(dir: String, outDir: String, name: String): String =
+  if (Str.startsWith(outDir, "/")) exeName(outDir, name) else if (Str.startsWith(outDir, Str.concat(dir, "/"))) joinSlash(Str.slice(outDir, Str.len(dir) + 1, Str.len(outDir)), name) else exeName(outDir, name)
+
 def linkLine(clang: String, ll: String, lib: String, exe: String): String =
   Str.concat(clang, Str.concat(" -O0 -Wno-override-module ", Str.concat(ll, Str.concat(" ", Str.concat(lib, Str.concat(" -lpthread -lssl -lcrypto -o ", exe))))))
 
 def crateHome(): IO[String] =
-  Sys.getenv("SCUZZ_HOME").map(h => joinSlash(h, "."))
+  Sys.getenv("SCUZZ_HOME").flatMap(h => crateHomeAt(h))
+
+def crateHomeAt(h: String): IO[String] =
+  IO.pure(joinSlash(h, "."))
 
 def crateAt(h: String, rel: String): String =
   joinSlash(h, rel)
@@ -62,13 +74,21 @@ def forceLoad(mac: Bool, lib: String): String =
   if (mac) Str.concat("-Wl,-force_load,", lib) else lib
 
 def linkGpu(h: String): IO[Bool] =
-  Fs.read(crateAt(h, "crates/ffi-skia/build/sk_capi_backend")).map(s => Str.trim(s) == "gpu").handleErrorWith(_ => IO.pure(false))
+  Fs.read(crateAt(h, "crates/ffi-skia/build/sk_capi_backend")).flatMap(s => linkGpuGot(s)).handleErrorWith(_ => IO.pure(false))
+
+def linkGpuGot(s: String): IO[Bool] =
+  IO.pure(Str.trim(s) == "gpu")
 
 def linkLineUi(clang: String, ll: String, lib: String, exe: String, h: String, gpu: Bool, mac: Bool): String =
   Str.concat(clang, Str.concat(" -O0 -Wno-override-module ", Str.concat(ll, Str.concat(" ", Str.concat(lib, Str.concat(" ", Str.concat(skiaLib(h), Str.concat(uiFlags1(mac), Str.concat(forceLoad(mac, deskLib(h)), Str.concat(uiFlags2(mac), Str.concat(forceLoad(mac, mobLib(h)), Str.concat(uiFlags3(gpu, mac), exe))))))))))))
 
 def hostMac(): IO[Bool] =
-  Sys.exec("uname -s").map(r => Str.trim(r._2) == "Darwin")
+  Sys.exec("uname -s").flatMap(r => hostMacGot(r))
+
+def hostMacGot(r: (Int, String, String)): IO[Bool] =
+  r match {
+    case (_c, out, _err) => IO.pure(Str.trim(out) == "Darwin")
+  }
 
 def linkLineMac(clang: String, ll: String, lib: String, exe: String): String =
   Str.concat(clang, Str.concat(" -O0 -Wno-override-module ", Str.concat(ll, Str.concat(" ", Str.concat(lib, Str.concat(" -framework CoreFoundation -L/opt/homebrew/opt/openssl@3/lib -L/usr/local/opt/openssl@3/lib -lpthread -lssl -lcrypto -o ", exe))))))
@@ -100,7 +120,36 @@ def missToml(dir: String): String =
   Str.concat("missing scuzz.toml in ", dir)
 
 def showMan(m: Man): String =
-  if (!m.ok) Str.concat("err:", m.err) else Str.concat("name=", Str.concat(m.name, Str.concat(" ver=", Str.concat(m.version, Str.concat(" ui=", Str.concat(if (m.hasUi) "true" else "false", Str.concat(" deps=", Str.fromInt(List.len(m.deps)))))))))
+  if (!m.ok) Str.concat("err:", m.err) else showManUi(m, Manifest.manUi(m))
+
+def showManUi(m: Man, ui: UiMan): String =
+  Str.concat("name=", Str.concat(m.name, Str.concat(" ver=", Str.concat(m.version, Str.concat(" ui=", Str.concat(if (m.hasUi) "true" else "false", showManRest(m, ui)))))))
+
+def showManRest(m: Man, ui: UiMan): String =
+  Str.concat(" runtime=", Str.concat(Manifest.uiRuntime(ui), Str.concat(" size=", Str.concat(Manifest.uiWidth(ui), Str.concat("x", Str.concat(Manifest.uiHeight(ui), Str.concat(" scale=", Str.concat(Manifest.uiScale(ui), showManTap(m, ui)))))))))
+
+def showManTap(m: Man, ui: UiMan): String =
+  Str.concat(" tap=", Str.concat(Manifest.uiTap(ui), Str.concat(" bundle=", Str.concat(Manifest.uiBundle(ui), Str.concat(" deps=", showDeps(m.deps))))))
+
+def showDeps(xs: List[(String, String)]): String =
+  if (List.isEmpty(xs)) "" else showDepsGo(List.at(xs, 0), List.tail(xs), "")
+
+def showDepsGo(h: (String, String), rest: List[(String, String)], acc: String): String =
+  h match {
+    case (n, p) => showDepsMore(rest, if (acc == "") Str.concat(n, Str.concat("=", p)) else Str.concat(acc, Str.concat(",", Str.concat(n, Str.concat("=", p)))))
+  }
+
+def showDepsMore(rest: List[(String, String)], acc: String): String =
+  if (List.isEmpty(rest)) acc else showDepsGo(List.at(rest, 0), List.tail(rest), acc)
+
+def seenHas(xs: List[String], d: String): Bool =
+  if (List.isEmpty(xs)) false else if (List.at(xs, 0) == d) true else seenHas(List.tail(xs), d)
+
+def cycleErr(dir: String): String =
+  Str.concat("dependency cycle: ", dir)
+
+def depDir(dir: String, path: String): String =
+  if (path == ".") dir else joinSlash(dir, path)
 
 def compilePkg(toml: String, src: String, outDir: String, clang: String, lib: String): PkgOut =
   compilePkg2(Manifest.parse(toml), src, outDir, clang, lib)
@@ -118,11 +167,17 @@ def compileFiles(toml: String, files: List[(String, String)], outDir: String, cl
   compileFiles2(Manifest.parse(toml), files, outDir, clang, lib)
 
 def compileFiles2(m: Man, files: List[(String, String)], outDir: String, clang: String, lib: String): PkgOut =
-  if (!m.ok) PkgOut(false, "", "", "", "", m.err) else compileFiles3(m, Emit.emitFullFiles(files), outDir, clang, lib)
+  if (!m.ok) PkgOut(false, "", "", "", "", m.err) else compileFilesChecked(m, files, Check.checkFiles(files), outDir, clang, lib)
 
-def compileFiles3(m: Man, ll: String, outDir: String, clang: String, lib: String): PkgOut =
+def compileFilesChecked(m: Man, files: List[(String, String)], diags: String, outDir: String, clang: String, lib: String): PkgOut =
+  if (diags != "[]") PkgOut(false, m.name, "", "", "", diags) else compileFilesOk(m, Emit.emitFullFiles(files), outDir, clang, lib)
+
+def compileFilesOk(m: Man, ll: String, outDir: String, clang: String, lib: String): PkgOut =
   PkgOut(true, m.name, ll, llName(outDir, m.name), linkLine(clang, llName(outDir, m.name), lib, exeName(outDir, m.name)), "[]")
 
+def manNeed(m: Man): IO[Unit] =
+  if (!m.ok) IO.println(m.err).flatMap(_ => IO.fail("toml")) else IO.pure(())
+
 def rtLib(h: String): String =
   crateAt(h, "crates/runtime/build/libscuzz_rt.a")
 
@@ -136,18 +191,13 @@ def emitDir(dir: String, outDir: String, full: Bool): IO[Unit] =
   if (full) emitDirBump(dir, outDir) else emitDirLive(dir, outDir)
 
 def emitDirBump(dir: String, outDir: String): IO[Unit] =
-  Fs.mkdirs(joinSlash(dir, ".scuzz")).flatMap(_ => Fs.write(fpPath(dir), "").flatMap(_ => emitDirLive(dir, outDir)))
+  Fs.delete(fpPath(dir)).handleErrorWith(_ => IO.pure(())).flatMap(_ => emitDirLive(dir, outDir))
 
 def emitDirLive(dir: String, outDir: String): IO[Unit] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => emitDirMan(dir, outDir, Manifest.parse(toml)))
 
 def emitDirMan(dir: String, outDir: String, m: Man): IO[Unit] =
-  m match {
-    case Man(ok, name, version, hasUi, deps, err) => emitDirMan2(dir, outDir, ok, err, deps)
-  }
-
-def emitDirMan2(dir: String, outDir: String, ok: Bool, err: String, deps: List[(String, String)]): IO[Unit] =
-  if (!ok) IO.println(Str.concat("fail:", err)) else Fs.list(joinSlash(dir, "src")).flatMap(ents => emitDirListed(dir, outDir, deps, ents))
+  manNeed(m).flatMap(_ => Fs.list(joinSlash(dir, "src")).flatMap(ents => emitDirListed(dir, outDir, m.deps, ents)))
 
 def emitDirListed(dir: String, outDir: String, deps: List[(String, String)], ents: List[(String, Bool)]): IO[Unit] =
   readSrcFiles(joinSlash(dir, "src"), ents).flatMap(own => emitDirCollected(dir, outDir, deps, own))
@@ -156,13 +206,56 @@ def emitDirCollected(dir: String, outDir: String, deps: List[(String, String)],
   collectDeps(dir, deps, own).flatMap(files => emitDirReady(dir, outDir, files))
 
 def emitDirReady(dir: String, outDir: String, files: List[(String, String)]): IO[Unit] =
-  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => emitDirHit(dir, outDir, files, toml, fpText(toml, files)))
+  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => fpText(toml, files).flatMap(fp => emitDirHit(dir, outDir, files, toml, fp)))
 
 def fpPath(dir: String): String =
   joinSlash(joinSlash(dir, ".scuzz"), "fingerprint")
 
-def fpText(toml: String, files: List[(String, String)]): String =
-  Str.concat(toml, fpFiles(files))
+def fpText(toml: String, files: List[(String, String)]): IO[String] =
+  fpIdent().flatMap(id => fpTextJoin(id, toml, files))
+
+def fpTextJoin(id: String, toml: String, files: List[(String, String)]): IO[String] =
+  IO.pure(Str.concat(id, Str.concat(toml, fpFiles(files))))
+
+def fpIdent(): IO[String] =
+  crateHome().flatMap(h => fpIdentAt(h))
+
+def fpIdentAt(h: String): IO[String] =
+  Fs.read(joinSlash(h, "VERSION")).handleErrorWith(_ => IO.pure("")).flatMap(ver => fpIdentUname(h, Str.trim(ver)))
+
+def fpIdentUname(h: String, ver: String): IO[String] =
+  runLine("uname -s").flatMap(u => fpIdentUnameGot(h, ver, u))
+
+def fpIdentUnameGot(h: String, ver: String, u: (Int, String, String)): IO[String] =
+  u match {
+    case (_c, out, _err) => fpIdentClang(h, ver, Str.trim(out))
+  }
+
+def fpIdentClang(h: String, ver: String, uname: String): IO[String] =
+  runLine("clang -v").flatMap(cv => fpIdentClangGot(h, ver, uname, cv))
+
+def fpIdentClangGot(h: String, ver: String, uname: String, cv: (Int, String, String)): IO[String] =
+  fpIdentSkia(h, ver, uname, fpClang(cv))
+
+def fpIdentSkia(h: String, ver: String, uname: String, clang: String): IO[String] =
+  Fs.read(crateAt(h, "crates/ffi-skia/build/sk_capi_backend")).handleErrorWith(_ => IO.pure("")).flatMap(be => fpIdentSkiaGot(ver, uname, clang, be))
+
+def fpIdentSkiaGot(ver: String, uname: String, clang: String, be: String): IO[String] =
+  IO.pure(fpIdentJoin(ver, uname, clang, Str.trim(be)))
+
+def fpIdentJoin(ver: String, uname: String, clang: String, skia: String): String =
+  Str.concat(fpIdentVer(ver, uname), fpIdentClangSkia(clang, skia))
+
+def fpIdentVer(ver: String, uname: String): String =
+  Str.concat("ver=", Str.concat(ver, Str.concat(fpNl(), Str.concat("uname=", Str.concat(uname, fpNl())))))
+
+def fpIdentClangSkia(clang: String, skia: String): String =
+  Str.concat("clang=", Str.concat(clang, Str.concat(fpNl(), Str.concat("skia=", Str.concat(skia, fpNl())))))
+
+def fpClang(r: (Int, String, String)): String =
+  r match {
+    case (_c, out, err) => firstLine(if (Str.len(Str.trim(out)) > 0) out else err)
+  }
 
 def fpFiles(files: List[(String, String)]): String =
   Builder.result(fpFilesAt(files, Builder.empty()))
@@ -189,42 +282,37 @@ def emitDirHitArt(dir: String, outDir: String, files: List[(String, String)], to
   emitDirHitArtMan(dir, outDir, files, toml, fp, Manifest.parse(toml))
 
 def emitDirHitArtMan(dir: String, outDir: String, files: List[(String, String)], toml: String, fp: String, m: Man): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)) else Fs.exists(llName(outDir, m.name)).flatMap(hit => if (hit) emitDirUp(outDir, toml) else emitDirFresh(dir, outDir, files, toml, fp))
+  manNeed(m).flatMap(_ => Fs.exists(llName(outDir, m.name)).flatMap(hit => if (hit) emitDirUp(outDir, toml) else emitDirFresh(dir, outDir, files, toml, fp)))
 
 def emitDirUp(outDir: String, toml: String): IO[Unit] =
   emitDirUpMan(outDir, Manifest.parse(toml))
 
-def emitDirUpMan(outDir: String, m: Man): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)) else IO.println(Str.concat("up-to-date ", exeName(outDir, m.name)))
+def emitDirUpMan(_outDir: String, m: Man): IO[Unit] =
+  manNeed(m)
 
 def emitDirFresh(dir: String, outDir: String, files: List[(String, String)], toml: String, fp: String): IO[Unit] =
   crateHome().flatMap(h => emitDirOut(compileFiles(toml, files, outDir, "clang", rtLib(h))).flatMap(ok => emitDirStored(dir, fp, ok)))
 
 def emitDirStored(dir: String, fp: String, ok: Bool): IO[Unit] =
-  if (!ok) IO.pure(()) else Fs.mkdirs(joinSlash(dir, ".scuzz")).flatMap(_ => Fs.write(fpPath(dir), fp).flatMap(_ => Fs.delete(fpVerifyPath(dir)).handleErrorWith(_ => IO.pure(()))))
+  if (!ok) IO.fail("check") else Fs.mkdirs(joinSlash(dir, ".scuzz")).flatMap(_ => Fs.write(fpPath(dir), fp).flatMap(_ => Fs.delete(fpVerifyPath(dir)).handleErrorWith(_ => IO.pure(()))))
 
 def emitDirAlways(dir: String, outDir: String, own: List[(String, String)]): IO[Unit] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => emitDirAlwaysGot(toml, own, outDir).flatMap(_ => emitVerifyStamp(dir, toml, own)))
 
 def emitVerifyStamp(dir: String, toml: String, own: List[(String, String)]): IO[Unit] =
-  Fs.mkdirs(joinSlash(dir, ".scuzz")).flatMap(_ => Fs.write(fpVerifyPath(dir), fpText(toml, own)).flatMap(_ => Fs.delete(fpPath(dir)).handleErrorWith(_ => IO.pure(()))))
+  fpText(toml, own).flatMap(fp => Fs.mkdirs(joinSlash(dir, ".scuzz")).flatMap(_ => Fs.write(fpVerifyPath(dir), fp).flatMap(_ => Fs.delete(fpPath(dir)).handleErrorWith(_ => IO.pure(())))))
 
 def fpVerifyPath(dir: String): String =
   Str.concat(fpPath(dir), ".verify")
 
 def emitDirAlwaysGot(toml: String, own: List[(String, String)], outDir: String): IO[Unit] =
-  crateHome().flatMap(h => emitDirOut(compileFiles(toml, own, outDir, "clang", rtLib(h))).flatMap(_ => IO.pure(())))
+  crateHome().flatMap(h => emitDirOut(compileFiles(toml, own, outDir, "clang", rtLib(h))).flatMap(ok => if (!ok) IO.fail("check") else IO.pure(())))
 
 def fuzzCollect(dir: String): IO[List[(String, String)]] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => fuzzCollectMan(dir, Manifest.parse(toml)))
 
 def fuzzCollectMan(dir: String, m: Man): IO[List[(String, String)]] =
-  m match {
-    case Man(ok, _name, _version, _hasUi, deps, err) => fuzzCollectMan2(dir, ok, err, deps)
-  }
-
-def fuzzCollectMan2(dir: String, ok: Bool, err: String, deps: List[(String, String)]): IO[List[(String, String)]] =
-  if (!ok) IO.println(Str.concat("fail:", err)).flatMap(_ => IO.pure(Manifest.noPairs())) else Fs.list(joinSlash(dir, "src")).flatMap(ents => fuzzCollectListed(dir, deps, ents))
+  manNeed(m).flatMap(_ => Fs.list(joinSlash(dir, "src")).flatMap(ents => fuzzCollectListed(dir, m.deps, ents)))
 
 def fuzzCollectListed(dir: String, deps: List[(String, String)], ents: List[(String, Bool)]): IO[List[(String, String)]] =
   readSrcFiles(joinSlash(dir, "src"), ents).flatMap(own => collectDeps(dir, deps, own).flatMap(files => fuzzSimFiles(dir, deps, files).flatMap(simmed => fuzzReadDrv(joinSlash(dir, "src")).flatMap(drv => fuzzCollectVer(dir, simmed, drv)))))
@@ -244,7 +332,10 @@ def fuzzSimOne(dir: String, deps: List[(String, String)], stem: String, src: Str
   fuzzSimPath(joinSlash(joinSlash(dir, "src"), Str.concat(stem, ".scuzz_sim")), src).handleErrorWith(_ => fuzzSimDeps(dir, deps, stem, src))
 
 def fuzzSimPath(path: String, src: String): IO[String] =
-  Fs.read(path).map(sim => Verify.applySim(src, sim))
+  Fs.read(path).flatMap(sim => fuzzSimApply(src, sim))
+
+def fuzzSimApply(src: String, sim: String): IO[String] =
+  IO.pure(Verify.applySim(src, sim))
 
 def fuzzSimDeps(dir: String, deps: List[(String, String)], stem: String, src: String): IO[String] =
   if (List.isEmpty(deps)) IO.pure(src) else fuzzSimDepHd(dir, List.at(deps, 0), List.tail(deps), stem, src)
@@ -272,67 +363,71 @@ def isDrivers(name: String): Bool =
   Str.len(name) > 14 && Str.slice(name, Str.len(name) - 14, Str.len(name)) == ".scuzz_drivers"
 
 def fuzzCollectVer(dir: String, files: List[(String, String)], drv: String): IO[List[(String, String)]] =
-  Fs.list(dir).flatMap(ents => emitFuzzVerGo(dir, files, drv, ents, Manifest.noPairs()))
+  Fs.list(dir).flatMap(ents => emitFuzzVerGo(dir, ents, Manifest.noPairs()).flatMap(ver => fuzzCollectVerGot(files, ver, drv)))
+
+def fuzzCollectVerGot(files: List[(String, String)], ver: List[(String, String)], drv: String): IO[List[(String, String)]] =
+  IO.pure(fuzzFiles(files, ver, drv))
 
-def emitFuzzVerGo(dir: String, files: List[(String, String)], drv: String, ents: List[(String, Bool)], ver: List[(String, String)]): IO[List[(String, String)]] =
-  if (List.isEmpty(ents)) IO.pure(fuzzFiles(files, ver, drv)) else emitFuzzVerHd(dir, files, drv, List.at(ents, 0), List.tail(ents), ver)
+def emitFuzzVerGo(dir: String, ents: List[(String, Bool)], ver: List[(String, String)]): IO[List[(String, String)]] =
+  if (List.isEmpty(ents)) IO.pure(ver) else emitFuzzVerHd(dir, List.at(ents, 0), List.tail(ents), ver)
 
-def emitFuzzVerHd(dir: String, files: List[(String, String)], drv: String, ent: (String, Bool), rest: List[(String, Bool)], ver: List[(String, String)]): IO[List[(String, String)]] =
+def emitFuzzVerHd(dir: String, ent: (String, Bool), rest: List[(String, Bool)], ver: List[(String, String)]): IO[List[(String, String)]] =
   ent match {
-    case (name, isDir) => emitFuzzVerPick(dir, files, drv, name, isDir, rest, ver)
+    case (name, isDir) => emitFuzzVerPick(dir, name, isDir, rest, ver)
   }
 
-def emitFuzzVerPick(dir: String, files: List[(String, String)], drv: String, name: String, isDir: Bool, rest: List[(String, Bool)], ver: List[(String, String)]): IO[List[(String, String)]] =
-  if (isDir || !isVerify(name)) emitFuzzVerGo(dir, files, drv, rest, ver) else Fs.read(joinSlash(dir, name)).flatMap(src => emitFuzzVerGo(dir, files, drv, rest, (stemVerify(name), src) :: ver))
+def emitFuzzVerPick(dir: String, name: String, isDir: Bool, rest: List[(String, Bool)], ver: List[(String, String)]): IO[List[(String, String)]] =
+  if (isDir) emitFuzzVerDir(dir, name, rest, ver) else if (!isVerify(name)) emitFuzzVerGo(dir, rest, ver) else Fs.read(joinSlash(dir, name)).flatMap(src => emitFuzzVerGo(dir, rest, (stemVerify(name), src) :: ver))
+
+def emitFuzzVerDir(dir: String, name: String, rest: List[(String, Bool)], ver: List[(String, String)]): IO[List[(String, String)]] =
+  if (skipWalk(name)) emitFuzzVerGo(dir, rest, ver) else Fs.list(joinSlash(dir, name)).flatMap(sub => emitFuzzVerGo(joinSlash(dir, name), sub, ver).flatMap(got => emitFuzzVerGo(dir, rest, got)))
 
 def stemVerify(name: String): String =
   Str.slice(name, 0, Str.len(name) - 13)
 
 def fuzzFiles(files: List[(String, String)], ver: List[(String, String)], drv: String): List[(String, String)] =
-  List.concat(Verify.rewriteReqFiles(files), fuzzWrap(ver, drv))
+  List.concat(Verify.rewriteReqFiles(files), fuzzWrap(ver, drv, files))
 
-def fuzzWrap(ver: List[(String, String)], drv: String): List[(String, String)] =
-  fuzzWrapGot(Str.concat(Verify.wrapFiles(ver), drv))
+def fuzzWrap(ver: List[(String, String)], drv: String, files: List[(String, String)]): List[(String, String)] =
+  fuzzWrapGot(Str.concat(Verify.wrapFilesEns(ver, Verify.ensOfFiles(files)), drv))
 
 def fuzzWrapGot(src: String): List[(String, String)] =
   if (src == "") Manifest.noPairs() else (Verify.wrapMod(), src) :: Manifest.noPairs()
 
 def collectDeps(dir: String, deps: List[(String, String)], acc: List[(String, String)]): IO[List[(String, String)]] =
-  if (List.isEmpty(deps)) IO.pure(acc) else collectDepGo(dir, deps, acc)
+  collectDepsSeen(dir, deps, acc, Manifest.noLines())
 
-def collectDepGo(dir: String, deps: List[(String, String)], acc: List[(String, String)]): IO[List[(String, String)]] =
-  collectDepHead(dir, List.at(deps, 0), deps, acc)
+def collectDepsSeen(dir: String, deps: List[(String, String)], acc: List[(String, String)], seen: List[String]): IO[List[(String, String)]] =
+  if (List.isEmpty(deps)) IO.pure(acc) else collectDepGo(dir, deps, acc, seen)
 
-def collectDepHead(dir: String, d: (String, String), deps: List[(String, String)], acc: List[(String, String)]): IO[List[(String, String)]] =
-  collectDep(dir, d, List.tail(deps), acc)
+def collectDepGo(dir: String, deps: List[(String, String)], acc: List[(String, String)], seen: List[String]): IO[List[(String, String)]] =
+  collectDepHead(dir, List.at(deps, 0), deps, acc, seen)
 
-def collectDep(dir: String, d: (String, String), rest: List[(String, String)], acc: List[(String, String)]): IO[List[(String, String)]] =
+def collectDepHead(dir: String, d: (String, String), deps: List[(String, String)], acc: List[(String, String)], seen: List[String]): IO[List[(String, String)]] =
+  collectDep(dir, d, List.tail(deps), acc, seen)
+
+def collectDep(dir: String, d: (String, String), rest: List[(String, String)], acc: List[(String, String)], seen: List[String]): IO[List[(String, String)]] =
   d match {
-    case (name, path) => collectDepNamed(dir, name, path, rest, acc)
+    case (name, path) => collectDepNamed(dir, name, path, rest, acc, seen)
   }
 
-def collectDepNamed(dir: String, _name: String, path: String, rest: List[(String, String)], acc: List[(String, String)]): IO[List[(String, String)]] =
-  collectPkg(joinSlash(dir, path), dir, rest, acc)
-
-def collectPkg(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)]): IO[List[(String, String)]] =
-  Fs.read(joinSlash(pkgDir, "scuzz.toml")).flatMap(toml => collectPkgMan(pkgDir, parentDir, rest, acc, Manifest.parse(toml)))
+def collectDepNamed(dir: String, _name: String, path: String, rest: List[(String, String)], acc: List[(String, String)], seen: List[String]): IO[List[(String, String)]] =
+  collectPkg(depDir(dir, path), dir, rest, acc, seen)
 
-def collectPkgMan(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)], m: Man): IO[List[(String, String)]] =
-  m match {
-    case Man(ok, name, version, hasUi, nested, err) => collectPkgOk(pkgDir, parentDir, rest, acc, ok, nested)
-  }
+def collectPkg(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)], seen: List[String]): IO[List[(String, String)]] =
+  if (seenHas(seen, pkgDir)) IO.println(cycleErr(pkgDir)).flatMap(_ => IO.fail("toml")) else Fs.read(joinSlash(pkgDir, "scuzz.toml")).flatMap(toml => collectPkgMan(pkgDir, parentDir, rest, acc, Manifest.parse(toml), seen))
 
-def collectPkgOk(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)], ok: Bool, nested: List[(String, String)]): IO[List[(String, String)]] =
-  if (!ok) collectDeps(parentDir, rest, acc) else Fs.list(joinSlash(pkgDir, "src")).flatMap(ents => collectPkgListed(pkgDir, parentDir, rest, acc, nested, ents))
+def collectPkgMan(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)], m: Man, seen: List[String]): IO[List[(String, String)]] =
+  manNeed(m).flatMap(_ => Fs.list(joinSlash(pkgDir, "src")).flatMap(ents => collectPkgListed(pkgDir, parentDir, rest, acc, m.deps, ents, seen)))
 
-def collectPkgListed(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)], nested: List[(String, String)], ents: List[(String, Bool)]): IO[List[(String, String)]] =
-  readSrcFiles(joinSlash(pkgDir, "src"), ents).flatMap(more => collectPkgGot(pkgDir, parentDir, rest, acc, nested, more))
+def collectPkgListed(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)], nested: List[(String, String)], ents: List[(String, Bool)], seen: List[String]): IO[List[(String, String)]] =
+  readSrcFiles(joinSlash(pkgDir, "src"), ents).flatMap(more => collectPkgGot(pkgDir, parentDir, rest, acc, nested, more, seen))
 
-def collectPkgGot(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)], nested: List[(String, String)], more: List[(String, String)]): IO[List[(String, String)]] =
-  collectDeps(pkgDir, nested, acc).flatMap(withNested => collectAfterNested(parentDir, rest, withNested, more))
+def collectPkgGot(pkgDir: String, parentDir: String, rest: List[(String, String)], acc: List[(String, String)], nested: List[(String, String)], more: List[(String, String)], seen: List[String]): IO[List[(String, String)]] =
+  collectDepsSeen(pkgDir, nested, acc, pkgDir :: seen).flatMap(withNested => collectAfterNested(parentDir, rest, withNested, more, seen))
 
-def collectAfterNested(parentDir: String, rest: List[(String, String)], withNested: List[(String, String)], more: List[(String, String)]): IO[List[(String, String)]] =
-  collectDeps(parentDir, rest, appendNew(withNested, more))
+def collectAfterNested(parentDir: String, rest: List[(String, String)], withNested: List[(String, String)], more: List[(String, String)], seen: List[String]): IO[List[(String, String)]] =
+  collectDepsSeen(parentDir, rest, appendNew(withNested, more), seen)
 
 def hasStem(xs: List[(String, String)], stem: String): Bool =
   hasStemAt(xs, stem, 0)
@@ -396,38 +491,38 @@ def emitDirOut(p: PkgOut): IO[Bool] =
 def emitDirWrite(ok: Bool, ll: String, llPath: String, diags: String): IO[Bool] =
   if (!ok) IO.println(Str.concat("fail:", diags)).flatMap(_ => IO.pure(false)) else Fs.write(llPath, ll).flatMap(_ => IO.println("ok").flatMap(_ => IO.pure(true)))
 
-def runDir(dir: String, outDir: String, runEnv: String): IO[Unit] =
-  emitDir(dir, outDir, false).flatMap(_ => linkRun(dir, outDir, runEnv))
+def runDir(dir: String, outDir: String, runEnv: String, extra: String): IO[Unit] =
+  emitDir(dir, outDir, false).flatMap(_ => linkRun(dir, outDir, runEnv, extra))
 
-def linkRun(dir: String, outDir: String, runEnv: String): IO[Unit] =
-  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => linkRunMan(Manifest.parse(toml), outDir, runEnv))
+def linkRun(dir: String, outDir: String, runEnv: String, extra: String): IO[Unit] =
+  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => linkRunMan(Manifest.parse(toml), outDir, runEnv, extra))
 
-def linkRunMan(m: Man, outDir: String, runEnv: String): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)) else linkRunUi(m.hasUi, m.name, outDir, runEnv)
+def linkRunMan(m: Man, outDir: String, runEnv: String, extra: String): IO[Unit] =
+  manNeed(m).flatMap(_ => linkRunUi(m.hasUi, m.name, outDir, runEnv, extra))
 
-def linkRunUi(hasUi: Bool, name: String, outDir: String, runEnv: String): IO[Unit] =
-  if (hasUi) ensureUi().flatMap(_ => linkRunNamed(true, name, outDir, runEnv)) else linkRunNamed(false, name, outDir, runEnv)
+def linkRunUi(hasUi: Bool, name: String, outDir: String, runEnv: String, extra: String): IO[Unit] =
+  if (hasUi) ensureUi().flatMap(_ => linkRunNamed(true, name, outDir, runEnv, extra)) else linkRunNamed(false, name, outDir, runEnv, extra)
 
 def ensureUi(): IO[Unit] =
   crateHome().flatMap(h => runLine(Str.concat("make -C ", Str.concat(crateAt(h, "crates/ffi-skia"), " lib CC=clang"))).flatMap(r => ensureUiDesk(h, r)))
 
 def ensureUiDesk(h: String, r: (Int, String, String)): IO[Unit] =
   r match {
-    case (code, _out, err) => if (code != 0) IO.println(err) else runLine(Str.concat("make -C ", Str.concat(crateAt(h, "crates/embedder-desktop"), " lib CC=clang"))).flatMap(r2 => ensureUiMob(h, r2))
+    case (code, _out, err) => if (code != 0) IO.println(err).flatMap(_ => IO.fail("ui")) else runLine(Str.concat("make -C ", Str.concat(crateAt(h, "crates/embedder-desktop"), " lib CC=clang"))).flatMap(r2 => ensureUiMob(h, r2))
   }
 
 def ensureUiMob(h: String, r: (Int, String, String)): IO[Unit] =
   r match {
-    case (code, _out, err) => if (code != 0) IO.println(err) else runLine(Str.concat("make -C ", Str.concat(crateAt(h, "crates/embedder-mobile"), " lib CC=clang"))).flatMap(r2 => ensureUiDone(r2))
+    case (code, _out, err) => if (code != 0) IO.println(err).flatMap(_ => IO.fail("ui")) else runLine(Str.concat("make -C ", Str.concat(crateAt(h, "crates/embedder-mobile"), " lib CC=clang"))).flatMap(r2 => ensureUiDone(r2))
   }
 
 def ensureUiDone(r: (Int, String, String)): IO[Unit] =
   r match {
-    case (code, _out, err) => if (code != 0) IO.println(err) else IO.pure(())
+    case (code, _out, err) => if (code != 0) IO.println(err).flatMap(_ => IO.fail("ui")) else IO.pure(())
   }
 
-def linkRunNamed(hasUi: Bool, name: String, outDir: String, runEnv: String): IO[Unit] =
-  runLinkLine(hasUi, outDir, name).flatMap(r => afterClang(r, exeName(outDir, name), runEnv))
+def linkRunNamed(hasUi: Bool, name: String, outDir: String, runEnv: String, extra: String): IO[Unit] =
+  runLinkLine(hasUi, outDir, name).flatMap(r => afterClang(r, exeName(outDir, name), runEnv, extra))
 
 def runLine(cmd: String): IO[(Int, String, String)] =
   Sys.exec(cmd)
@@ -435,19 +530,19 @@ def runLine(cmd: String): IO[(Int, String, String)] =
 def runProbe(cmd: String): IO[(Int, String, String)] =
   runLine(Str.concat("timeout --kill-after=2s 20s env ", cmd))
 
-def afterClang(r: (Int, String, String), exe: String, runEnv: String): IO[Unit] =
+def afterClang(r: (Int, String, String), exe: String, runEnv: String, extra: String): IO[Unit] =
   r match {
-    case (code, out, err) => afterClang2(code, out, err, exe, runEnv)
+    case (code, out, err) => afterClang2(code, out, err, exe, runEnv, extra)
   }
 
-def afterClang2(code: Int, _out: String, err: String, exe: String, runEnv: String): IO[Unit] =
-  if (code != 0) afterClangFail(err) else afterClangRun(exe, runEnv)
+def afterClang2(code: Int, _out: String, err: String, exe: String, runEnv: String, extra: String): IO[Unit] =
+  if (code != 0) afterClangFail(err) else afterClangRun(exe, runEnv, extra)
 
 def afterClangFail(err: String): IO[Unit] =
   IO.println(err).flatMap(_ => IO.fail("link"))
 
-def afterClangRun(exe: String, runEnv: String): IO[Unit] =
-  runLine(Str.concat(runEnv, exe)).flatMap(r => afterRun(r))
+def afterClangRun(exe: String, runEnv: String, extra: String): IO[Unit] =
+  runLine(Str.concat(runEnv, Str.concat(exe, extra))).flatMap(r => afterRun(r))
 
 def afterRun(r: (Int, String, String)): IO[Unit] =
   r match {
@@ -460,75 +555,62 @@ def afterRun2(code: Int, out: String, err: String): IO[Unit] =
 def testEnv(): String =
   "SCUZZ_TESTRT=1 SCUZZ_SERVE=1 SCUZZ_KIT=sealed "
 
-def headlessEnv(): String =
-  "SCUZZ_UI_RUNTIME=headless SCUZZ_UI_WIDTH=200 SCUZZ_UI_HEIGHT=120 SCUZZ_UI_SCALE=1 "
-
-def skipSp(s: String, i: Int): Int =
-  if (i >= Str.len(s)) i else if (Str.charAt(s, i) == 32 || Str.charAt(s, i) == 9 || Str.charAt(s, i) == 61 || Str.charAt(s, i) == 91 || Str.charAt(s, i) == 44) skipSp(s, i + 1) else i
-
-def takeDigits(s: String, i: Int): String =
-  takeDigits2(s, i, i)
-
-def takeDigits2(s: String, i: Int, j: Int): String =
-  if (j >= Str.len(s) || Str.charAt(s, j) < 48 || Str.charAt(s, j) > 57) Str.slice(s, i, j) else takeDigits2(s, i, j + 1)
-
-def sizePair(toml: String): (String, String) =
-  sizePairAt(toml, Str.indexOf(toml, "headless_size"))
+def uiEnvKind(headless: Bool, rt: String): String =
+  if (headless) "headless" else rt
 
-def sizePairAt(toml: String, i: Int): (String, String) =
-  if (i < 0) ("200", "120") else sizePair2(toml, skipSp(toml, i + 13))
+def uiEnvUi(ui: UiMan, headless: Bool): String =
+  Str.concat("SCUZZ_UI_RUNTIME=", Str.concat(uiEnvKind(headless, Manifest.uiRuntime(ui)), Str.concat(" SCUZZ_UI_WIDTH=", Str.concat(Manifest.uiWidth(ui), Str.concat(" SCUZZ_UI_HEIGHT=", Str.concat(Manifest.uiHeight(ui), Str.concat(" SCUZZ_UI_SCALE=", Str.concat(Manifest.uiScale(ui), " "))))))))
 
-def sizePair2(toml: String, i: Int): (String, String) =
-  sizePair3(toml, takeDigits(toml, i), i)
+def uiEnvMan(m: Man, headless: Bool): String =
+  uiEnvUi(Manifest.manUi(m), headless)
 
-def sizePair3(toml: String, w: String, i: Int): (String, String) =
-  if (w == "") ("200", "120") else sizePair4(toml, w, skipSp(toml, i + Str.len(w)))
+def uiEnvOf(toml: String, headless: Bool): String =
+  uiEnvMan(Manifest.parse(toml), headless)
 
-def sizePair4(toml: String, w: String, j: Int): (String, String) =
-  sizePair5(w, takeDigits(toml, j))
-
-def sizePair5(w: String, h: String): (String, String) =
-  if (h == "") (w, "120") else (w, h)
+def headlessEnvMan(m: Man): String =
+  uiEnvMan(m, true)
 
 def headlessEnvOf(toml: String): String =
-  headlessEnvPair(sizePair(toml))
-
-def headlessEnvPair(wh: (String, String)): String =
-  wh match {
-    case (w, h) => Str.concat("SCUZZ_UI_RUNTIME=headless SCUZZ_UI_WIDTH=", Str.concat(w, Str.concat(" SCUZZ_UI_HEIGHT=", Str.concat(h, " SCUZZ_UI_SCALE=1 "))))
-  }
-
-def tapNOf(toml: String): String =
-  tapNAt(toml, Str.indexOf(toml, "tap_button"))
+  uiEnvOf(toml, true)
 
-def tapNAt(toml: String, i: Int): String =
-  if (i < 0) "" else takeDigits(toml, skipSp(toml, i + 10))
+def runEnvOf(outDir: String, headless: Bool, toml: String): String =
+  Str.concat(uiEnvOf(toml, headless), if (headless) Str.concat("SCUZZ_SNAPSHOT_PATH=", Str.concat(joinSlash(outDir, "snapshot.png"), " ")) else "")
 
 def tapNEnv(toml: String, tap: Bool): String =
-  if (!tap || tapNOf(toml) == "") "" else Str.concat("SCUZZ_UI_TAP_N=", Str.concat(tapNOf(toml), " "))
+  tapNEnvMan(Manifest.parse(toml), tap)
+
+def tapNEnvMan(m: Man, tap: Bool): String =
+  if (!tap || Manifest.uiTap(Manifest.manUi(m)) == "") "" else Str.concat("SCUZZ_UI_TAP_N=", Str.concat(Manifest.uiTap(Manifest.manUi(m)), " "))
 
 def snapEnv(outDir: String): String =
-  Str.concat(headlessEnv(), Str.concat("SCUZZ_SNAPSHOT_PATH=", Str.concat(joinSlash(outDir, "snapshot.png"), " ")))
+  runEnvOf(outDir, true, "")
+
+def snapEnvOf(outDir: String, toml: String): String =
+  runEnvOf(outDir, true, toml)
 
 def checkDir(dir: String, json: Bool): IO[Unit] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => checkDirMan(dir, json, Manifest.parse(toml)))
 
 def checkDirMan(dir: String, json: Bool, m: Man): IO[Unit] =
-  m match {
-    case Man(ok, _name, _version, _hasUi, deps, err) => checkDirMan2(dir, json, ok, err, deps)
-  }
-
-def checkDirMan2(dir: String, json: Bool, ok: Bool, err: String, deps: List[(String, String)]): IO[Unit] =
-  if (!ok) IO.println(Str.concat("fail:", err)) else Fs.list(joinSlash(dir, "src")).flatMap(ents => checkDirListed(dir, json, deps, ents))
+  manNeed(m).flatMap(_ => Fs.list(joinSlash(dir, "src")).flatMap(ents => checkDirListed(dir, json, m.deps, ents)))
 
 def isVerify(name: String): Bool =
   Str.len(name) > 13 && Str.slice(name, Str.len(name) - 13, Str.len(name)) == ".scuzz_verify"
 
+def isIntent(name: String): Bool =
+  Str.len(name) > 13 && Str.slice(name, Str.len(name) - 13, Str.len(name)) == ".scuzz_intent"
+
+def skipWalk(name: String): Bool =
+  name == "build" || name == "corpus" || name == "goldens" || Str.len(name) > 0 && Str.charAt(name, 0) == 46
+
+def joinRel(rel: String, name: String): String =
+  if (rel == "") name else joinSlash(rel, name)
+
 def checkDirListed(dir: String, json: Bool, deps: List[(String, String)], ents: List[(String, Bool)]): IO[Unit] =
   readSrcFiles(joinSlash(dir, "src"), ents).flatMap(own => checkDriveNames(dir, json, deps, own, ents))
 
 def checkDriveNames(dir: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], ents: List[(String, Bool)]): IO[Unit] =
-  drvSrcsOf(joinSlash(dir, "src"), ents).flatMap(drvs => fuzzVerSrcs(dir).flatMap(vers => checkDriveNamesGot(dir, json, deps, own, List.concat(Verify.oracleNames(vers), Verify.drvNames(drvs)))))
+  drvSrcsOf(joinSlash(dir, "src"), ents).flatMap(drvs => fuzzVerSrcs(dir).flatMap(vers => checkDriveNamesGot(dir, json, deps, own, List.concat(Verify.oracleNamesEns(vers, Verify.ensOfFiles(own)), Verify.drvNames(drvs)))))
 
 def checkDriveNamesGot(dir: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], names: List[String]): IO[Unit] =
   checkDriveNamesRule(dir, json, deps, own, Verify.driveRule(names))
@@ -551,24 +633,30 @@ def drvSrcsCons(src: String, srcDir: String, rest: List[(String, Bool)]): IO[Lis
   drvSrcsOf(srcDir, rest).flatMap(names => IO.pure(src :: names))
 
 def checkDirVerify(dir: String, json: Bool, deps: List[(String, String)], own: List[(String, String)]): IO[Unit] =
-  Fs.list(dir).flatMap(ents => checkVerifyGo(dir, json, deps, own, ents))
+  Fs.list(dir).flatMap(ents => checkVerifyGo(dir, "", json, deps, own, ents))
 
-def checkVerifyGo(dir: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], ents: List[(String, Bool)]): IO[Unit] =
-  if (List.isEmpty(ents)) collectDeps(dir, deps, own).flatMap(files => checkFmtGo(json, files, own, fileStems(own))) else checkVerifyHd(dir, json, deps, own, List.at(ents, 0), List.tail(ents))
+def checkVerifyGo(dir: String, rel: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], ents: List[(String, Bool)]): IO[Unit] =
+  if (List.isEmpty(ents)) checkVerifyDone(dir, rel, json, deps, own) else checkVerifyHd(dir, rel, json, deps, own, List.at(ents, 0), List.tail(ents))
 
-def checkVerifyHd(dir: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], ent: (String, Bool), rest: List[(String, Bool)]): IO[Unit] =
+def checkVerifyDone(dir: String, rel: String, json: Bool, deps: List[(String, String)], own: List[(String, String)]): IO[Unit] =
+  if (rel != "") IO.pure(()) else collectDeps(dir, deps, own).flatMap(files => checkFmtGo(json, files, own, fileStems(own)))
+
+def checkVerifyHd(dir: String, rel: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], ent: (String, Bool), rest: List[(String, Bool)]): IO[Unit] =
   ent match {
-    case (name, isDir) => checkVerifyPick(dir, json, deps, own, name, isDir, rest)
+    case (name, isDir) => checkVerifyPick(dir, rel, json, deps, own, name, isDir, rest)
   }
 
-def checkVerifyPick(dir: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], name: String, isDir: Bool, rest: List[(String, Bool)]): IO[Unit] =
-  if (isDir || !isVerify(name)) checkVerifyGo(dir, json, deps, own, rest) else Fs.read(joinSlash(dir, name)).flatMap(src => checkVerifySrc(dir, json, deps, own, name, src, rest))
+def checkVerifyPick(dir: String, rel: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], name: String, isDir: Bool, rest: List[(String, Bool)]): IO[Unit] =
+  if (isDir) checkVerifyDir(dir, rel, json, deps, own, name, rest) else if (isIntent(name)) IO.println(Verify.intentMsg(joinRel(rel, name))).flatMap(_ => IO.fail("scuzz check")) else if (!isVerify(name)) checkVerifyGo(dir, rel, json, deps, own, rest) else Fs.read(joinSlash(dir, name)).flatMap(src => checkVerifySrc(dir, rel, json, deps, own, joinRel(rel, name), src, rest))
+
+def checkVerifyDir(dir: String, rel: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], name: String, rest: List[(String, Bool)]): IO[Unit] =
+  if (skipWalk(name)) checkVerifyGo(dir, rel, json, deps, own, rest) else Fs.list(joinSlash(dir, name)).flatMap(sub => checkVerifyGo(joinSlash(dir, name), joinRel(rel, name), json, deps, own, sub).flatMap(_ => checkVerifyGo(dir, rel, json, deps, own, rest)))
 
-def checkVerifySrc(dir: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], name: String, src: String, rest: List[(String, Bool)]): IO[Unit] =
-  checkVerifyGot(dir, json, deps, own, rest, Verify.checkVerify(src, name))
+def checkVerifySrc(dir: String, rel: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], file: String, src: String, rest: List[(String, Bool)]): IO[Unit] =
+  checkVerifyGot(dir, rel, json, deps, own, rest, Verify.checkVerifyEns(src, file, Verify.ensOfFiles(own)))
 
-def checkVerifyGot(dir: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], rest: List[(String, Bool)], msg: String): IO[Unit] =
-  if (msg == "scuzz check ok") checkVerifyGo(dir, json, deps, own, rest) else IO.println(msg).flatMap(_ => IO.fail("scuzz check"))
+def checkVerifyGot(dir: String, rel: String, json: Bool, deps: List[(String, String)], own: List[(String, String)], rest: List[(String, Bool)], msg: String): IO[Unit] =
+  if (msg == "scuzz check ok") checkVerifyGo(dir, rel, json, deps, own, rest) else IO.println(msg).flatMap(_ => IO.fail("scuzz check"))
 
 def checkFmtGo(json: Bool, all: List[(String, String)], rest: List[(String, String)], stems: List[String]): IO[Unit] =
   if (List.isEmpty(rest)) checkFmtDone(json, all, stems) else checkFmtHd(json, all, List.at(rest, 0), List.tail(rest), stems)
@@ -647,6 +735,48 @@ def checkDirJson(diags: String, files: List[(String, String)]): IO[Unit] =
 def checkDirHuman(human: String): IO[Unit] =
   if (human == "scuzz check ok") IO.println(human) else IO.println(human).flatMap(_ => IO.fail("scuzz check"))
 
+def overlayStemHit(overlays: List[(String, String)], stem: String): (Bool, String) =
+  overlayStemHitGo(overlays, Str.concat(stem, ".scuzz"))
+
+def overlayStemHitGo(overlays: List[(String, String)], name: String): (Bool, String) =
+  if (List.isEmpty(overlays)) (false, "") else overlayStemHitHd(List.at(overlays, 0), List.tail(overlays), name)
+
+def overlayStemHitHd(h: (String, String), rest: List[(String, String)], name: String): (Bool, String) =
+  h match {
+    case (path, src) => if (overlayPathHit(path, name)) (true, src) else overlayStemHitGo(rest, name)
+  }
+
+def overlayPathHit(path: String, name: String): Bool =
+  path == name || Str.endsWith(path, Str.concat("/", name))
+
+def substOverlay(files: List[(String, String)], overlays: List[(String, String)]): List[(String, String)] =
+  if (List.isEmpty(files)) Manifest.noPairs() else substOverlayHd(List.at(files, 0), List.tail(files), overlays)
+
+def substOverlayHd(h: (String, String), rest: List[(String, String)], overlays: List[(String, String)]): List[(String, String)] =
+  h match {
+    case (stem, src) => substOverlayPick(stem, src, rest, overlays, overlayStemHit(overlays, stem))
+  }
+
+def substOverlayPick(stem: String, src: String, rest: List[(String, String)], overlays: List[(String, String)], hit: (Bool, String)): List[(String, String)] =
+  hit match {
+    case (found, over) => (stem, if (found) over else src) :: substOverlay(rest, overlays)
+  }
+
+def checkOverlay(dir: String, overlays: List[(String, String)]): IO[String] =
+  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => checkOverlayMan(dir, overlays, Manifest.parse(toml))).handleErrorWith(_ => IO.pure("[]"))
+
+def checkOverlayMan(dir: String, overlays: List[(String, String)], m: Man): IO[String] =
+  manNeed(m).flatMap(_ => Fs.list(joinSlash(dir, "src")).flatMap(ents => checkOverlayListed(dir, overlays, m.deps, ents)))
+
+def checkOverlayListed(dir: String, overlays: List[(String, String)], deps: List[(String, String)], ents: List[(String, Bool)]): IO[String] =
+  readSrcFiles(joinSlash(dir, "src"), ents).flatMap(own => checkOverlayOwn(dir, overlays, deps, own))
+
+def checkOverlayOwn(dir: String, overlays: List[(String, String)], deps: List[(String, String)], own: List[(String, String)]): IO[String] =
+  collectDeps(dir, deps, own).flatMap(files => IO.pure(checkOverlayGot(files, fileStems(own), overlays)))
+
+def checkOverlayGot(files: List[(String, String)], stems: List[String], overlays: List[(String, String)]): String =
+  Check.checkFilesOwn(sigFiles(substOverlay(files, overlays), stems), stems)
+
 def testDir(dir: String, outDir: String, update: Bool, pixels: Bool, differential: Bool): IO[Unit] =
   if (differential) testDiff(dir, outDir) else emitDir(dir, outDir, true).flatMap(_ => testLink(dir, outDir, update, pixels))
 
@@ -654,7 +784,7 @@ def testLink(dir: String, outDir: String, update: Bool, pixels: Bool): IO[Unit]
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => testLinkMan(dir, Manifest.parse(toml), outDir, update, pixels))
 
 def testLinkMan(dir: String, m: Man, outDir: String, update: Bool, pixels: Bool): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)) else testLinkUi(m.hasUi, dir, m.name, outDir, update, pixels)
+  manNeed(m).flatMap(_ => testLinkUi(m.hasUi, dir, m.name, outDir, update, pixels))
 
 def testLinkUi(hasUi: Bool, dir: String, name: String, outDir: String, update: Bool, pixels: Bool): IO[Unit] =
   if (hasUi) ensureUi().flatMap(_ => testLinkNamed(true, dir, name, outDir, update, pixels)) else testLinkNamed(false, dir, name, outDir, update, pixels)
@@ -713,7 +843,7 @@ def uiSnap(outDir: String, name: String, tap: Bool): String =
   joinSlash(outDir, if (tap) Str.concat(name, "_after_tap.actual.png") else Str.concat(name, ".actual.png"))
 
 def testUiRun(dir: String, name: String, runEnv: String, golden: String, actual: String, update: Bool, pixels: Bool, tap: Bool, arg: String, outDir: String): IO[Unit] =
-  runLine(Str.concat("cd ", Str.concat(dir, Str.concat(" && ", Str.concat(runEnv, Str.concat(joinSlash("build", name), arg)))))).flatMap(r => testUiAfter(r, golden, actual, update, pixels, tap, dir, outDir, name))
+  runLine(Str.concat("cd ", Str.concat(dir, Str.concat(" && ", Str.concat(runEnv, Str.concat(exeAfterCd(dir, outDir, name), arg)))))).flatMap(r => testUiAfter(r, golden, actual, update, pixels, tap, dir, outDir, name))
 
 def testUiAfter(r: (Int, String, String), golden: String, actual: String, update: Bool, pixels: Bool, tap: Bool, dir: String, outDir: String, name: String): IO[Unit] =
   r match {
@@ -751,7 +881,7 @@ def testDiffUi(dir: String, outDir: String): IO[Unit] =
   ensureUi().flatMap(_ => Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => testDiffMan(dir, outDir, Manifest.parse(toml))))
 
 def testDiffMan(dir: String, outDir: String, m: Man): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)).flatMap(_ => IO.fail("toml")) else if (!m.hasUi) IO.println("--differential needs a [ui] package").flatMap(_ => IO.fail("differential")) else testDiffBackends(dir, outDir, m.name, "skia" :: "sk_sw" :: "gpu" :: [], [])
+  manNeed(m).flatMap(_ => if (!m.hasUi) IO.println("--differential needs a [ui] package").flatMap(_ => IO.fail("differential")) else testDiffBackends(dir, outDir, m.name, "skia" :: "sk_sw" :: "gpu" :: [], []))
 
 def testDiffBackends(dir: String, outDir: String, name: String, rest: List[String], dumps: List[String]): IO[Unit] =
   if (List.isEmpty(rest)) testDiffDone(dumps) else testDiffOne(dir, outDir, name, List.at(rest, 0), List.tail(rest), dumps)
@@ -776,7 +906,7 @@ def skiaMake(backend: String): IO[Bool] =
 
 def skiaMakeGot(r: (Int, String, String), backend: String): IO[Bool] =
   r match {
-    case (code, _out, err) => if (code != 0) IO.println(Str.concat("differential: backend unavailable: ", backend)).map(_ => false) else IO.pure(true)
+    case (code, _out, err) => if (code != 0) IO.println(Str.concat("differential: backend unavailable: ", backend)).flatMap(_ => IO.pure(false)) else IO.pure(true)
   }
 
 def testDiffLink(dir: String, outDir: String, name: String, backend: String, rest: List[String], dumps: List[String]): IO[Unit] =
@@ -800,7 +930,7 @@ def testDiffKeep(dir: String, outDir: String, name: String, rest: List[String],
   if (a == "" || b == "") testDiffBackends(dir, outDir, name, rest, dumps) else testDiffBackends(dir, outDir, name, rest, Str.concat(a, b) :: dumps)
 
 def testDiffDump(dir: String, name: String, toml: String, arg: String, backend: String, tap: Bool): IO[String] =
-  runLine(Str.concat("cd ", Str.concat(dir, Str.concat(" && ", Str.concat(uiDumpEnvOf(toml, uiDumpRel(name, tap), uiSnapRel(name, tap), tap), Str.concat(joinSlash("build", name), arg)))))).flatMap(r => testDiffDumpGot(r, dir, name, tap, backend))
+  runLine(Str.concat("cd ", Str.concat(dir, Str.concat(" && ", Str.concat(uiDumpEnvOf(toml, uiDumpRel(name, tap), uiSnapRel(name, tap), tap), Str.concat(exeAfterCd(dir, joinSlash(dir, "build"), name), arg)))))).flatMap(r => testDiffDumpGot(r, dir, name, tap, backend))
 
 def testDiffDumpGot(r: (Int, String, String), dir: String, name: String, tap: Bool, _backend: String): IO[String] =
   r match {
@@ -831,16 +961,7 @@ def badTarget(t: String): String =
   Str.concat("unknown package target '", Str.concat(t, "' (host|android|ios|all). Example: scuzz package --target host"))
 
 def bundleIdOf(toml: String): String =
-  bundleIdAt(toml, Str.indexOf(toml, "bundle_id"))
-
-def bundleIdAt(toml: String, i: Int): String =
-  if (i < 0) "dev.scuzz.app" else bundleIdTake(toml, skipSp(toml, i + 9))
-
-def bundleIdTake(toml: String, i: Int): String =
-  if (i >= Str.len(toml) || Str.charAt(toml, i) != 34) "dev.scuzz.app" else bundleIdQuoted(toml, i + 1, i + 1)
-
-def bundleIdQuoted(toml: String, start: Int, j: Int): String =
-  if (j >= Str.len(toml) || Str.charAt(toml, j) == 34) Str.slice(toml, start, j) else bundleIdQuoted(toml, start, j + 1)
+  Manifest.uiBundle(Manifest.manUi(Manifest.parse(toml)))
 
 def hostRunSh(name: String): String =
   Str.concat("#!/usr/bin/env bash\n# Host Mobile shell smoke. Same app binary; Mobile peer + host embedder.\nset -euo pipefail\nDIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\nexport SCUZZ_UI_RUNTIME=mobile\nexport SCUZZ_MOBILE_SHELL=1\nexec \"$DIR/", Str.concat(name, "\" \"$@\"\n"))
@@ -866,7 +987,7 @@ def compileLinkedMan(dir: String, outDir: String): IO[Unit] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => compileLinkedUi(Manifest.parse(toml), outDir))
 
 def compileLinkedUi(m: Man, outDir: String): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)).flatMap(_ => IO.fail("toml")) else if (m.hasUi) ensureUi().flatMap(_ => linkOnly(true, m.name, outDir)) else linkOnly(false, m.name, outDir)
+  manNeed(m).flatMap(_ => if (m.hasUi) ensureUi().flatMap(_ => linkOnly(true, m.name, outDir)) else linkOnly(false, m.name, outDir))
 
 def pkgDir(dir: String, outDir: String, target: String): IO[Unit] =
   if (target == "host") pkgHost(dir, outDir) else if (target == "android") pkgAndroid(dir, outDir) else if (target == "ios") pkgIos(dir, outDir) else if (target == "all") pkgHost(dir, outDir).flatMap(_ => pkgAndroid(dir, outDir).flatMap(_ => pkgIos(dir, outDir))) else IO.println(badTarget(target)).flatMap(_ => IO.fail("package"))
@@ -878,13 +999,13 @@ def pkgHostMan(dir: String, outDir: String): IO[Unit] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => pkgHostNamed(Manifest.parse(toml), dir, outDir, toml))
 
 def pkgHostNamed(m: Man, _dir: String, outDir: String, toml: String): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)).flatMap(_ => IO.fail("toml")) else pkgHostCopy(m.name, exeName(outDir, m.name), joinSlash(joinSlash(outDir, "package"), "host"), bundleIdOf(toml))
+  manNeed(m).flatMap(_ => pkgHostCopy(m.name, exeName(outDir, m.name), joinSlash(joinSlash(outDir, "package"), "host"), Manifest.uiBundle(Manifest.manUi(m))))
 
 def pkgHostCopy(name: String, exe: String, dest: String, id: String): IO[Unit] =
   Fs.mkdirs(dest).flatMap(_ => pkgHostCp(name, exe, dest, id))
 
 def pkgHostCp(name: String, exe: String, dest: String, id: String): IO[Unit] =
-  runLine(Str.concat("cp ", Str.concat(exe, Str.concat(" ", joinSlash(dest, name))))).flatMap(r => pkgHostChmod(r, name, dest, id))
+  runLine(Str.concat("cp ", Str.concat(shQuote(exe), Str.concat(" ", shQuote(joinSlash(dest, name)))))).flatMap(r => pkgHostChmod(r, name, dest, id))
 
 def pkgHostChmod(r: (Int, String, String), name: String, dest: String, id: String): IO[Unit] =
   r match {
@@ -895,23 +1016,44 @@ def pkgHostCpFail(err: String): IO[Unit] =
   IO.println(err).flatMap(_ => IO.fail("cp"))
 
 def pkgHostChmodOk(name: String, dest: String, id: String): IO[Unit] =
-  runLine(Str.concat("chmod +x ", joinSlash(dest, name))).flatMap(_ => pkgHostWrite(name, dest, id))
+  runLine(Str.concat("chmod +x ", shQuote(joinSlash(dest, name)))).flatMap(_ => pkgHostWrite(name, dest, id))
 
 def pkgHostWrite(name: String, dest: String, id: String): IO[Unit] =
-  Fs.write(joinSlash(dest, "run.sh"), hostRunSh(name)).flatMap(_ => runLine(Str.concat("chmod +x ", joinSlash(dest, "run.sh"))).flatMap(_ => Fs.write(joinSlash(dest, "package.toml"), hostMeta(name, id)).flatMap(_ => IO.println(Str.concat("packaged host -> ", dest)).flatMap(_ => IO.println(Str.concat("scuzz package ok (", Str.concat(dest, ")")))))))
+  Fs.write(joinSlash(dest, "run.sh"), hostRunSh(name)).flatMap(_ => runLine(Str.concat("chmod +x ", shQuote(joinSlash(dest, "run.sh")))).flatMap(_ => Fs.write(joinSlash(dest, "package.toml"), hostMeta(name, id)).flatMap(_ => IO.println(Str.concat("packaged host -> ", dest)).flatMap(_ => IO.println(Str.concat("scuzz package ok (", Str.concat(dest, ")")))))))
+
+def pkgScuzzEnv(h: String): String =
+  if (h == "") "" else Str.concat("SCUZZ=", Str.concat(shQuote(joinSlash(h, "bin/scuzz")), " "))
 
 def pkgEnvId(id: String): String =
-  Str.concat("SCUZZ_BUNDLE_ID=", Str.concat(id, " "))
+  Str.concat("SCUZZ_BUNDLE_ID=", Str.concat(shQuote(id), " "))
+
+def pkgBash(h: String, rel: String, dir: String, id: String): String =
+  Str.concat(pkgScuzzEnv(h), Str.concat(pkgEnvId(id), Str.concat("bash ", Str.concat(shQuote(crateAt(h, rel)), Str.concat(" ", shQuote(dir))))))
+
+def pkgAndroidCmd(h: String, dir: String, id: String): String =
+  pkgBash(h, "crates/embedder-mobile/shells/android/build_ndk.sh", dir, id)
+
+def pkgAndroidApkCmd(h: String, dir: String, id: String): String =
+  pkgBash(h, "crates/embedder-mobile/shells/android/build_apk.sh", dir, id)
+
+def pkgIosCmd(h: String, dir: String, id: String): String =
+  pkgBash(h, "crates/embedder-mobile/shells/ios/build_sim.sh", dir, id)
+
+def pkgAndroidAdbCmd(h: String, apk: String): String =
+  Str.concat("bash ", Str.concat(shQuote(crateAt(h, "crates/embedder-mobile/shells/android/install_apk.sh")), Str.concat(" ", shQuote(apk))))
 
 def pkgAndroid(dir: String, outDir: String): IO[Unit] =
-  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => pkgAndroidGo(dir, outDir, bundleIdOf(toml)))
+  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => pkgAndroidMan(dir, outDir, Manifest.parse(toml)))
+
+def pkgAndroidMan(dir: String, outDir: String, m: Man): IO[Unit] =
+  manNeed(m).flatMap(_ => pkgAndroidGo(dir, outDir, Manifest.uiBundle(Manifest.manUi(m))))
 
 def pkgAndroidGo(dir: String, outDir: String, id: String): IO[Unit] =
-  crateHome().flatMap(h => runLine(Str.concat("bash ", Str.concat(crateAt(h, "crates/embedder-mobile/shells/android/build_ndk.sh"), Str.concat(" ", dir)))).flatMap(r => pkgAndroidNdk(h, r, dir, outDir, id)))
+  Sys.getenv("SCUZZ_HOME").flatMap(h => runLine(pkgAndroidCmd(h, dir, id)).flatMap(r => pkgAndroidNdk(h, r, dir, outDir, id)))
 
 def pkgAndroidNdk(h: String, r: (Int, String, String), dir: String, outDir: String, id: String): IO[Unit] =
   r match {
-    case (code, out, err) => if (code != 0) pkgAndroidFail(out, err) else runLine(Str.concat(pkgEnvId(id), Str.concat("bash ", Str.concat(crateAt(h, "crates/embedder-mobile/shells/android/build_apk.sh"), Str.concat(" ", dir))))).flatMap(r2 => pkgAndroidApk(r2, dir, outDir))
+    case (code, out, err) => if (code != 0) pkgAndroidFail(out, err) else runLine(pkgAndroidApkCmd(h, dir, id)).flatMap(r2 => pkgAndroidApk(r2, dir, outDir))
   }
 
 def pkgAndroidApk(r: (Int, String, String), dir: String, outDir: String): IO[Unit] =
@@ -923,7 +1065,7 @@ def pkgAndroidStage(dir: String, outDir: String): IO[Unit] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => pkgAndroidNamed(Manifest.parse(toml), dir, outDir, toml))
 
 def pkgAndroidNamed(m: Man, dir: String, outDir: String, toml: String): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)).flatMap(_ => IO.fail("toml")) else pkgAndroidCopy(m.name, dir, joinSlash(joinSlash(outDir, "package"), "android"), bundleIdOf(toml))
+  manNeed(m).flatMap(_ => pkgAndroidCopy(m.name, dir, joinSlash(joinSlash(outDir, "package"), "android"), Manifest.uiBundle(Manifest.manUi(m))))
 
 def androidLib(dir: String): String =
   joinSlash(joinSlash(joinSlash(dir, "build"), "android"), "lib")
@@ -935,7 +1077,7 @@ def pkgAndroidCopy(name: String, dir: String, dest: String, id: String): IO[Unit
   Fs.mkdirs(dest).flatMap(_ => pkgAndroidCpSo(name, dir, dest, id))
 
 def pkgAndroidCpSo(name: String, dir: String, dest: String, id: String): IO[Unit] =
-  runLine(Str.concat("rm -rf ", Str.concat(joinSlash(dest, "lib"), Str.concat(" && cp -a ", Str.concat(androidLib(dir), Str.concat(" ", joinSlash(dest, "lib"))))))).flatMap(r => pkgAndroidCpSoGot(r, name, dir, dest, id))
+  runLine(Str.concat("rm -rf ", Str.concat(shQuote(joinSlash(dest, "lib")), Str.concat(" && cp -a ", Str.concat(shQuote(androidLib(dir)), Str.concat(" ", shQuote(joinSlash(dest, "lib")))))))).flatMap(r => pkgAndroidCpSoGot(r, name, dir, dest, id))
 
 def pkgAndroidCpSoGot(r: (Int, String, String), name: String, dir: String, dest: String, id: String): IO[Unit] =
   r match {
@@ -943,7 +1085,7 @@ def pkgAndroidCpSoGot(r: (Int, String, String), name: String, dir: String, dest:
   }
 
 def pkgAndroidCpApk(name: String, dir: String, dest: String, id: String): IO[Unit] =
-  runLine(Str.concat("cp ", Str.concat(androidApk(dir, name), Str.concat(" ", joinSlash(dest, Str.concat(name, ".apk")))))).flatMap(r => pkgAndroidCpApkGot(r, name, dest, id))
+  runLine(Str.concat("cp ", Str.concat(shQuote(androidApk(dir, name)), Str.concat(" ", shQuote(joinSlash(dest, Str.concat(name, ".apk"))))))).flatMap(r => pkgAndroidCpApkGot(r, name, dest, id))
 
 def pkgAndroidCpApkGot(r: (Int, String, String), name: String, dest: String, id: String): IO[Unit] =
   r match {
@@ -954,7 +1096,7 @@ def pkgAndroidWrite(name: String, dest: String, id: String): IO[Unit] =
   Fs.write(joinSlash(dest, "package.toml"), androidMeta(name, id)).flatMap(_ => pkgAndroidAdb(name, dest))
 
 def pkgAndroidAdb(name: String, dest: String): IO[Unit] =
-  crateHome().flatMap(h => runLine(Str.concat("bash ", Str.concat(crateAt(h, "crates/embedder-mobile/shells/android/install_apk.sh"), Str.concat(" ", joinSlash(dest, Str.concat(name, ".apk")))))).flatMap(r => pkgAndroidAdbGot(r, dest)))
+  Sys.getenv("SCUZZ_HOME").flatMap(h => runLine(pkgAndroidAdbCmd(h, joinSlash(dest, Str.concat(name, ".apk")))).flatMap(r => pkgAndroidAdbGot(r, dest)))
 
 def pkgAndroidAdbGot(r: (Int, String, String), dest: String): IO[Unit] =
   r match {
@@ -985,10 +1127,13 @@ def pkgIosMiss(): IO[Unit] =
   IO.println(xcodeMiss()).flatMap(_ => IO.fail("ios"))
 
 def pkgIosToml(dir: String, outDir: String): IO[Unit] =
-  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => pkgIosBuild(dir, outDir, bundleIdOf(toml)))
+  Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => pkgIosMan(dir, outDir, Manifest.parse(toml)))
+
+def pkgIosMan(dir: String, outDir: String, m: Man): IO[Unit] =
+  manNeed(m).flatMap(_ => pkgIosBuild(dir, outDir, Manifest.uiBundle(Manifest.manUi(m))))
 
 def pkgIosBuild(dir: String, outDir: String, id: String): IO[Unit] =
-  crateHome().flatMap(h => runLine(Str.concat(pkgEnvId(id), Str.concat("bash ", Str.concat(crateAt(h, "crates/embedder-mobile/shells/ios/build_sim.sh"), Str.concat(" ", dir))))).flatMap(r2 => pkgIosRun(r2, dir, outDir)))
+  Sys.getenv("SCUZZ_HOME").flatMap(h => runLine(pkgIosCmd(h, dir, id)).flatMap(r2 => pkgIosRun(r2, dir, outDir)))
 
 def pkgIosRun(r: (Int, String, String), dir: String, outDir: String): IO[Unit] =
   r match {
@@ -1005,13 +1150,13 @@ def pkgIosStage(dir: String, outDir: String): IO[Unit] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => pkgIosNamed(Manifest.parse(toml), dir, outDir, toml))
 
 def pkgIosNamed(m: Man, dir: String, outDir: String, toml: String): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)).flatMap(_ => IO.fail("toml")) else pkgIosCopy(m.name, dir, joinSlash(joinSlash(outDir, "package"), "ios"), bundleIdOf(toml))
+  manNeed(m).flatMap(_ => pkgIosCopy(m.name, dir, joinSlash(joinSlash(outDir, "package"), "ios"), Manifest.uiBundle(Manifest.manUi(m))))
 
 def pkgIosCopy(name: String, dir: String, dest: String, id: String): IO[Unit] =
   Fs.mkdirs(dest).flatMap(_ => pkgIosCp(name, dir, dest, id))
 
 def pkgIosCp(name: String, dir: String, dest: String, id: String): IO[Unit] =
-  runLine(Str.concat("rm -rf ", Str.concat(joinSlash(dest, Str.concat(name, ".app")), Str.concat(" && cp -a ", Str.concat(iosApp(dir, name), Str.concat(" ", joinSlash(dest, Str.concat(name, ".app")))))))).flatMap(r => pkgIosCpGot(r, name, dest, id))
+  runLine(Str.concat("rm -rf ", Str.concat(shQuote(joinSlash(dest, Str.concat(name, ".app"))), Str.concat(" && cp -a ", Str.concat(shQuote(iosApp(dir, name)), Str.concat(" ", shQuote(joinSlash(dest, Str.concat(name, ".app"))))))))).flatMap(r => pkgIosCpGot(r, name, dest, id))
 
 def pkgIosCpGot(r: (Int, String, String), name: String, dest: String, id: String): IO[Unit] =
   r match {
@@ -1039,7 +1184,10 @@ def fuzzVerSrcHd(dir: String, ent: (String, Bool), rest: List[(String, Bool)], a
   }
 
 def fuzzVerSrcPick(dir: String, name: String, isDir: Bool, rest: List[(String, Bool)], acc: List[String]): IO[List[String]] =
-  if (isDir || !isVerify(name)) fuzzVerSrcGo(dir, rest, acc) else Fs.read(joinSlash(dir, name)).flatMap(src => fuzzVerSrcGo(dir, rest, src :: acc))
+  if (isDir) fuzzVerSrcDir(dir, name, rest, acc) else if (!isVerify(name)) fuzzVerSrcGo(dir, rest, acc) else Fs.read(joinSlash(dir, name)).flatMap(src => fuzzVerSrcGo(dir, rest, src :: acc))
+
+def fuzzVerSrcDir(dir: String, name: String, rest: List[(String, Bool)], acc: List[String]): IO[List[String]] =
+  if (skipWalk(name)) fuzzVerSrcGo(dir, rest, acc) else Fs.list(joinSlash(dir, name)).flatMap(sub => fuzzVerSrcGo(joinSlash(dir, name), sub, acc).flatMap(got => fuzzVerSrcGo(dir, rest, got)))
 
 def fuzzLiveBuild(dir: String, outDir: String): IO[Unit] =
   fuzzLiveCollect(dir).flatMap(files => fuzzLiveEmit(dir, joinSlash(outDir, "live"), files))
@@ -1051,12 +1199,7 @@ def fuzzLiveCollect(dir: String): IO[List[(String, String)]] =
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => fuzzLiveMan(dir, Manifest.parse(toml)))
 
 def fuzzLiveMan(dir: String, m: Man): IO[List[(String, String)]] =
-  m match {
-    case Man(ok, _name, _version, _hasUi, deps, err) => fuzzLiveMan2(dir, ok, err, deps)
-  }
-
-def fuzzLiveMan2(dir: String, ok: Bool, err: String, deps: List[(String, String)]): IO[List[(String, String)]] =
-  if (!ok) IO.println(Str.concat("fail:", err)).flatMap(_ => IO.pure(Manifest.noPairs())) else Fs.list(joinSlash(dir, "src")).flatMap(ents => fuzzLiveListed(dir, deps, ents))
+  manNeed(m).flatMap(_ => Fs.list(joinSlash(dir, "src")).flatMap(ents => fuzzLiveListed(dir, m.deps, ents)))
 
 def fuzzLiveListed(dir: String, deps: List[(String, String)], ents: List[(String, Bool)]): IO[List[(String, String)]] =
   readSrcFiles(joinSlash(dir, "src"), ents).flatMap(own => collectDeps(dir, deps, own))
@@ -1065,19 +1208,19 @@ def fuzzLinked(dir: String, outDir: String, iterations: Int, seed: Int, replay:
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => fuzzMan(Manifest.parse(toml), dir, outDir, iterations, seed, replay, files, noFailFast, oracles))
 
 def fuzzMan(m: Man, dir: String, outDir: String, iterations: Int, seed: Int, replay: String, files: List[(String, String)], noFailFast: Bool, oracles: Bool): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)).flatMap(_ => IO.fail("toml")) else fuzzMan2(FuzzJob(dir, outDir, exeName(outDir, m.name), m.name, m.hasUi, iterations, seed, noFailFast, files, oracles), replay)
+  manNeed(m).flatMap(_ => fuzzMan2(FuzzJob(dir, outDir, exeName(outDir, m.name), m.name, m.hasUi, iterations, seed, noFailFast, files, oracles, if (m.hasUi) headlessEnvMan(m) else ""), replay))
 
 def fuzzMan2(job: FuzzJob, replay: String): IO[Unit] =
-  if (replay != "") fuzzReplayFile(job.outDir, job.exe, job.hasUi, replay) else fuzzBody(job)
+  if (replay != "") fuzzReplayFile(job.outDir, job.exe, job.hasUi, replay, job.uiEnv) else fuzzBody(job)
 
-def fuzzReplayFile(outDir: String, exe: String, hasUi: Bool, replay: String): IO[Unit] =
-  Fs.read(replay).flatMap(src => fuzzReplayGot(outDir, exe, hasUi, replay, src))
+def fuzzReplayFile(outDir: String, exe: String, hasUi: Bool, replay: String, uiEnv: String): IO[Unit] =
+  Fs.read(replay).flatMap(src => fuzzReplayGot(outDir, exe, hasUi, replay, src, uiEnv))
 
-def fuzzReplayGot(outDir: String, exe: String, hasUi: Bool, replay: String, src: String): IO[Unit] =
-  fuzzReplayRun(outDir, exe, hasUi, replay, fuzzRunOf(replay, src))
+def fuzzReplayGot(outDir: String, exe: String, hasUi: Bool, replay: String, src: String, uiEnv: String): IO[Unit] =
+  fuzzReplayRun(outDir, exe, hasUi, replay, fuzzRunOf(replay, src), uiEnv)
 
-def fuzzReplayRun(outDir: String, exe: String, hasUi: Bool, replay: String, run: FuzzRun): IO[Unit] =
-  IO.println(fuzzReplayHead(replay, run)).flatMap(_ => fuzzWriteDrive(outDir, run.script).flatMap(_ => fuzzProbeRun(exe, hasUi, outDir, run).flatMap(bad => fuzzReplayDone(bad))))
+def fuzzReplayRun(outDir: String, exe: String, hasUi: Bool, replay: String, run: FuzzRun, uiEnv: String): IO[Unit] =
+  IO.println(fuzzReplayHead(replay, run)).flatMap(_ => fuzzWriteDrive(outDir, run.script).flatMap(_ => fuzzProbeRun(exe, hasUi, outDir, run, uiEnv).flatMap(bad => fuzzReplayDone(bad))))
 
 def fuzzReplayHead(replay: String, run: FuzzRun): String =
   Str.concat("scuzz fuzz --replay ", Str.concat(replay, Str.concat(" (", Str.concat(Str.fromInt(List.len(Verify.linesOf(run.script))), " events)"))))
@@ -1095,22 +1238,25 @@ def fuzzBody2(job: FuzzJob, script: String): IO[Unit] =
   fuzzWriteSeeds(job.outDir, script).flatMap(_ => fuzzCorpusFiles(job.dir).flatMap(runs => fuzzBody3(job, script, runs)))
 
 def fuzzBody3(job: FuzzJob, script: String, runs: List[FuzzRun]): IO[Unit] =
-  fuzzSplit(job).flatMap(_ => fuzzReplayGo(job.exe, job.hasUi, job.outDir, job.seed, fuzzAddSeeds(runs, joinSlash(job.outDir, "seeds.txt"), script), FuzzAcc(0, 0, "")).flatMap(acc => fuzzAfterReplay(job, script, List.len(fuzzAddSeeds(runs, joinSlash(job.outDir, "seeds.txt"), script)), acc)))
+  fuzzBody4(job, script, fuzzAddSeeds(runs, joinSlash(job.outDir, "seeds.txt"), script))
+
+def fuzzBody4(job: FuzzJob, script: String, runs: List[FuzzRun]): IO[Unit] =
+  fuzzSplit(job).flatMap(_ => fuzzReplayGo(job.exe, job.hasUi, job.outDir, job.seed, runs, FuzzAcc(0, 0, ""), job.uiEnv).flatMap(acc => fuzzAfterReplay(job, script, runs, acc)))
 
-def fuzzAfterReplay(job: FuzzJob, script: String, corpus: Int, acc: FuzzAcc): IO[Unit] =
-  if (acc.fail > 0 && !job.noFailFast) fuzzDone(job, corpus, acc.fail, acc.corpFail, acc.repro, emptyMut(Mutate.countFiles(job.files, job.oracles))) else fuzzSearch(job.exe, job.hasUi, job.outDir, script, Verify.searchN(job.iterations), 0, 1, job.seed).flatMap(fail => fuzzAfterSearch(job, script, corpus, acc, fail))
+def fuzzAfterReplay(job: FuzzJob, script: String, runs: List[FuzzRun], acc: FuzzAcc): IO[Unit] =
+  if (acc.fail > 0 && !job.noFailFast) fuzzDone(job, List.len(runs), acc.fail, acc.corpFail, acc.repro, emptyMut(Mutate.countFiles(job.files, job.oracles))) else fuzzSearch(job.exe, job.hasUi, job.outDir, script, Verify.searchN(job.iterations), 0, 0, job.seed, job.uiEnv).flatMap(fail => fuzzAfterSearch(job, script, runs, acc, fail))
 
-def fuzzAfterSearch(job: FuzzJob, script: String, corpus: Int, acc: FuzzAcc, fail: Int): IO[Unit] =
-  if (fail > 0 && acc.repro == "") fuzzAfterSearchFail(job, script, corpus, acc, fail) else fuzzMutate(job, corpus, fail, acc.corpFail, acc.repro)
+def fuzzAfterSearch(job: FuzzJob, script: String, runs: List[FuzzRun], acc: FuzzAcc, fail: Int): IO[Unit] =
+  if (fail > 0 && acc.repro == "") fuzzAfterSearchFail(job, script, runs, acc, fail) else fuzzMutate(job, runs, fail, acc.corpFail, acc.repro)
 
-def fuzzAfterSearchFail(job: FuzzJob, script: String, corpus: Int, acc: FuzzAcc, fail: Int): IO[Unit] =
-  if (job.hasUi) fuzzSearchFail(job, script, corpus, acc, fail) else fuzzMutate(job, corpus, fail, acc.corpFail, joinSlash(joinSlash(job.outDir, "fuzz"), "repro.toml"))
+def fuzzAfterSearchFail(job: FuzzJob, script: String, runs: List[FuzzRun], acc: FuzzAcc, fail: Int): IO[Unit] =
+  if (job.hasUi) fuzzSearchFail(job, script, runs, acc, fail) else fuzzMutate(job, runs, fail, acc.corpFail, joinSlash(joinSlash(job.outDir, "fuzz"), "repro.toml"))
 
-def fuzzSearchFail(job: FuzzJob, script: String, corpus: Int, acc: FuzzAcc, fail: Int): IO[Unit] =
-  fuzzSaveRepro(job.outDir, job.seed, FuzzRun(joinSlash(job.outDir, "seeds.txt"), "", fuzzFailScript(job, script), "", "")).flatMap(path => fuzzSearchFail2(job, script, corpus, acc, fail, path))
+def fuzzSearchFail(job: FuzzJob, script: String, runs: List[FuzzRun], acc: FuzzAcc, fail: Int): IO[Unit] =
+  fuzzSaveRepro(job.outDir, job.seed, FuzzRun(joinSlash(job.outDir, "seeds.txt"), "", fuzzFailScript(job, script), "", "")).flatMap(path => fuzzSearchFail2(job, script, runs, acc, fail, path))
 
-def fuzzSearchFail2(job: FuzzJob, script: String, corpus: Int, acc: FuzzAcc, fail: Int, path: String): IO[Unit] =
-  if (!job.hasUi || script != "") fuzzMutate(job, corpus, fail, acc.corpFail, path) else fuzzPromoteTap(job).flatMap(_ => fuzzMutate(job, corpus + 1, fail, acc.corpFail, path))
+def fuzzSearchFail2(job: FuzzJob, script: String, runs: List[FuzzRun], acc: FuzzAcc, fail: Int, path: String): IO[Unit] =
+  if (!job.hasUi || script != "") fuzzMutate(job, runs, fail, acc.corpFail, path) else fuzzPromoteTap(job).flatMap(_ => fuzzMutate(job, List.concat(runs, fuzzSeedRun(joinSlash(job.outDir, "seeds.txt"), "tap 0") :: noRuns()), fail, acc.corpFail, path))
 
 def fuzzFailScript(job: FuzzJob, script: String): String =
   if (job.hasUi && script == "") """tap 0
@@ -1132,7 +1278,10 @@ def fuzzHasSim(dir: String, deps: List[(String, String)]): IO[Bool] =
   fuzzHasSimDir(joinSlash(dir, "src")).flatMap(hit => if (hit) IO.pure(true) else fuzzHasSimDeps(dir, deps))
 
 def fuzzHasSimDir(srcDir: String): IO[Bool] =
-  Fs.list(srcDir).map(ents => fuzzHasSimEnts(ents)).handleErrorWith(_ => IO.pure(false))
+  Fs.list(srcDir).flatMap(ents => fuzzHasSimDirGot(ents)).handleErrorWith(_ => IO.pure(false))
+
+def fuzzHasSimDirGot(ents: List[(String, Bool)]): IO[Bool] =
+  IO.pure(fuzzHasSimEnts(ents))
 
 def fuzzHasSimEnts(ents: List[(String, Bool)]): Bool =
   if (List.isEmpty(ents)) false else fuzzHasSimHd(List.at(ents, 0), List.tail(ents))
@@ -1160,7 +1309,7 @@ def fuzzSplitGo(job: FuzzJob): IO[Unit] =
   Fs.mkdirs(joinSlash(job.outDir, "fuzz")).flatMap(_ => Fs.mkdirs(joinSlash(joinSlash(job.outDir, "fuzz"), "live")).flatMap(_ => fuzzSplitRun(job)))
 
 def fuzzSplitRun(job: FuzzJob): IO[Unit] =
-  fuzzSplitProbe(job.exe, job.hasUi, fuzzDumpPath(job.outDir), fuzzTlPath(job.outDir)).flatMap(cv => fuzzSplitRunGo(job, cv))
+  fuzzSplitProbe(job.exe, job.hasUi, fuzzDumpPath(job.outDir), fuzzTlPath(job.outDir), job.uiEnv).flatMap(cv => fuzzSplitRunGo(job, cv))
 
 def fuzzSplitRunGo(job: FuzzJob, cv: Int): IO[Unit] =
   if (cv != 0) failMsg("fuzz probe failed: app fails under TestRuntime before any event", "scuzz fuzz") else fuzzSplitLive(job)
@@ -1169,16 +1318,16 @@ def fuzzTlPath(outDir: String): String =
   joinSlash(joinSlash(outDir, "fuzz"), "timeline.txt")
 
 def fuzzSplitLive(job: FuzzJob): IO[Unit] =
-  fuzzSplitProbe(fuzzLiveExe(job), job.hasUi, joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "live"), "dump.txt"), joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "live"), "timeline.txt")).flatMap(cl => fuzzSplitLiveGo(job, cl))
+  fuzzSplitProbe(fuzzLiveExe(job), job.hasUi, joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "live"), "dump.txt"), joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "live"), "timeline.txt"), job.uiEnv).flatMap(cl => fuzzSplitLiveGo(job, cl))
 
 def fuzzSplitLiveGo(job: FuzzJob, cl: Int): IO[Unit] =
   if (cl != 0) failMsg("fuzz live/verify split: live graph failed on the same seed", "scuzz fuzz") else fuzzSplitCmp(job)
 
-def fuzzSplitProbe(exe: String, hasUi: Bool, dump: String, tl: String): IO[Int] =
-  runProbe(Str.concat(fuzzSplitEnv(hasUi, dump, tl), exe)).map(r => fuzzProbeCode(r))
+def fuzzSplitProbe(exe: String, hasUi: Bool, dump: String, tl: String, uiEnv: String): IO[Int] =
+  runProbe(Str.concat(fuzzSplitEnv(hasUi, dump, tl, uiEnv), exe)).flatMap(r => fuzzProbeCodeIo(r))
 
-def fuzzSplitEnv(hasUi: Bool, dump: String, tl: String): String =
-  Str.concat(testEnv(), Str.concat(if (hasUi) headlessEnv() else "", Str.concat(Str.concat("SCUZZ_FUZZ_DUMP=", Str.concat(dump, " ")), fuzzTlEnv(tl))))
+def fuzzSplitEnv(hasUi: Bool, dump: String, tl: String, uiEnv: String): String =
+  Str.concat(testEnv(), Str.concat(if (hasUi) uiEnv else "", Str.concat(Str.concat("SCUZZ_FUZZ_DUMP=", Str.concat(dump, " ")), fuzzTlEnv(tl))))
 
 def fuzzSplitCmp(job: FuzzJob): IO[Unit] =
   fuzzReadOr(fuzzDumpPath(job.outDir)).flatMap(vd => fuzzReadOr(joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "live"), "dump.txt")).flatMap(ld => fuzzReadOr(fuzzTlPath(job.outDir)).flatMap(vt => fuzzReadOr(joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "live"), "timeline.txt")).flatMap(lt => fuzzSplitEq(ld, vd, lt, vt)))))
@@ -1230,14 +1379,14 @@ def fuzzHasScript(runs: List[FuzzRun], script: String): Bool =
 def fuzzHasScriptHd(h: FuzzRun, rest: List[FuzzRun], script: String): Bool =
   h.script == script || fuzzHasScript(rest, script)
 
-def fuzzReplayGo(exe: String, hasUi: Bool, outDir: String, seed: Int, runs: List[FuzzRun], acc: FuzzAcc): IO[FuzzAcc] =
-  if (List.isEmpty(runs) || acc.fail > 0) IO.pure(acc) else fuzzReplayOne(exe, hasUi, outDir, seed, List.at(runs, 0), List.tail(runs), acc)
+def fuzzReplayGo(exe: String, hasUi: Bool, outDir: String, seed: Int, runs: List[FuzzRun], acc: FuzzAcc, uiEnv: String): IO[FuzzAcc] =
+  if (List.isEmpty(runs) || acc.fail > 0) IO.pure(acc) else fuzzReplayOne(exe, hasUi, outDir, seed, List.at(runs, 0), List.tail(runs), acc, uiEnv)
 
-def fuzzReplayOne(exe: String, hasUi: Bool, outDir: String, seed: Int, h: FuzzRun, rest: List[FuzzRun], acc: FuzzAcc): IO[FuzzAcc] =
-  fuzzWriteDrive(outDir, h.script).flatMap(_ => fuzzProbeRun(exe, hasUi, outDir, h).flatMap(bad => fuzzReplayNext(exe, hasUi, outDir, seed, rest, acc, h, bad)))
+def fuzzReplayOne(exe: String, hasUi: Bool, outDir: String, seed: Int, h: FuzzRun, rest: List[FuzzRun], acc: FuzzAcc, uiEnv: String): IO[FuzzAcc] =
+  fuzzWriteDrive(outDir, h.script).flatMap(_ => fuzzProbeRun(exe, hasUi, outDir, h, uiEnv).flatMap(bad => fuzzReplayNext(exe, hasUi, outDir, seed, rest, acc, h, bad, uiEnv)))
 
-def fuzzReplayNext(exe: String, hasUi: Bool, outDir: String, seed: Int, rest: List[FuzzRun], acc: FuzzAcc, h: FuzzRun, bad: Int): IO[FuzzAcc] =
-  if (bad == 0) fuzzReplayGo(exe, hasUi, outDir, seed, rest, acc) else fuzzNoteFail(outDir, seed, h, acc).flatMap(next => fuzzReplayGo(exe, hasUi, outDir, seed, rest, next))
+def fuzzReplayNext(exe: String, hasUi: Bool, outDir: String, seed: Int, rest: List[FuzzRun], acc: FuzzAcc, h: FuzzRun, bad: Int, uiEnv: String): IO[FuzzAcc] =
+  if (bad == 0) fuzzReplayGo(exe, hasUi, outDir, seed, rest, acc, uiEnv) else fuzzNoteFail(outDir, seed, h, acc).flatMap(next => fuzzReplayGo(exe, hasUi, outDir, seed, rest, next, uiEnv))
 
 def fuzzNoteFail(outDir: String, seed: Int, run: FuzzRun, acc: FuzzAcc): IO[FuzzAcc] =
   fuzzSaveRepro(outDir, seed, run).flatMap(path => fuzzNoteFail2(outDir, run, acc, path))
@@ -1252,7 +1401,7 @@ def fuzzSaveRepro2(outDir: String, seed: Int, run: FuzzRun): IO[String] =
   fuzzSaveRepro3(joinSlash(joinSlash(outDir, "fuzz"), "repro.toml"), seed, run)
 
 def fuzzSaveRepro3(path: String, seed: Int, run: FuzzRun): IO[String] =
-  Fs.write(path, if (run.src != "") run.src else Verify.reproText(seed, run.sched, run.fault, Verify.linesOf(run.script))).map(_ => path)
+  Fs.write(path, if (run.src != "") run.src else Verify.reproText(seed, run.sched, run.fault, Verify.linesOf(run.script))).flatMap(_ => IO.pure(path))
 
 def fuzzDrivePath(outDir: String): String =
   joinSlash(joinSlash(outDir, "fuzz"), "drive.txt")
@@ -1270,33 +1419,42 @@ def fuzzWriteDrive(outDir: String, script: String): IO[Unit] =
   Fs.mkdirs(joinSlash(outDir, "fuzz")).flatMap(_ => Fs.write(fuzzDrivePath(outDir), script))
 
 def fuzzSeedText(dir: String, files: List[(String, String)]): IO[String] =
-  Fs.list(dir).flatMap(ents => fuzzSeedGo(dir, ents, Verify.noStr(), Verify.ensOfFiles(files)))
+  Fs.list(dir).flatMap(ents => fuzzSeedGo(dir, ents, Verify.noStr(), Verify.ensOfFiles(files)).flatMap(acc => fuzzSeedTextGot(acc)))
+
+def fuzzSeedTextGot(acc: List[String]): IO[String] =
+  IO.pure(Verify.nls(Verify.sortStrs(acc)))
 
-def fuzzSeedGo(dir: String, ents: List[(String, Bool)], acc: List[String], ens: List[En]): IO[String] =
-  if (List.isEmpty(ents)) IO.pure(Verify.nls(Verify.sortStrs(acc))) else fuzzSeedHd(dir, List.at(ents, 0), List.tail(ents), acc, ens)
+def fuzzSeedGo(dir: String, ents: List[(String, Bool)], acc: List[String], ens: List[En]): IO[List[String]] =
+  if (List.isEmpty(ents)) IO.pure(acc) else fuzzSeedHd(dir, List.at(ents, 0), List.tail(ents), acc, ens)
 
-def fuzzSeedHd(dir: String, ent: (String, Bool), rest: List[(String, Bool)], acc: List[String], ens: List[En]): IO[String] =
+def fuzzSeedHd(dir: String, ent: (String, Bool), rest: List[(String, Bool)], acc: List[String], ens: List[En]): IO[List[String]] =
   ent match {
     case (name, isDir) => fuzzSeedPick(dir, name, isDir, rest, acc, ens)
   }
 
-def fuzzSeedPick(dir: String, name: String, isDir: Bool, rest: List[(String, Bool)], acc: List[String], ens: List[En]): IO[String] =
-  if (isDir || !isVerify(name)) fuzzSeedGo(dir, rest, acc, ens) else Fs.read(joinSlash(dir, name)).flatMap(src => fuzzSeedGo(dir, rest, fuzzSeedAdd(acc, src, ens), ens))
+def fuzzSeedPick(dir: String, name: String, isDir: Bool, rest: List[(String, Bool)], acc: List[String], ens: List[En]): IO[List[String]] =
+  if (isDir) fuzzSeedDir(dir, name, rest, acc, ens) else if (!isVerify(name)) fuzzSeedGo(dir, rest, acc, ens) else Fs.read(joinSlash(dir, name)).flatMap(src => fuzzSeedGo(dir, rest, fuzzSeedAdd(acc, src, ens), ens))
+
+def fuzzSeedDir(dir: String, name: String, rest: List[(String, Bool)], acc: List[String], ens: List[En]): IO[List[String]] =
+  if (skipWalk(name)) fuzzSeedGo(dir, rest, acc, ens) else Fs.list(joinSlash(dir, name)).flatMap(sub => fuzzSeedGo(joinSlash(dir, name), sub, acc, ens).flatMap(got => fuzzSeedGo(dir, rest, got, ens)))
 
 def fuzzSeedAdd(acc: List[String], src: String, ens: List[En]): List[String] =
-  List.concat(acc, Verify.mapSeedE(Verify.parseVerify(src), ens))
+  List.concat(acc, Verify.mapSeedE(Verify.parseVerifyEns(src, ens), ens))
+
+def fuzzFaultOf(i: Int): String =
+  if (i <= 0) "" else Str.fromInt(i)
 
-def fuzzSearch(exe: String, hasUi: Bool, outDir: String, script: String, n: Int, fail: Int, i: Int, seed: Int): IO[Int] =
-  if (n <= 0) IO.pure(fail) else fuzzWriteDrive(outDir, script).flatMap(_ => fuzzProbeRun(exe, hasUi, outDir, FuzzRun("", "", script, Str.fromInt(i), "")).flatMap(bad => fuzzSearchHit(exe, hasUi, outDir, script, n, fail, i, seed, bad)))
+def fuzzSearch(exe: String, hasUi: Bool, outDir: String, script: String, n: Int, fail: Int, i: Int, seed: Int, uiEnv: String): IO[Int] =
+  if (n <= 0) IO.pure(fail) else fuzzWriteDrive(outDir, script).flatMap(_ => fuzzProbeRun(exe, hasUi, outDir, FuzzRun("", "", script, Str.fromInt(i), fuzzFaultOf(i)), uiEnv).flatMap(bad => fuzzSearchHit(exe, hasUi, outDir, script, n, fail, i, seed, bad, uiEnv)))
 
-def fuzzSearchHit(exe: String, hasUi: Bool, outDir: String, script: String, n: Int, fail: Int, i: Int, seed: Int, bad: Int): IO[Int] =
-  if (bad > 0 && fail == 0) fuzzSaveRepro(outDir, seed, FuzzRun(joinSlash(outDir, "seeds.txt"), "", script, Str.fromInt(i), "")).flatMap(_ => fuzzSearch(exe, hasUi, outDir, script, n - 1, fail + bad, i + 1, seed)) else fuzzSearch(exe, hasUi, outDir, script, n - 1, fail + bad, i + 1, seed)
+def fuzzSearchHit(exe: String, hasUi: Bool, outDir: String, script: String, n: Int, fail: Int, i: Int, seed: Int, bad: Int, uiEnv: String): IO[Int] =
+  if (bad > 0 && fail == 0) fuzzSaveRepro(outDir, seed, FuzzRun(joinSlash(outDir, "seeds.txt"), "", script, Str.fromInt(i), fuzzFaultOf(i))).flatMap(_ => fuzzSearch(exe, hasUi, outDir, script, n - 1, fail + bad, i + 1, seed, uiEnv)) else fuzzSearch(exe, hasUi, outDir, script, n - 1, fail + bad, i + 1, seed, uiEnv)
 
-def fuzzProbeRun(exe: String, hasUi: Bool, outDir: String, run: FuzzRun): IO[Int] =
-  runProbe(Str.concat(fuzzProbeEnv(hasUi, fuzzDrivePath(outDir), fuzzDumpPath(outDir), run.script != "", run.sched, run.fault, outDir), exe)).map(r => fuzzProbeCode(r))
+def fuzzProbeRun(exe: String, hasUi: Bool, outDir: String, run: FuzzRun, uiEnv: String): IO[Int] =
+  runProbe(Str.concat(fuzzProbeEnv(hasUi, fuzzDrivePath(outDir), fuzzDumpPath(outDir), run.script != "", run.sched, run.fault, outDir, uiEnv), exe)).flatMap(r => fuzzProbeCodeIo(r))
 
-def fuzzProbeEnv(hasUi: Bool, scriptPath: String, dumpPath: String, hasScript: Bool, sched: String, fault: String, outDir: String): String =
-  Str.concat(testEnv(), Str.concat(if (hasUi) headlessEnv() else "", Str.concat(fuzzScriptEnv(hasUi, scriptPath, dumpPath, hasScript), Str.concat(fuzzSchedEnv(sched), Str.concat(fuzzFaultEnv(fault), fuzzClassEnv(outDir))))))
+def fuzzProbeEnv(hasUi: Bool, scriptPath: String, dumpPath: String, hasScript: Bool, sched: String, fault: String, outDir: String, uiEnv: String): String =
+  Str.concat(testEnv(), Str.concat(if (hasUi) uiEnv else "", Str.concat(fuzzScriptEnv(hasUi, scriptPath, dumpPath, hasScript), Str.concat(fuzzSchedEnv(sched), Str.concat(fuzzFaultEnv(fault), fuzzClassEnv(outDir))))))
 
 def fuzzScriptEnv(hasUi: Bool, scriptPath: String, dumpPath: String, hasScript: Bool): String =
   if (hasScript) fuzzDriveEnv(hasUi, scriptPath, dumpPath) else if (hasUi) Str.concat("SCUZZ_UI_TAP=1 SCUZZ_FUZZ_DUMP=", Str.concat(dumpPath, " ")) else ""
@@ -1318,6 +1476,9 @@ def fuzzProbeCode(r: (Int, String, String)): Int =
     case (code, _out, _err) => if (code == 0) 0 else 1
   }
 
+def fuzzProbeCodeIo(r: (Int, String, String)): IO[Int] =
+  IO.pure(fuzzProbeCode(r))
+
 def fuzzDone(job: FuzzJob, corpus: Int, fail: Int, corpFail: Int, repro: String, mut: FuzzMut): IO[Unit] =
   fuzzWriteSummary(job, corpus, fail, corpFail, repro, mut).flatMap(_ => IO.println(Verify.fuzzOut2(Verify.fuzzHead(job.iterations, corpus, mut.sites), Verify.searchN(job.iterations), job.seed, corpus, mut.sites, fail, corpFail, Mutate.fuzzMutLine(mut.killed, mut.survived, mut.inert, mut.ran, mut.sites))).flatMap(_ => if (fail > 0) IO.fail("scuzz fuzz") else IO.pure(())))
 
@@ -1325,19 +1486,22 @@ def fuzzWriteSummary(job: FuzzJob, corpus: Int, fail: Int, corpFail: Int, repro:
   Fs.mkdirs(joinSlash(job.outDir, "fuzz")).flatMap(_ => fuzzPromoOf(job.outDir).flatMap(promo => fuzzClassText(job.outDir).flatMap(ct => Fs.write(joinSlash(joinSlash(job.outDir, "fuzz"), "summary.toml"), Verify.summaryToml(fail == 0, job.seed, job.iterations, Verify.searchN(job.iterations), fail, corpus, corpFail, promo, repro, mut.killed, mut.survived, mut.inert, mut.ran, mut.sites, job.oracles, ct)))))
 
 def fuzzPromoOf(outDir: String): IO[String] =
-  Fs.read(joinSlash(joinSlash(outDir, "fuzz"), "promo")).map(_ => "1").handleErrorWith(_ => IO.pure("0"))
+  Fs.read(joinSlash(joinSlash(outDir, "fuzz"), "promo")).flatMap(_ => IO.pure("1")).handleErrorWith(_ => IO.pure("0"))
 
 def fuzzClassText(outDir: String): IO[String] =
-  Fs.read(fuzzClassPath(outDir)).map(t => Verify.classToml(t)).handleErrorWith(_ => IO.pure(""))
+  Fs.read(fuzzClassPath(outDir)).flatMap(t => fuzzClassTextGot(t)).handleErrorWith(_ => IO.pure(""))
 
-def fuzzMutate(job: FuzzJob, corpus: Int, fail: Int, corpFail: Int, repro: String): IO[Unit] =
-  fuzzMutate2(job, corpus, fail, corpFail, repro, Mutate.countFiles(job.files, job.oracles))
+def fuzzClassTextGot(t: String): IO[String] =
+  IO.pure(Verify.classToml(t))
 
-def fuzzMutate2(job: FuzzJob, corpus: Int, fail: Int, corpFail: Int, repro: String, sites: Int): IO[Unit] =
-  fuzzMutate3(job, corpus, fail, corpFail, repro, sites, if (Verify.mutateN(job.iterations) < sites) Verify.mutateN(job.iterations) else sites)
+def fuzzMutate(job: FuzzJob, runs: List[FuzzRun], fail: Int, corpFail: Int, repro: String): IO[Unit] =
+  fuzzMutate2(job, runs, fail, corpFail, repro, Mutate.countFiles(job.files, job.oracles))
 
-def fuzzMutate3(job: FuzzJob, corpus: Int, fail: Int, corpFail: Int, repro: String, sites: Int, take: Int): IO[Unit] =
-  if (sites == 0) fuzzMutNone(job, corpus, fail, corpFail, repro, sites) else if (take <= 0) fuzzDone(job, corpus, fail, corpFail, repro, emptyMut(sites)) else IO.println(Mutate.mutateHead(take, sites, job.oracles)).flatMap(_ => fuzzMutBase(job).flatMap(base => fuzzMutGo(job, Mutate.pickSites(job.seed, take, sites), base, emptyMut(sites), take).flatMap(mut => fuzzMutFin(job, corpus, fail, corpFail, repro, mut, take))))
+def fuzzMutate2(job: FuzzJob, runs: List[FuzzRun], fail: Int, corpFail: Int, repro: String, sites: Int): IO[Unit] =
+  fuzzMutate3(job, runs, fail, corpFail, repro, sites, if (Verify.mutateN(job.iterations) < sites) Verify.mutateN(job.iterations) else sites)
+
+def fuzzMutate3(job: FuzzJob, runs: List[FuzzRun], fail: Int, corpFail: Int, repro: String, sites: Int, take: Int): IO[Unit] =
+  if (sites == 0) fuzzMutNone(job, List.len(runs), fail, corpFail, repro, sites) else if (take <= 0) fuzzDone(job, List.len(runs), fail, corpFail, repro, emptyMut(sites)) else IO.println(Mutate.mutateHead(take, sites, job.oracles)).flatMap(_ => fuzzMutBase(job, runs).flatMap(base => fuzzMutGo(job, Mutate.pickSites(job.seed, take, sites), base, emptyMut(sites), take).flatMap(mut => fuzzMutFin(job, List.len(runs), fail, corpFail, repro, mut, take))))
 
 def fuzzMutNone(job: FuzzJob, corpus: Int, fail: Int, corpFail: Int, repro: String, sites: Int): IO[Unit] =
   IO.println(if (job.oracles) "scuzz fuzz: no residual Property.check / Property.assert / .require sites" else "scuzz fuzz: no live-code mutation sites").flatMap(_ => fuzzDone(job, corpus, fail, corpFail, repro, emptyMut(sites)))
@@ -1345,46 +1509,82 @@ def fuzzMutNone(job: FuzzJob, corpus: Int, fail: Int, corpFail: Int, repro: Stri
 def fuzzMutFin(job: FuzzJob, corpus: Int, fail: Int, corpFail: Int, repro: String, mut: FuzzMut, take: Int): IO[Unit] =
   IO.println(Str.concat("scuzz fuzz mutate: ", Str.concat(Str.fromInt(mut.killed), Str.concat(" killed, ", Str.concat(Str.fromInt(mut.survived), Str.concat(" survived, ", Str.concat(Str.fromInt(mut.inert), Str.concat(" inert (", Str.concat(Str.fromInt(take), " ran)"))))))))).flatMap(_ => fuzzDone(job, corpus, fail, corpFail, repro, FuzzMut(mut.killed, mut.survived, mut.inert, take, mut.sites)))
 
-def fuzzMutBase(job: FuzzJob): IO[String] =
-  fuzzIdleAt(job.exe, job.hasUi, joinSlash(joinSlash(job.outDir, "fuzz"), "mutate/baseline")).map(p => fuzzIdleTl(p))
+def fuzzMutBase(job: FuzzJob, runs: List[FuzzRun]): IO[MutBase] =
+  fuzzIdleAt(job.exe, job.hasUi, joinSlash(joinSlash(job.outDir, "fuzz"), "mutate/baseline"), job.uiEnv).flatMap(p => fuzzMutBaseRuns(job, runs, 0, Verify.noStr(), noRuns()).flatMap(got => IO.pure(MutBase(fuzzIdleTl(p), got._1, got._2))))
+
+def fuzzMutBaseRuns(job: FuzzJob, runs: List[FuzzRun], i: Int, tls: List[String], pass: List[FuzzRun]): IO[(List[String], List[FuzzRun])] =
+  if (List.isEmpty(runs)) IO.pure((tls, pass)) else fuzzMutBaseRunHd(job, List.at(runs, 0), List.tail(runs), i, tls, pass)
+
+def fuzzMutBaseRunHd(job: FuzzJob, h: FuzzRun, rest: List[FuzzRun], i: Int, tls: List[String], pass: List[FuzzRun]): IO[(List[String], List[FuzzRun])] =
+  fuzzProbeAt(job.exe, job.hasUi, joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "mutate/baseline"), Str.fromInt(i)), job.uiEnv, h.script, h.sched, h.fault).flatMap(p => fuzzMutBaseGot(job, h, rest, i, tls, pass, p))
+
+def fuzzMutBaseGot(job: FuzzJob, h: FuzzRun, rest: List[FuzzRun], i: Int, tls: List[String], pass: List[FuzzRun], p: (Int, String)): IO[(List[String], List[FuzzRun])] =
+  if (p._1 != 0) fuzzMutBaseRuns(job, rest, i, tls, pass) else fuzzMutBaseRuns(job, rest, i + 1, List.concat(tls, p._2 :: Verify.noStr()), List.concat(pass, h :: noRuns()))
 
 def fuzzIdleTl(p: (Int, String)): String =
   p._2
 
-def fuzzMutGo(job: FuzzJob, sites: List[Int], base: String, acc: FuzzMut, take: Int): IO[FuzzMut] =
+def fuzzMutGo(job: FuzzJob, sites: List[Int], base: MutBase, acc: FuzzMut, take: Int): IO[FuzzMut] =
   if (List.isEmpty(sites)) IO.pure(acc) else fuzzMutOne(job, List.at(sites, 0), base, acc).flatMap(next => fuzzMutGo(job, List.tail(sites), base, next, take))
 
-def fuzzMutOne(job: FuzzJob, site: Int, base: String, acc: FuzzMut): IO[FuzzMut] =
+def fuzzMutOne(job: FuzzJob, site: Int, base: MutBase, acc: FuzzMut): IO[FuzzMut] =
   fuzzMutCompile(job, site).flatMap(exe => fuzzMutRun(job, site, exe, base, acc))
 
 def fuzzMutCompile(job: FuzzJob, site: Int): IO[String] =
   fuzzMutCompile2(job, site, joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "mutate"), Str.fromInt(site)), Mutate.applyFiles(job.files, site, job.oracles))
 
 def fuzzMutCompile2(job: FuzzJob, _site: Int, mutDir: String, files: List[(String, String)]): IO[String] =
-  Fs.mkdirs(mutDir).flatMap(_ => emitDirAlwaysGot(fuzzToml(job), files, mutDir).flatMap(_ => fuzzMutLink(job, mutDir)))
+  Fs.mkdirs(mutDir).flatMap(_ => emitDirAlwaysGot(fuzzToml(job), files, mutDir).flatMap(_ => fuzzMutLink(job, mutDir))).handleErrorWith(_ => IO.pure(""))
 
 def fuzzToml(job: FuzzJob): String =
   Str.concat("[package]\nname = \"", Str.concat(job.name, "\"\n"))
 
 def fuzzMutLink(job: FuzzJob, mutDir: String): IO[String] =
-  runLinkLine(job.hasUi, mutDir, job.name).map(r => fuzzMutLinkGot(r, exeName(mutDir, job.name)))
+  runLinkLine(job.hasUi, mutDir, job.name).flatMap(r => fuzzMutLinkIo(r, exeName(mutDir, job.name)))
+
+def fuzzMutLinkIo(r: (Int, String, String), exe: String): IO[String] =
+  IO.pure(fuzzMutLinkGot(r, exe))
 
 def fuzzMutLinkGot(r: (Int, String, String), exe: String): String =
   r match {
     case (code, _out, _err) => if (code == 0) exe else ""
   }
 
-def fuzzMutRun(job: FuzzJob, site: Int, exe: String, base: String, acc: FuzzMut): IO[FuzzMut] =
-  if (exe == "") IO.println(Str.concat("  mutant ", Str.concat(Str.fromInt(site), ": killed (compile)"))).map(_ => FuzzMut(acc.killed + 1, acc.survived, acc.inert, acc.ran, acc.sites)) else fuzzIdleAt(exe, job.hasUi, joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "mutate"), Str.fromInt(site))).flatMap(p => fuzzMutClass(site, p, base, acc))
+def fuzzMutRun(job: FuzzJob, site: Int, exe: String, base: MutBase, acc: FuzzMut): IO[FuzzMut] =
+  if (exe == "") fuzzMutKilled(site, "killed (compile)", acc) else fuzzIdleAt(exe, job.hasUi, joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "mutate"), Str.fromInt(site)), job.uiEnv).flatMap(p => fuzzMutAfterIdle(job, site, exe, base, acc, p))
+
+def fuzzMutAfterIdle(job: FuzzJob, site: Int, exe: String, base: MutBase, acc: FuzzMut, p: (Int, String)): IO[FuzzMut] =
+  if (p._1 != 0) fuzzMutKilled(site, "killed", acc) else fuzzMutReplay(job, site, exe, base.pass, 0, Verify.noStr()).flatMap(tls => fuzzMutAfterReplay(site, base, acc, p._2, tls)).handleErrorWith(_ => fuzzMutKilled(site, "killed", acc))
+
+def fuzzMutReplay(job: FuzzJob, site: Int, exe: String, runs: List[FuzzRun], i: Int, acc: List[String]): IO[List[String]] =
+  if (List.isEmpty(runs)) IO.pure(acc) else fuzzMutReplayHd(job, site, exe, List.at(runs, 0), List.tail(runs), i, acc)
 
-def fuzzMutClass(site: Int, p: (Int, String), base: String, acc: FuzzMut): IO[FuzzMut] =
-  fuzzMutClass2(site, p._1, p._2, base, acc)
+def fuzzMutReplayHd(job: FuzzJob, site: Int, exe: String, h: FuzzRun, rest: List[FuzzRun], i: Int, acc: List[String]): IO[List[String]] =
+  fuzzProbeAt(exe, job.hasUi, joinSlash(joinSlash(joinSlash(joinSlash(job.outDir, "fuzz"), "mutate"), Str.fromInt(site)), Str.fromInt(i)), job.uiEnv, h.script, h.sched, h.fault).flatMap(p => fuzzMutReplayGot(job, site, exe, rest, i, acc, p))
 
-def fuzzMutClass2(site: Int, code: Int, tl: String, base: String, acc: FuzzMut): IO[FuzzMut] =
-  if (code != 0) IO.println(Str.concat("  mutant ", Str.concat(Str.fromInt(site), ": killed"))).map(_ => FuzzMut(acc.killed + 1, acc.survived, acc.inert, acc.ran, acc.sites)) else if (tl == base) IO.pure(FuzzMut(acc.killed, acc.survived, acc.inert + 1, acc.ran, acc.sites)) else IO.println(Str.concat("  mutant ", Str.concat(Str.fromInt(site), ": survived"))).map(_ => FuzzMut(acc.killed, acc.survived + 1, acc.inert, acc.ran, acc.sites))
+def fuzzMutReplayGot(job: FuzzJob, site: Int, exe: String, rest: List[FuzzRun], i: Int, acc: List[String], p: (Int, String)): IO[List[String]] =
+  if (p._1 != 0) IO.fail("killed") else fuzzMutReplay(job, site, exe, rest, i + 1, List.concat(acc, p._2 :: Verify.noStr()))
 
-def fuzzIdleAt(exe: String, hasUi: Bool, mutDir: String): IO[(Int, String)] =
-  Fs.mkdirs(mutDir).flatMap(_ => Fs.write(joinSlash(mutDir, "timeline.txt"), "").flatMap(_ => runProbe(Str.concat(fuzzProbeEnv(hasUi, joinSlash(mutDir, "drive.txt"), joinSlash(mutDir, "dump.txt"), false, "", "", mutDir), Str.concat(fuzzTlEnv(joinSlash(mutDir, "timeline.txt")), exe))).flatMap(r => fuzzIdleGot(mutDir, r))))
+def fuzzMutAfterReplay(site: Int, base: MutBase, acc: FuzzMut, idle: String, tls: List[String]): IO[FuzzMut] =
+  if (idle == base.idle && tlsEq(tls, base.tls)) IO.pure(FuzzMut(acc.killed, acc.survived, acc.inert + 1, acc.ran, acc.sites)) else fuzzMutLived(site, acc)
+
+def tlsEq(a: List[String], b: List[String]): Bool =
+  if (List.len(a) != List.len(b)) false else tlsEqGo(a, b)
+
+def tlsEqGo(a: List[String], b: List[String]): Bool =
+  if (List.isEmpty(a)) true else List.at(a, 0) == List.at(b, 0) && tlsEqGo(List.tail(a), List.tail(b))
+
+def fuzzMutKilled(site: Int, kind: String, acc: FuzzMut): IO[FuzzMut] =
+  IO.println(Str.concat("  mutant ", Str.concat(Str.fromInt(site), Str.concat(": ", kind)))).flatMap(_ => IO.pure(FuzzMut(acc.killed + 1, acc.survived, acc.inert, acc.ran, acc.sites)))
+
+def fuzzMutLived(site: Int, acc: FuzzMut): IO[FuzzMut] =
+  IO.println(Str.concat("  mutant ", Str.concat(Str.fromInt(site), ": survived"))).flatMap(_ => IO.pure(FuzzMut(acc.killed, acc.survived + 1, acc.inert, acc.ran, acc.sites)))
+
+def fuzzIdleAt(exe: String, hasUi: Bool, mutDir: String, uiEnv: String): IO[(Int, String)] =
+  fuzzProbeAt(exe, hasUi, mutDir, uiEnv, "", "", "")
+
+def fuzzProbeAt(exe: String, hasUi: Bool, mutDir: String, uiEnv: String, script: String, sched: String, fault: String): IO[(Int, String)] =
+  Fs.mkdirs(mutDir).flatMap(_ => Fs.write(joinSlash(mutDir, "timeline.txt"), "").flatMap(_ => Fs.write(joinSlash(mutDir, "drive.txt"), script).flatMap(_ => runProbe(Str.concat(fuzzProbeEnv(hasUi, joinSlash(mutDir, "drive.txt"), joinSlash(mutDir, "dump.txt"), script != "", sched, fault, mutDir, uiEnv), Str.concat(fuzzTlEnv(joinSlash(mutDir, "timeline.txt")), exe))).flatMap(r => fuzzIdleGot(mutDir, r)))))
 
 def fuzzTlEnv(path: String): String =
   Str.concat("SCUZZ_TIMELINE_DUMP=", Str.concat(path, " "))
@@ -1395,7 +1595,10 @@ def fuzzIdleGot(mutDir: String, r: (Int, String, String)): IO[(Int, String)] =
   }
 
 def fuzzIdleRead(mutDir: String, code: Int): IO[(Int, String)] =
-  Fs.read(joinSlash(mutDir, "timeline.txt")).handleErrorWith(_ => IO.pure("")).map(tl => (code, tl))
+  Fs.read(joinSlash(mutDir, "timeline.txt")).handleErrorWith(_ => IO.pure("")).flatMap(tl => fuzzIdleReadGot(code, tl))
+
+def fuzzIdleReadGot(code: Int, tl: String): IO[(Int, String)] =
+  IO.pure((code, tl))
 
 def fuzzRelate(dir: String, outDir: String): IO[Unit] =
   fuzzCollect(dir).flatMap(files => emitDirAlways(dir, outDir, files).flatMap(_ => compileLinkedMan(dir, outDir).flatMap(_ => fuzzRelateLinked(dir, outDir, files))))
@@ -1404,31 +1607,31 @@ def fuzzRelateLinked(dir: String, outDir: String, files: List[(String, String)])
   Fs.read(joinSlash(dir, "scuzz.toml")).flatMap(toml => fuzzRelateMan(Manifest.parse(toml), dir, outDir, files))
 
 def fuzzRelateMan(m: Man, dir: String, outDir: String, files: List[(String, String)]): IO[Unit] =
-  if (!m.ok) IO.println(Str.concat("fail:", m.err)).flatMap(_ => IO.fail("toml")) else fuzzRelateJob(exeName(outDir, m.name), m.hasUi, dir, outDir, files)
+  manNeed(m).flatMap(_ => fuzzRelateJob(exeName(outDir, m.name), m.hasUi, dir, outDir, files, if (m.hasUi) headlessEnvMan(m) else ""))
 
-def fuzzRelateJob(exe: String, hasUi: Bool, dir: String, outDir: String, files: List[(String, String)]): IO[Unit] =
-  fuzzSeedText(dir, files).flatMap(script => fuzzWriteSeeds(outDir, script).flatMap(_ => fuzzCorpusFiles(dir).flatMap(runs => fuzzRelateGo(exe, hasUi, outDir, fuzzAddSeeds(runs, joinSlash(outDir, "seeds.txt"), script)))))
+def fuzzRelateJob(exe: String, hasUi: Bool, dir: String, outDir: String, files: List[(String, String)], uiEnv: String): IO[Unit] =
+  fuzzSeedText(dir, files).flatMap(script => fuzzWriteSeeds(outDir, script).flatMap(_ => fuzzCorpusFiles(dir).flatMap(runs => fuzzRelateGo(exe, hasUi, outDir, fuzzAddSeeds(runs, joinSlash(outDir, "seeds.txt"), script), uiEnv))))
 
-def fuzzRelateGo(exe: String, hasUi: Bool, outDir: String, runs: List[FuzzRun]): IO[Unit] =
-  if (List.isEmpty(runs)) IO.println("scuzz fuzz: --relate: no corpus entries") else Fs.mkdirs(joinSlash(joinSlash(outDir, "fuzz"), "relate")).flatMap(_ => fuzzRelateAcc(exe, hasUi, joinSlash(joinSlash(outDir, "fuzz"), "relate"), runs, 0, 0, List.len(runs)))
+def fuzzRelateGo(exe: String, hasUi: Bool, outDir: String, runs: List[FuzzRun], uiEnv: String): IO[Unit] =
+  if (List.isEmpty(runs)) IO.println("scuzz fuzz: --relate: no corpus entries") else Fs.mkdirs(joinSlash(joinSlash(outDir, "fuzz"), "relate")).flatMap(_ => fuzzRelateAcc(exe, hasUi, joinSlash(joinSlash(outDir, "fuzz"), "relate"), runs, 0, 0, List.len(runs), uiEnv))
 
-def fuzzRelateAcc(exe: String, hasUi: Bool, relDir: String, runs: List[FuzzRun], n: Int, fail: Int, total: Int): IO[Unit] =
-  if (List.isEmpty(runs)) fuzzRelateDone(fail, total) else fuzzRelateOne(exe, hasUi, relDir, List.at(runs, 0), n).flatMap(bad => fuzzRelateAcc(exe, hasUi, relDir, List.tail(runs), n + 1, fail + bad, total))
+def fuzzRelateAcc(exe: String, hasUi: Bool, relDir: String, runs: List[FuzzRun], n: Int, fail: Int, total: Int, uiEnv: String): IO[Unit] =
+  if (List.isEmpty(runs)) fuzzRelateDone(fail, total) else fuzzRelateOne(exe, hasUi, relDir, List.at(runs, 0), n, uiEnv).flatMap(bad => fuzzRelateAcc(exe, hasUi, relDir, List.tail(runs), n + 1, fail + bad, total, uiEnv))
 
 def fuzzRelateDone(fail: Int, total: Int): IO[Unit] =
   if (fail > 0) IO.println(Str.concat("fuzz --relate: ", Str.concat(Str.fromInt(fail), Str.concat(" of ", Str.concat(Str.fromInt(total), " entries failed"))))).flatMap(_ => IO.fail("relate")) else IO.println(Str.concat("scuzz fuzz: --relate: ", Str.concat(Str.fromInt(total), " entries ok")))
 
-def fuzzRelateOne(exe: String, hasUi: Bool, relDir: String, run: FuzzRun, n: Int): IO[Int] =
-  fuzzRelateOne2(exe, hasUi, relDir, run, n, relateLabel(run), Verify.perturbSched(run.sched, Verify.relateSeed(relateLabel(run), run.sched, run.script, n)))
+def fuzzRelateOne(exe: String, hasUi: Bool, relDir: String, run: FuzzRun, n: Int, uiEnv: String): IO[Int] =
+  fuzzRelateOne2(exe, hasUi, relDir, run, n, relateLabel(run), Verify.perturbSched(run.sched, Verify.relateSeed(relateLabel(run), run.sched, run.script, n)), uiEnv)
 
-def fuzzRelateOne2(exe: String, hasUi: Bool, relDir: String, run: FuzzRun, n: Int, label: String, pert: String): IO[Int] =
-  fuzzRelateOne3(exe, hasUi, relDir, run, n, label, pert, joinSlash(relDir, Str.concat(Str.fromInt(n), ".a.txt")), joinSlash(relDir, Str.concat(Str.fromInt(n), ".b.txt")))
+def fuzzRelateOne2(exe: String, hasUi: Bool, relDir: String, run: FuzzRun, n: Int, label: String, pert: String, uiEnv: String): IO[Int] =
+  fuzzRelateOne3(exe, hasUi, relDir, run, n, label, pert, joinSlash(relDir, Str.concat(Str.fromInt(n), ".a.txt")), joinSlash(relDir, Str.concat(Str.fromInt(n), ".b.txt")), uiEnv)
 
-def fuzzRelateOne3(exe: String, hasUi: Bool, relDir: String, run: FuzzRun, n: Int, label: String, pert: String, a: String, b: String): IO[Int] =
-  relateExec(exe, hasUi, relDir, a, Str.concat(Str.fromInt(n), ".a"), run.script, run.sched, run.fault).flatMap(codeA => fuzzRelateOne4(exe, hasUi, relDir, run, n, label, pert, a, b, codeA))
+def fuzzRelateOne3(exe: String, hasUi: Bool, relDir: String, run: FuzzRun, n: Int, label: String, pert: String, a: String, b: String, uiEnv: String): IO[Int] =
+  relateExec(exe, hasUi, relDir, a, Str.concat(Str.fromInt(n), ".a"), run.script, run.sched, run.fault, uiEnv).flatMap(codeA => fuzzRelateOne4(exe, hasUi, relDir, run, n, label, pert, a, b, codeA, uiEnv))
 
-def fuzzRelateOne4(exe: String, hasUi: Bool, relDir: String, run: FuzzRun, n: Int, label: String, pert: String, a: String, b: String, codeA: Int): IO[Int] =
-  relateExec(exe, hasUi, relDir, b, Str.concat(Str.fromInt(n), ".b"), run.script, pert, run.fault).flatMap(codeB => fuzzRelateJudge(exe, a, b, label, codeA, codeB))
+def fuzzRelateOne4(exe: String, hasUi: Bool, relDir: String, run: FuzzRun, n: Int, label: String, pert: String, a: String, b: String, codeA: Int, uiEnv: String): IO[Int] =
+  relateExec(exe, hasUi, relDir, b, Str.concat(Str.fromInt(n), ".b"), run.script, pert, run.fault, uiEnv).flatMap(codeB => fuzzRelateJudge(exe, a, b, label, codeA, codeB))
 
 def fuzzRelateJudge(exe: String, a: String, b: String, label: String, codeA: Int, codeB: Int): IO[Int] =
   fuzzRelateNote(label, "a", codeA).flatMap(fa => fuzzRelateJudgeB(exe, a, b, label, fa, codeB))
@@ -1440,10 +1643,10 @@ def fuzzRelateJudgeC(exe: String, a: String, b: String, label: String, fa: Int,
   relateJudge(exe, a, b).flatMap(fj => fuzzRelateFin(label, fa + fb + fj))
 
 def fuzzRelateNote(label: String, tag: String, code: Int): IO[Int] =
-  if (code == 0) IO.pure(0) else IO.println(Str.concat("relate failed: ", Str.concat(label, Str.concat(" (run ", Str.concat(tag, Str.concat(" exited ", Str.concat(Str.fromInt(code), ")"))))))).map(_ => 1)
+  if (code == 0) IO.pure(0) else IO.println(Str.concat("relate failed: ", Str.concat(label, Str.concat(" (run ", Str.concat(tag, Str.concat(" exited ", Str.concat(Str.fromInt(code), ")"))))))).flatMap(_ => IO.pure(1))
 
 def fuzzRelateFin(label: String, fail: Int): IO[Int] =
-  if (fail > 0) IO.pure(1) else IO.println(Str.concat("relate ok: ", label)).map(_ => 0)
+  if (fail > 0) IO.pure(1) else IO.println(Str.concat("relate ok: ", label)).flatMap(_ => IO.pure(0))
 
 def relateLabel(run: FuzzRun): String =
   relateLabel2(baseName(run.path), run.script)
@@ -1460,11 +1663,11 @@ def baseNameAt(path: String, i: Int): String =
 def firstLine(s: String): String =
   if (List.isEmpty(Verify.linesOf(s))) "" else List.at(Verify.linesOf(s), 0)
 
-def relateExec(exe: String, hasUi: Bool, relDir: String, out: String, tag: String, script: String, sched: String, fault: String): IO[Int] =
-  relateExec2(exe, hasUi, relDir, out, tag, script, sched, fault, joinSlash(relDir, Str.concat(tag, ".script.txt")), joinSlash(relDir, Str.concat(tag, ".sometimes")))
+def relateExec(exe: String, hasUi: Bool, relDir: String, out: String, tag: String, script: String, sched: String, fault: String, uiEnv: String): IO[Int] =
+  relateExec2(exe, hasUi, relDir, out, tag, script, sched, fault, joinSlash(relDir, Str.concat(tag, ".script.txt")), joinSlash(relDir, Str.concat(tag, ".sometimes")), uiEnv)
 
-def relateExec2(exe: String, hasUi: Bool, relDir: String, out: String, tag: String, script: String, sched: String, fault: String, scriptPath: String, reached: String): IO[Int] =
-  Fs.write(out, "").flatMap(_ => Fs.write(reached, "").flatMap(_ => Fs.write(scriptPath, script).flatMap(_ => Fs.write(joinSlash(relDir, Str.concat(tag, ".dump.txt")), "").flatMap(_ => runProbe(Str.concat(relateEnv(hasUi, scriptPath, joinSlash(relDir, Str.concat(tag, ".dump.txt")), script != "", out, reached, sched, fault), exe)).flatMap(r => relateExecGot(r))))))
+def relateExec2(exe: String, hasUi: Bool, relDir: String, out: String, tag: String, script: String, sched: String, fault: String, scriptPath: String, reached: String, uiEnv: String): IO[Int] =
+  Fs.write(out, "").flatMap(_ => Fs.write(reached, "").flatMap(_ => Fs.write(scriptPath, script).flatMap(_ => Fs.write(joinSlash(relDir, Str.concat(tag, ".dump.txt")), "").flatMap(_ => runProbe(Str.concat(relateEnv(hasUi, scriptPath, joinSlash(relDir, Str.concat(tag, ".dump.txt")), script != "", out, reached, sched, fault, uiEnv), exe)).flatMap(r => relateExecGot(r))))))
 
 def relateExecGot(r: (Int, String, String)): IO[Int] =
   r match {
@@ -1472,13 +1675,13 @@ def relateExecGot(r: (Int, String, String)): IO[Int] =
   }
 
 def relateExecCode(code: Int, out: String, err: String): IO[Int] =
-  if (code == 0) IO.pure(0) else IO.println(if (Str.len(err) > 0) err else out).map(_ => code)
+  if (code == 0) IO.pure(0) else IO.println(if (Str.len(err) > 0) err else out).flatMap(_ => IO.pure(code))
 
-def relateEnv(hasUi: Bool, scriptPath: String, dumpPath: String, hasScript: Bool, tl: String, reached: String, sched: String, fault: String): String =
-  Str.concat(relateBaseEnv(hasUi), Str.concat(relateScriptEnv(hasUi, scriptPath, dumpPath, hasScript), Str.concat(fuzzTlEnv(tl), Str.concat(Str.concat("SCUZZ_SOMETIMES_DUMP=", Str.concat(reached, " ")), Str.concat(fuzzSchedEnv(sched), fuzzFaultEnv(fault))))))
+def relateEnv(hasUi: Bool, scriptPath: String, dumpPath: String, hasScript: Bool, tl: String, reached: String, sched: String, fault: String, uiEnv: String): String =
+  Str.concat(relateBaseEnv(hasUi, uiEnv), Str.concat(relateScriptEnv(hasUi, scriptPath, dumpPath, hasScript), Str.concat(fuzzTlEnv(tl), Str.concat(Str.concat("SCUZZ_SOMETIMES_DUMP=", Str.concat(reached, " ")), Str.concat(fuzzSchedEnv(sched), fuzzFaultEnv(fault))))))
 
-def relateBaseEnv(hasUi: Bool): String =
-  Str.concat(testEnv(), if (hasUi) headlessEnv() else "")
+def relateBaseEnv(hasUi: Bool, uiEnv: String): String =
+  Str.concat(testEnv(), if (hasUi) uiEnv else "")
 
 def relateScriptEnv(hasUi: Bool, scriptPath: String, dumpPath: String, hasScript: Bool): String =
   if (!hasScript) "" else if (hasUi) Str.concat("SCUZZ_UI_SCRIPT=", Str.concat(scriptPath, Str.concat(" SCUZZ_FUZZ_DUMP=", Str.concat(dumpPath, " ")))) else Str.concat("SCUZZ_DRIVE_SCRIPT=", Str.concat(scriptPath, " "))
@@ -1488,6 +1691,6 @@ def relateJudge(exe: String, a: String, b: String): IO[Int] =
 
 def relateJudgeGot(r: (Int, String, String)): IO[Int] =
   r match {
-    case (code, out, err) => if (code == 0) IO.pure(0) else IO.println(if (Str.len(err) > 0) err else out).map(_ => 1)
+    case (code, out, err) => if (code == 0) IO.pure(0) else IO.println(if (Str.len(err) > 0) err else out).flatMap(_ => IO.pure(1))
   }
 
diff --git a/examples/compiler/src/Emit.scuzz b/examples/compiler/src/Emit.scuzz
index 2de3e1ea..7db97ad5 100644
--- a/examples/compiler/src/Emit.scuzz
+++ b/examples/compiler/src/Emit.scuzz
@@ -22,6 +22,9 @@ import Check.withImportFuns
 import Check.fileOf
 import Check.locOf
 import Check.srcOfStem
+import Check.alignCall
+import Check.isTupField
+import Check.tupIdx
 
 def noStr(): List[String] =
   []
@@ -82,7 +85,22 @@ def _escLl(s: String, i: Int, b: Builder): String =
   if (i >= Str.len(s)) Builder.result(b) else _escLl2(s, i, b, Str.charAt(s, i))
 
 def _escLl2(s: String, i: Int, b: Builder, c: Int): String =
-  _escLl(s, i + 1, Builder.append(b, if (c == 34) "\\22" else if (c == 92) "\\\\" else if (c == 10) "\\0A" else Str.slice(s, i, i + 1)))
+  _escLl(s, i + 1, Builder.append(b, escLlCp(s, i, c)))
+
+def escLlCp(s: String, i: Int, c: Int): String =
+  if (c == 34) "\\22" else if (c == 92) "\\\\" else if (c >= 32 && c <= 126) Str.slice(s, i, i + 1) else escUtf8(c)
+
+def escUtf8(c: Int): String =
+  if (c < 128) escByte(c) else if (c < 2048) Str.concat(escByte(192 + c / 64), escByte(128 + c % 64)) else if (c < 65536) Str.concat(escByte(224 + c / 4096), Str.concat(escByte(128 + c / 64 % 64), escByte(128 + c % 64))) else Str.concat(escByte(240 + c / 262144), Str.concat(escByte(128 + c / 4096 % 64), Str.concat(escByte(128 + c / 64 % 64), escByte(128 + c % 64))))
+
+def escByte(n: Int): String =
+  Str.concat("\\", hexU2(n))
+
+def hexU2(n: Int): String =
+  Str.concat(hexU(n / 16), hexU(n % 16))
+
+def hexU(n: Int): String =
+  Str.slice("0123456789ABCDEF", n, n + 1)
 
 def strArr(s: String): Int =
   Str.byteLen(s) + 1
@@ -182,7 +200,10 @@ def cat6(a: String, b: String, c: String, d: String, e: String, f: String): Stri
   Builder.result(Builder.append(Builder.append(Builder.append(Builder.append(Builder.append(Builder.append(Builder.empty(), a), b), c), d), e), f))
 
 def llvmBin(op: String): String =
-  if (op == "+") "add" else if (op == "-") "sub" else if (op == "*") "mul" else if (op == "/") "sdiv" else if (op == "%") "srem" else if (op == "&") "and" else if (op == "|") "or" else if (op == "^") "xor" else if (op == "<<") "shl" else if (op == ">>") "ashr" else "add"
+  if (op == "+") "add" else if (op == "-") "sub" else if (op == "*") "mul" else if (op == "/") "sdiv" else if (op == "%") "srem" else if (op == "&") "and" else if (op == "|") "or" else if (op == "^") "xor" else if (op == "<<") "shl" else if (op == ">>") "ashr" else stuckStr()
+
+def stuckStr(): String =
+  stuckStr()
 
 def emitExpr(e: Expr, prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   emitExprFid(e, prefix, strs, defs, ens, ps, loc, 0)
@@ -192,7 +213,7 @@ def emitExprFid(e: Expr, prefix: String, strs: List[String], defs: List[Fun], en
 
 def needsPh(e: Expr): Bool =
   e match {
-    case Expr.ELam(_, _) => false
+    case Expr.ELam(_, _, _) => false
     case Expr.EHole => true
     case Expr.EBin(_, l, r, _) => hasHole(l) || hasHole(r)
     case Expr.EUn(_, inner, _) => hasHole(inner)
@@ -235,12 +256,13 @@ def hasHole(e: Expr): Bool =
     case Expr.EField(recv, _, _) => hasHole(recv)
     case Expr.EBin(_, l, r, _) => hasHole(l) || hasHole(r)
     case Expr.EUn(_, inner, _) => hasHole(inner)
-    case Expr.ELam(_, body) => hasHole(body)
+    case Expr.ELam(_, _, body) => hasHole(body)
     case Expr.EIf(c, t, el, _) => hasHole(c) || hasHole(t) || hasHole(el)
     case Expr.EMatch(s, arms, _) => hasHole(s) || hasHoleArms(arms)
     case Expr.EList(xs) => hasHoleList(xs)
     case Expr.ETuple(xs) => hasHoleList(xs)
     case Expr.ENamed(_, inner) => hasHole(inner)
+    case Expr.EAscribe(inner, _, _) => hasHole(inner)
     case _ => false
   }
 
@@ -264,9 +286,10 @@ def rewriteHole(e: Expr, n: String): Expr =
     case Expr.EField(recv, name, _) => Expr.EField(rewriteHole(recv, n), name, 0)
     case Expr.EBin(op, l, r, _) => Expr.EBin(op, rewriteHole(l, n), rewriteHole(r, n), 0)
     case Expr.EUn(op, inner, _) => Expr.EUn(op, rewriteHole(inner, n), 0)
-    case Expr.ELam(p, body) => Expr.ELam(p, rewriteHole(body, n))
+    case Expr.ELam(p, ty, body) => Expr.ELam(p, ty, rewriteHole(body, n))
     case Expr.EIf(c, t, el, _) => Expr.EIf(rewriteHole(c, n), rewriteHole(t, n), rewriteHole(el, n), 0)
     case Expr.ENamed(nm, inner) => Expr.ENamed(nm, rewriteHole(inner, n))
+    case Expr.EAscribe(inner, ty, off) => Expr.EAscribe(rewriteHole(inner, n), ty, off)
     case Expr.EList(xs) => Expr.EList(rewriteHoleList(xs, n))
     case Expr.ETuple(xs) => Expr.ETuple(rewriteHoleList(xs, n))
     case _ => e
@@ -287,19 +310,23 @@ def emitExprGo(e: Expr, prefix: String, strs: List[String], defs: List[Fun], ens
     case Expr.EUn(op, inner, _) => emitUn(op, inner, prefix, strs, defs, ens, ps, loc)
     case Expr.ENamed(_, inner) => emitExprFid(inner, prefix, strs, defs, ens, ps, loc, fid)
     case Expr.EMethod(recv, name, args, _) => if (isFmName(name)) emitFmRt(fmRt(name), recv, args, prefix, strs, defs, ens, ps, loc, fid) else if (name == "apply") emitApplyRecv(recv, args, prefix, strs, defs, ens, ps, loc, fid) else if (name == "map") emitIoMap(recv, args, prefix, strs, defs, ens, ps, loc, fid) else emitCtorCall(recv, name, args, prefix, strs, defs, ens, ps, loc)
-    case Expr.ELam(p, body) => emitLam(p, body, prefix, strs, defs, ens, ps, loc)
+    case Expr.ELam(p, _, body) => emitLam(p, body, prefix, strs, defs, ens, ps, loc)
     case Expr.EIf(c, t, el, _) => emitIfFid(c, t, el, prefix, strs, defs, ens, ps, loc, fid)
-    case Expr.EField(recv, name, _) => emitField(recv, name, prefix, ens, ps)
+    case Expr.EField(recv, name, _) => emitField(recv, name, prefix, strs, defs, ens, ps, loc)
     case Expr.EMatch(s, arms, _) => emitMatch(s, arms, prefix, strs, defs, ens, ps, loc)
     case Expr.EList(xs) => emitList(xs, prefix, strs, defs, ens, ps, loc)
     case Expr.ETuple(xs) => emitTuple(xs, prefix, strs, defs, ens, ps, loc)
     case Expr.EInterp(s) => emitInterp(s, prefix, strs, defs, ens, ps, loc)
     case Expr.EFloat(s) => emitFloatBits(s, prefix)
     case Expr.EFor(bs, body, _) => emitExprFid(desugarFor(bs, body), prefix, strs, defs, ens, ps, loc, fid)
+    case Expr.EAscribe(inner, _, _) => emitExprFid(inner, prefix, strs, defs, ens, ps, loc, fid)
     case Expr.EUnit => Slot("", "null", true)
-    case _ => Slot("", "0", false)
+    case _ => emitStuck()
   }
 
+def emitStuck(): Slot =
+  emitStuck()
+
 def emitFloatBits(s: String, prefix: String): Slot =
   Slot(line(Str.concat(tmp(prefix, "fb"), Str.concat("bitcast double ", Str.concat(s, " to i64")))), pct(prefix, "fb"), false)
 
@@ -347,14 +374,6 @@ def desugarFor(bs: List[Bind], body: Expr): Expr =
 def forYield(bs: List[Bind], body: Expr): Expr =
   if (hasDraw(bs)) Expr.ECall("IO.pure", body :: noExpr(), 0) else body
 
-def hasDraw(bs: List[Bind]): Bool =
-  if (List.isEmpty(bs)) false else bindIsDraw(List.at(bs, 0)) || hasDraw(List.tail(bs))
-
-def bindIsDraw(b: Bind): Bool =
-  b match {
-    case Bind(draw, _, _) => draw
-  }
-
 def desugarForRev(bs: List[Bind], body: Expr): Expr =
   if (List.isEmpty(bs)) body else desugarForRevHit(bs, body)
 
@@ -379,10 +398,10 @@ def wrapGuard(c: Expr, body: Expr): Expr =
   Expr.EIf(c, body, Expr.ECall("IO.fail", Expr.EStr("guard", 0) :: noExpr(), 0), 0)
 
 def wrapDraw(name: String, v: Expr, body: Expr): Expr =
-  if (isSimpleBind(name)) Expr.EMethod(v, "flatMap", Expr.ELam(name, body) :: noExpr(), 0) else wrapPatDraw(name, v, body)
+  if (isSimpleBind(name)) Expr.EMethod(v, "flatMap", Expr.ELam(name, "", body) :: noExpr(), 0) else wrapPatDraw(name, v, body)
 
 def wrapPatDraw(pat: String, v: Expr, body: Expr): Expr =
-  Expr.EMethod(Expr.EMethod(v, "flatMap", Expr.ELam("__p", Expr.ECall("IO.pure", Expr.EMatch(Expr.EVar("__p", 0), Arm(pat, "", patResult(pat)) :: noArm(), 0) :: noExpr(), 0)) :: noExpr(), 0), "flatMap", Expr.ELam(patBindName(pat), body) :: noExpr(), 0)
+  Expr.EMethod(Expr.EMethod(v, "flatMap", Expr.ELam("__p", "", Expr.ECall("IO.pure", Expr.EMatch(Expr.EVar("__p", 0), Arm(pat, "", patResult(pat)) :: noArm(), 0) :: noExpr(), 0)) :: noExpr(), 0), "flatMap", Expr.ELam(patBindName(pat), "", body) :: noExpr(), 0)
 
 def patResult(pat: String): Expr =
   if (isConsPat(pat)) Expr.EVar(consHead(pat), 0) else if (hasComma(patBind(pat))) Expr.ETuple(patEVars(splitPat(patBind(pat)))) else Expr.EVar(fieldBind(patBind(pat)), 0)
@@ -397,7 +416,7 @@ def joinComma(xs: List[String]): String =
   if (List.isEmpty(xs)) "" else if (List.isEmpty(List.tail(xs))) List.at(xs, 0) else Str.concat(List.at(xs, 0), Str.concat(", ", joinComma(List.tail(xs))))
 
 def wrapEq(name: String, v: Expr, body: Expr): Expr =
-  if (eqIsLet(name)) Expr.EMethod(Expr.ELam(name, body), "apply", nameSig(name, v) :: noExpr(), 0) else wrapDraw(name, Expr.ECall("IO.pure", v :: noExpr(), 0), body)
+  if (eqIsLet(name)) Expr.EMethod(Expr.ELam(name, "", body), "apply", nameSig(name, v) :: noExpr(), 0) else wrapDraw(name, Expr.ECall("IO.pure", v :: noExpr(), 0), body)
 
 def nameSig(name: String, v: Expr): Expr =
   if (name == "_" || !isSimpleBind(name)) v else nameSigGo(name, v)
@@ -457,7 +476,13 @@ def closeBrace(s: String, i: Int, depth: Int): Int =
   if (i >= Str.len(s) || depth <= 0) i else closeBraceCh(s, i, depth, Str.charAt(s, i))
 
 def closeBraceCh(s: String, i: Int, depth: Int, c: Int): Int =
-  if (c == 123) closeBrace(s, i + 1, depth + 1) else if (c == 125) closeBrace(s, i + 1, depth - 1) else closeBrace(s, i + 1, depth)
+  if (c == 34) closeBrace(s, skipQuoted(s, i + 1), depth) else if (c == 123) closeBrace(s, i + 1, depth + 1) else if (c == 125) closeBrace(s, i + 1, depth - 1) else closeBrace(s, i + 1, depth)
+
+def skipQuoted(s: String, i: Int): Int =
+  if (i >= Str.len(s)) i else skipQuotedCh(s, i, Str.charAt(s, i))
+
+def skipQuotedCh(s: String, i: Int, c: Int): Int =
+  if (c == 34) i + 1 else if (c == 92 && i + 1 < Str.len(s)) skipQuoted(s, i + 2) else skipQuoted(s, i + 1)
 
 def interpPartsBrace2(s: String, j: Int, i: Int, lit: String, acc: List[Expr]): List[Expr] =
   interpPartsBrace3(Parse.parseExprList(Lexer.lex(Str.slice(s, i + 2, j - 1)), 0), lit, acc, s, j)
@@ -561,6 +586,7 @@ def isFloatExpr(e: Expr, ps: List[Param], defs: List[Fun]): Bool =
     case Expr.EBin(_, a, b, _) => isFloatExpr(a, ps, defs) || isFloatExpr(b, ps, defs)
     case Expr.EUn(_, inner, _) => isFloatExpr(inner, ps, defs)
     case Expr.ENamed(_, inner) => isFloatExpr(inner, ps, defs)
+    case Expr.EAscribe(inner, _, _) => isFloatExpr(inner, ps, defs)
     case _ => false
   }
 
@@ -786,6 +812,7 @@ def exprIsI64Go(e: Expr, ps: List[Param], defs: List[Fun]): Bool =
     case Expr.EMatch(_, arms, _) => exprIsI64Match(arms, ps, defs)
     case Expr.EIf(_, t, _, _) => exprIsI64(t, ps, defs)
     case Expr.ENamed(_, inner) => exprIsI64(inner, ps, defs)
+    case Expr.EAscribe(inner, _, _) => exprIsI64(inner, ps, defs)
     case _ => false
   }
 
@@ -833,7 +860,7 @@ def hasSubAt(s: String, sub: String, i: Int): Bool =
   if (i + Str.len(sub) > Str.len(s)) false else if (startsAt(s, i, sub)) true else hasSubAt(s, sub, i + 1)
 
 def callIsI64(f: String, defs: List[Fun]): Bool =
-  f == "Signal.get" || f == "Str.byteLen" || f == "Property.a11yHas" || f == "Property.signalListLen" || f == "Property.signalInt" || f == "Color.rgb" || f == "Color.rgba" || f == "Theme.accent" || f == "Theme.primary" || f == "Theme.muted" || f == "Theme.foreground" || f == "Str.len" || f == "Str.charAt" || f == "Str.toInt" || f == "Str.startsWith" || f == "Str.eq" || f == "Str.contains" || f == "List.len" || f == "List.isEmpty" || f == "Map.size" || f == "Set.size" || f == "Map.contains" || f == "Set.contains" || f == "Json.has" || f == "Json.getBool" || f == "Json.getInt" || f == "Json.intOr" || f == "Json.isNull" || f == "Json.isObj" || f == "Json.isArr" || kitUnaryI64(f) != "" || kitBinaryI64(f) != "" || isTlI64Call(f) || funRetI64(defs, f)
+  f == "Signal.get" || f == "Str.byteLen" || f == "Property.a11yHas" || f == "Property.signalListLen" || f == "Property.signalInt" || f == "Color.rgb" || f == "Color.rgba" || f == "Theme.accent" || f == "Theme.primary" || f == "Theme.muted" || f == "Theme.foreground" || f == "Str.len" || f == "Str.charAt" || f == "Str.toInt" || f == "Str.startsWith" || f == "Str.eq" || f == "Str.contains" || f == "List.len" || f == "List.isEmpty" || f == "Map.size" || f == "Set.size" || f == "Map.contains" || f == "Set.contains" || f == "Json.has" || f == "Json.getBool" || f == "Json.getInt" || f == "Json.intOr" || f == "Json.boolOr" || f == "Json.isNull" || f == "Json.isObj" || f == "Json.isArr" || kitUnaryI64(f) != "" || kitBinaryI64(f) != "" || isTlI64Call(f) || funRetI64(defs, f)
 
 def isTlI64Call(f: String): Bool =
   f == "Timeline.len" || f == "Timeline.signalInt" || f == "Timeline.signalListLen" || f == "Timeline.signalStrHas" || tlHasRt(f) != "" || tlI64Rt(f) != ""
@@ -912,10 +939,10 @@ def emitCall3(f: String, code: String, vals: List[String], owns: List[Bool], pre
   if (isJsonExtra(f)) emitJsonExtra(f, code, vals, owns, prefix) else if (isRtExtra(f)) emitRtExtra(f, code, vals, owns, prefix) else if (isTlKit(f)) emitTlKit(f, code, vals, owns, prefix) else emitCall3b(f, code, vals, owns, prefix, defs, args, ens, ps, mod)
 
 def isRtExtra(f: String): Bool =
-  f == "IO.sleep" || f == "IO.fail" || f == "IO.timeout" || f == "IO.when" || f == "IO.unless" || f == "IO.repeatN" || f == "IO.retryN" || f == "Property.sometimes" || f == "Stream.range"
+  f == "IO.sleep" || f == "IO.fail" || f == "IO.timeout" || f == "IO.when" || f == "IO.unless" || f == "IO.repeatN" || f == "IO.retryN" || f == "Property.sometimes" || f == "Stream.range" || f == "Deferred.fail"
 
 def emitRtExtra(f: String, code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
-  if (f == "IO.sleep") emitSleep(code, vals, prefix) else if (f == "IO.fail") emitFail(code, vals, owns, prefix) else if (f == "IO.timeout") emitTimeout("sz_io_timeout", code, vals, owns, prefix) else if (f == "IO.when") emitWhen("sz_io_when", code, vals, owns, prefix) else if (f == "IO.unless") emitWhen("sz_io_unless", code, vals, owns, prefix) else if (f == "IO.repeatN") emitTimeout("sz_io_repeat_n", code, vals, owns, prefix) else if (f == "IO.retryN") emitTimeout("sz_io_retry_n", code, vals, owns, prefix) else if (f == "Stream.range") emitRange(code, vals, prefix) else emitSometimes(code, vals, owns, prefix)
+  if (f == "IO.sleep") emitSleep(code, vals, prefix) else if (f == "IO.fail") emitFail(code, vals, owns, prefix) else if (f == "Deferred.fail") emitDeferredFail(code, vals, owns, prefix) else if (f == "IO.timeout") emitTimeout("sz_io_timeout", code, vals, owns, prefix) else if (f == "IO.when") emitWhen("sz_io_when", code, vals, owns, prefix) else if (f == "IO.unless") emitWhen("sz_io_unless", code, vals, owns, prefix) else if (f == "IO.repeatN") emitTimeout("sz_io_repeat_n", code, vals, owns, prefix) else if (f == "IO.retryN") emitTimeout("sz_io_retry_n", code, vals, owns, prefix) else if (f == "Stream.range") emitRange(code, vals, prefix) else emitSometimes(code, vals, owns, prefix)
 
 def emitSleep(code: String, vals: List[String], prefix: String): Slot =
   Slot(join(code, line(Str.concat(tmp(prefix, "io"), Str.concat("call ptr @sz_io_sleep_ms(i64 ", Str.concat(arg0(vals), ")"))))), pct(prefix, "io"), false)
@@ -926,6 +953,15 @@ def emitFail(code: String, vals: List[String], owns: List[Bool], prefix: String)
 def emitFail2(code: String, s: String, o: Bool, prefix: String): Slot =
   Slot(join(code, join(line(Str.concat(tmp(prefix, "cstr"), Str.concat("call ptr @sz_string_cstr(ptr ", Str.concat(s, ")")))), join(line(Str.concat(tmp(prefix, "err"), Str.concat("call ptr @sz_error_new(i32 1, ptr ", Str.concat(pct(prefix, "cstr"), ")")))), join(line(Str.concat(tmp(prefix, "io"), Str.concat("call ptr @sz_io_fail(ptr ", Str.concat(pct(prefix, "err"), ")")))), join(relPtr(pct(prefix, "err")), if (o) relPtr(s) else ""))))), pct(prefix, "io"), false)
 
+def emitDeferredFail(code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
+  emitDeferredFail2(code, arg0(vals), arg1(vals), headOwn(owns), headOwn(tailOwn(owns)), prefix)
+
+def emitDeferredRel(od: Bool, d: String, os: Bool, s: String): String =
+  join(if (od) relPtr(d) else "", if (os) relPtr(s) else "")
+
+def emitDeferredFail2(code: String, d: String, s: String, od: Bool, os: Bool, prefix: String): Slot =
+  Slot(join(code, join(line(Str.concat(tmp(prefix, "cstr"), Str.concat("call ptr @sz_string_cstr(ptr ", Str.concat(s, ")")))), join(line(Str.concat(tmp(prefix, "err"), Str.concat("call ptr @sz_error_new(i32 1, ptr ", Str.concat(pct(prefix, "cstr"), ")")))), join(line(Str.concat(tmp(prefix, "io"), Str.concat("call ptr @sz_deferred_fail(ptr ", Str.concat(d, Str.concat(", ptr ", Str.concat(pct(prefix, "err"), ")")))))), join(relPtr(pct(prefix, "err")), emitDeferredRel(od, d, os, s)))))), pct(prefix, "io"), false)
+
 def emitTimeout(rt: String, code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
   emitTimeout2(rt, code, arg0(vals), arg1(vals), headOwn(tailOwn(owns)), prefix)
 
@@ -1002,7 +1038,7 @@ def emitNetServe2(rt: String, port: Slot, fn: Expr, prefix: String, defs: List[F
 
 def netServePtr(e: Expr, defs: List[Fun], mod: String): String =
   e match {
-    case Expr.ELam(p, body) => netServePtrLam(p, body, defs, mod)
+    case Expr.ELam(p, _, body) => netServePtrLam(p, body, defs, mod)
     case Expr.EVar(f, _) => funPtr(defs, f, mod)
     case Expr.EMethod(recv, name, _, _) => methodPtr(recv, name)
     case Expr.ECall(f, _, _) => funPtr(defs, f, mod)
@@ -1100,18 +1136,19 @@ def mapPackCall(rt: String, iv: String, prefix: String): String =
   Str.concat(tmp(prefix, "v"), Str.concat(mapKitCallMid(rt), Str.concat(iv, Str.concat(", ptr ", Str.concat(pct(prefix, "fnp"), Str.concat(", ptr ", Str.concat(pct(prefix, "envp"), mapKitCallEnd(rt))))))))
 
 def wrapPh(e: Expr, ps: List[Param], defs: List[Fun], mod: String): Expr =
-  if (needsPh(e)) Expr.ELam("_ph", rewriteHole(e, "_ph")) else etaKit(e, ps, defs, mod)
+  if (needsPh(e)) Expr.ELam("_ph", "", rewriteHole(e, "_ph")) else etaKit(e, ps, defs, mod)
 
 def etaKit(e: Expr, ps: List[Param], defs: List[Fun], mod: String): Expr =
   e match {
     case Expr.ECall(f, args, _) => if (List.isEmpty(args) && kitEta1(f)) phCall(f) else e
     case Expr.EVar(f, _) => if (etaVar(f, ps, defs, mod)) phCall(f) else e
     case Expr.ENamed(_, inner) => etaKit(inner, ps, defs, mod)
+    case Expr.EAscribe(inner, _, _) => etaKit(inner, ps, defs, mod)
     case _ => e
   }
 
 def phCall(f: String): Expr =
-  Expr.ELam("_ph", Expr.ECall(f, Expr.EVar("_ph", 0) :: noExpr(), 0))
+  Expr.ELam("_ph", "", Expr.ECall(f, Expr.EVar("_ph", 0) :: noExpr(), 0))
 
 def etaVar(f: String, ps: List[Param], defs: List[Fun], mod: String): Bool =
   if (kitEta1(f)) true else paramTy(ps, f) == "" && etaFun1(findDefPrefer(defs, f, mod))
@@ -1129,13 +1166,13 @@ def kitEta1(f: String): Bool =
 
 def mapLamBind(e: Expr): String =
   e match {
-    case Expr.ELam(p, _) => p
+    case Expr.ELam(p, _, _) => p
     case _ => "_"
   }
 
 def mapLamBody(e: Expr): Expr =
   e match {
-    case Expr.ELam(_, body) => body
+    case Expr.ELam(_, _, body) => body
     case _ => e
   }
 
@@ -1206,13 +1243,13 @@ def emitFoldKit4(rt: String, inner: Slot, z: Slot, lam: Expr, prefix: String, st
 
 def foldLam(e: Expr): Expr =
   e match {
-    case Expr.ELam(_, _) => e
+    case Expr.ELam(_, _, _) => e
     case Expr.EVar(f, _) => etaFold(f)
     case _ => e
   }
 
 def etaFold(f: String): Expr =
-  Expr.ELam("__tup", Expr.EMatch(Expr.EVar("__tup", 0), Arm("(a, b)", "", Expr.ECall(f, Expr.EVar("a", 0) :: Expr.EVar("b", 0) :: noExpr(), 0)) :: noArm(), 0))
+  Expr.ELam("__tup", "", Expr.EMatch(Expr.EVar("__tup", 0), Arm("(a, b)", "", Expr.ECall(f, Expr.EVar("a", 0) :: Expr.EVar("b", 0) :: noExpr(), 0)) :: noArm(), 0))
 
 def emitFoldKit4b(rt: String, inner: Slot, z: Slot, lam: Expr, prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   inner match {
@@ -1374,12 +1411,13 @@ def nameIntUse(e: Expr, n: String): Bool =
     case Expr.EBin(op, l, r, _) => nameIntUse(l, n) || nameIntUse(r, n)
     case Expr.EUn(_, inner, _) => nameIntUse(inner, n)
     case Expr.EIf(c, t, el, _) => nameIntUse(c, n) || nameIntUse(t, n) || nameIntUse(el, n)
-    case Expr.ELam(p, body) => if (p == n) false else nameIntUse(body, n)
+    case Expr.ELam(p, _, body) => if (p == n) false else nameIntUse(body, n)
     case Expr.EMatch(s, arms, _) => nameIntUse(s, n) || nameIntUseArms(arms, n)
     case Expr.EFor(bs, body, _) => nameIntUseBinds(bs, n) || nameIntUse(body, n)
     case Expr.EList(xs) => nameIntUseList(xs, n)
     case Expr.ETuple(xs) => nameIntUseList(xs, n)
     case Expr.ENamed(_, inner) => nameIntUse(inner, n)
+    case Expr.EAscribe(inner, _, _) => nameIntUse(inner, n)
     case Expr.EPrint(inner, _) => nameIntUse(inner, n)
     case _ => false
   }
@@ -1443,6 +1481,7 @@ def phUsedAsInt(e: Expr): Bool =
     case Expr.ECall(f, args, _) => phCallInt(f, args)
     case Expr.EMethod(_, name, args, _) => phCallInt(name, args)
     case Expr.ENamed(_, inner) => phUsedAsInt(inner)
+    case Expr.EAscribe(inner, _, _) => phUsedAsInt(inner)
     case _ => false
   }
 
@@ -1483,7 +1522,10 @@ def nethTupTy(body: Expr, rest: List[Param], defs: List[Fun]): String =
   if (exprIsI64(body, rest, defs)) "(Int, Int)" else "(Any, Any)"
 
 def emitNethBind2(bind: String, i64: Bool): String =
-  if (!keepBind(bind)) "" else if (i64) line(Str.concat("%", Str.concat(bind, " = call i64 @sz_unbox_i64(ptr %value)"))) else emitBindAliasPtr(bind)
+  if (!keepBind(bind)) "" else if (i64) emitNethBindI64(bind) else emitBindAliasPtr(bind)
+
+def emitNethBindI64(bind: String): String =
+  line(Str.concat("%", Str.concat(bind, " = call i64 @sz_unbox_i64(ptr %value)")))
 
 def emitNeth2(prefix: String, pre: String, s: Slot, loc: String, strs: List[String], pred: Bool): String =
   s match {
@@ -1618,10 +1660,10 @@ def nethRetLine(ret: String, pred: Bool): String =
   Str.concat(panicPop(), Str.concat(if (pred) "  ret i64 " else "  ret ptr ", ret))
 
 def isJsonExtra(f: String): Bool =
-  f == "Json.getInt" || f == "Json.getBool" || f == "Json.getStr" || f == "Json.intOr" || f == "Json.set" || f == "Json.setAt" || f == "Json.Int" || f == "Json.Null" || f == "Json.Float" || f == "Json.floatOr"
+  f == "Json.getInt" || f == "Json.getBool" || f == "Json.getStr" || f == "Json.intOr" || f == "Json.set" || f == "Json.setAt" || f == "Json.Int" || f == "Json.Null" || f == "Json.Float" || f == "Json.floatOr" || f == "Json.getFloat" || f == "Json.boolOr" || f == "Json.strOr"
 
 def emitJsonExtra(f: String, code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
-  if (f == "Json.getInt") emitJsonGetI64("sz_json_get_int", code, vals, owns, prefix) else if (f == "Json.getBool") emitJsonGetI64("sz_json_get_bool", code, vals, owns, prefix) else if (f == "Json.getStr") emitJsonGetStr(code, vals, owns, prefix) else if (f == "Json.intOr") emitJsonIntOr(code, vals, owns, prefix) else if (f == "Json.set") emitJsonSet(code, vals, owns, prefix) else if (f == "Json.setAt") emitJsonSetAt(code, vals, owns, prefix) else if (f == "Json.Int") emitJsonInt(code, vals, prefix) else if (f == "Json.Float") emitJsonFloat(code, vals, prefix) else if (f == "Json.floatOr") emitJsonFloatOr(code, vals, owns, prefix) else emitJsonNull(code, prefix)
+  if (f == "Json.getInt") emitJsonGetI64("sz_json_get_int", code, vals, owns, prefix) else if (f == "Json.getBool") emitJsonGetI64("sz_json_get_bool", code, vals, owns, prefix) else if (f == "Json.getStr") emitJsonGetStr(code, vals, owns, prefix) else if (f == "Json.intOr") emitJsonIntOr(code, vals, owns, prefix) else if (f == "Json.set") emitJsonSet(code, vals, owns, prefix) else if (f == "Json.setAt") emitJsonSetAt(code, vals, owns, prefix) else if (f == "Json.Int") emitJsonInt(code, vals, prefix) else if (f == "Json.Float") emitJsonFloat(code, vals, prefix) else if (f == "Json.floatOr") emitJsonFloatOr(code, vals, owns, prefix) else if (f == "Json.getFloat") emitJsonGetFloat(code, vals, owns, prefix) else if (f == "Json.boolOr") emitJsonBoolOr(code, vals, owns, prefix) else if (f == "Json.strOr") emitJsonStrOr(code, vals, owns, prefix) else emitJsonNull(code, prefix)
 
 def emitJsonFloat(code: String, vals: List[String], prefix: String): Slot =
   emitJsonFloat2(code, arg0(vals), prefix)
@@ -1647,6 +1689,36 @@ def jsonFloatOrFr(a: String, prefix: String): String =
 def jsonFloatOrV(prefix: String): String =
   line(Str.concat(tmp(prefix, "v"), Str.concat("bitcast double ", Str.concat(pct(prefix, "fr"), " to i64"))))
 
+def emitJsonGetFloat(code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
+  emitJsonGetFloat2(code, arg0(vals), arg1(vals), arg2(vals), headOwn(owns), headOwn(tailOwn(owns)), prefix)
+
+def emitJsonGetFloat2(code: String, a: String, b: String, n: String, oa: Bool, ob: Bool, prefix: String): Slot =
+  Slot(join(code, join(jsonGetFloatCall(a, b, n, prefix), join(if (oa) relPtr(a) else "", if (ob) relPtr(b) else ""))), pct(prefix, "v"), false)
+
+def jsonGetFloatCall(a: String, b: String, n: String, prefix: String): String =
+  join(jsonFloatOrFd(n, prefix), join(jsonGetFloatFr(a, b, prefix), jsonFloatOrV(prefix)))
+
+def jsonGetFloatFr(a: String, b: String, prefix: String): String =
+  line(Str.concat(tmp(prefix, "fr"), Str.concat("call double @sz_json_get_float(ptr ", Str.concat(a, Str.concat(", ptr ", Str.concat(b, Str.concat(", double ", Str.concat(pct(prefix, "fd"), ")"))))))))
+
+def emitJsonBoolOr(code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
+  emitJsonBoolOr2(code, arg0(vals), arg1(vals), headOwn(owns), prefix)
+
+def emitJsonBoolOr2(code: String, a: String, n: String, o: Bool, prefix: String): Slot =
+  Slot(join(code, join(jsonBoolOrCall(a, n, prefix), if (o) relPtr(a) else "")), pct(prefix, "v"), false)
+
+def jsonBoolOrCall(a: String, n: String, prefix: String): String =
+  line(Str.concat(tmp(prefix, "v"), Str.concat("call i64 @sz_json_bool_or(ptr ", Str.concat(a, Str.concat(", i64 ", Str.concat(n, ")"))))))
+
+def emitJsonStrOr(code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
+  emitJsonStrOr2(code, arg0(vals), arg1(vals), headOwn(owns), headOwn(tailOwn(owns)), prefix)
+
+def emitJsonStrOr2(code: String, a: String, d: String, oa: Bool, od: Bool, prefix: String): Slot =
+  Slot(join(code, join(jsonStrOrCall(a, d, prefix), join(if (oa) relPtr(a) else "", if (od) relPtr(d) else ""))), pct(prefix, "v"), true)
+
+def jsonStrOrCall(a: String, d: String, prefix: String): String =
+  line(Str.concat(tmp(prefix, "v"), Str.concat("call ptr @sz_json_str_or(ptr ", Str.concat(a, Str.concat(", ptr ", Str.concat(d, ")"))))))
+
 def emitJsonGetI64(rt: String, code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
   emitJsonGetI642(rt, code, arg0(vals), arg1(vals), arg2(vals), headOwn(owns), headOwn(tailOwn(owns)), prefix)
 
@@ -1705,7 +1777,7 @@ def emitJsonNull(code: String, prefix: String): Slot =
   Slot(join(code, emitAdtNew(prefix, 0, "null")), pct(prefix, "adt"), true)
 
 def emitCall3b(f: String, code: String, vals: List[String], owns: List[Bool], prefix: String, defs: List[Fun], args: List[Expr], ens: List[En], ps: List[Param], mod: String): Slot =
-  if (isUiKit(f)) emitUiKit(f, code, vals, owns, prefix) else if (f == "List.setAt") emitListSetAt(code, vals, owns, prefix) else if (f == "Str.fromInt") emitFromInt(code, vals, prefix, ps, owns, args) else if (f == "Str.concat") emitConcat(code, vals, owns, prefix) else if (f == "Str.len") emitStrLen(code, vals, owns, prefix) else if (f == "Str.byteLen") emitByteLen(code, vals, owns, prefix) else if (f == "Str.charAt") emitCharAt(code, vals, owns, prefix) else if (f == "Str.slice") emitSlice(code, vals, owns, prefix) else if (f == "Str.byteSlice") emitByteSlice(code, vals, owns, prefix) else if (f == "Str.toInt") emitToInt(code, vals, owns, prefix) else if (f == "Str.repeat") emitRepeat(code, vals, owns, prefix) else if (f == "Str.startsWith") emitStarts(code, vals, owns, prefix) else if (f == "Str.eq") emitStrEq(code, vals, owns, prefix) else if (f == "List.len") emitListLen(code, vals, owns, prefix) else if (f == "List.concat") emitListCat(code, vals, owns, prefix) else if (f == "List.reverse") emitListRev(code, vals, owns, prefix) else if (f == "List.head") emitListHead(code, vals, owns, prefix, args, ps) else if (f == "List.tail") emitListTail(code, vals, owns, prefix) else if (f == "List.isEmpty") emitListEmpty(code, vals, owns, prefix) else if (f == "List.cons") emitConsCall(code, vals, owns, prefix, args, ps, defs) else if (f == "List.at") emitAt(code, vals, owns, prefix, args, ps) else if (f == "List.join") emitListJoin(code, vals, owns, prefix) else if (kitUnaryPtr(f) != "") emitKitUnaryPtr(kitUnaryPtr(f), code, vals, owns, prefix) else if (kitUnaryI64(f) != "") emitKitUnaryI64(kitUnaryI64(f), code, vals, owns, prefix) else if (kitPtrI64(f) != "") emitKitPtrI64(kitPtrI64(f), code, vals, owns, prefix) else if (kitBinaryPtr(f) != "") emitKitBinaryPtr(kitBinaryPtr(f), code, vals, owns, prefix) else if (kitBinaryI64(f) != "") emitKitBinaryI64(kitBinaryI64(f), code, vals, owns, prefix) else if (f == "Stream.zipAll") emitZipAllKit("sz_stream_zip_all", code, vals, owns, prefix) else if (f == "List.zipAll") emitZipAllKit("sz_list_zip_all", code, vals, owns, prefix) else if (f == "Str.replace") emitStrReplace(code, vals, owns, prefix) else if (f == "Str.padLeft") emitStrPad("sz_string_pad_left", code, vals, owns, prefix) else if (f == "Str.padRight") emitStrPad("sz_string_pad_right", code, vals, owns, prefix) else if (f == "List.empty") emitListNil(code, prefix) else if (f == "Map.empty" || f == "Set.empty") emitMapEmpty(code, prefix) else if (f == "Map.set") emitMapSet(code, vals, owns, prefix) else if (f == "Set.add") emitSetAdd(code, vals, owns, prefix) else if (f == "Map.getOrElse") emitMapGetOr(code, vals, owns, prefix) else if (f == "Clock.monotonic") emitClock("sz_clock_monotonic", code, prefix) else if (f == "Clock.realTime") emitClock("sz_clock_real_time", code, prefix) else if (f == "Queue.unbounded") emitClock("sz_queue_unbounded", code, prefix) else if (f == "Deferred.empty") emitClock("sz_deferred_empty", code, prefix) else if (f == "Fs.mkdirs") emitFsMkdirs(code, vals, owns, prefix) else if (f == "Builder.empty") emitBldNew(code, prefix) else if (f == "Builder.append") emitBldApp(code, vals, owns, prefix) else if (f == "Builder.result") emitBldRes(code, vals, owns, prefix) else if (f == "Fs.read") emitFsRead(code, vals, owns, prefix) else if (f == "Fs.write") emitFsWrite(code, vals, owns, prefix) else if (f == "Fs.list") emitFsList(code, vals, owns, prefix) else if (f == "Fs.canonicalize") emitFsReadRt("sz_fs_canonicalize", code, vals, owns, prefix) else if (f == "Fs.exists") emitFsReadRt("sz_fs_exists", code, vals, owns, prefix) else if (f == "Fs.walk") emitFsReadRt("sz_fs_walk", code, vals, owns, prefix) else if (f == "Fs.delete") emitFsReadRt("sz_fs_delete", code, vals, owns, prefix) else if (f == "Fs.rename") emitFsWriteRt("sz_fs_rename", code, vals, owns, prefix) else if (f == "Net.httpPost") emitFsWriteRt("sz_net_http_post", code, vals, owns, prefix) else if (f == "Net.httpPut") emitFsWriteRt("sz_net_http_put", code, vals, owns, prefix) else if (f == "Net.httpPatch") emitFsWriteRt("sz_net_http_patch", code, vals, owns, prefix) else if (f == "Net.tcpListen") emitSysI64("sz_net_tcp_listen", code, vals, prefix) else if (f == "Net.udpBind") emitSysI64("sz_net_udp_bind", code, vals, prefix) else if (f == "Net.tcpConnect") emitNetPtrI64("sz_net_tcp_connect", code, vals, owns, prefix) else if (f == "Net.tcpRead") emitNetPtrI64("sz_net_tcp_read", code, vals, owns, prefix) else if (f == "Net.udpRecv") emitNetPtrI64("sz_net_udp_recv", code, vals, owns, prefix) else if (f == "Net.tcpWrite") emitFsWriteRt("sz_net_tcp_write", code, vals, owns, prefix) else if (f == "Net.udpSend") emitNetUdpSend(code, vals, owns, prefix) else if (f == "Net.tcpAccept") emitFsReadRt("sz_net_tcp_accept", code, vals, owns, prefix) else if (f == "Net.tcpClose") emitFsReadRt("sz_net_tcp_close", code, vals, owns, prefix) else if (f == "Net.udpClose") emitFsReadRt("sz_net_udp_close", code, vals, owns, prefix) else if (f == "Random.nextInt") emitSysI64("sz_random_next_int", code, vals, prefix) else if (f == "Sys.getenv") emitFsReadRt("sz_sys_getenv", code, vals, owns, prefix) else if (f == "Sys.write") emitFsReadRt("sz_sys_write", code, vals, owns, prefix) else if (f == "Sys.exec") emitFsReadRt("sz_sys_exec", code, vals, owns, prefix) else if (f == "Sys.spawn") emitFsReadRt("sz_sys_spawn", code, vals, owns, prefix) else if (f == "Sys.kill") emitSysI64("sz_sys_kill", code, vals, prefix) else if (f == "Sys.alive") emitSysI64("sz_sys_alive", code, vals, prefix) else if (f == "Sys.childClose") emitSysI64("sz_sys_child_close", code, vals, prefix) else if (f == "Sys.childRead") emitSysI64I64("sz_sys_child_read", code, vals, prefix) else if (f == "Sys.childWrite") emitSysI64Ptr("sz_sys_child_write", code, vals, owns, prefix) else if (f == "Impurity.runKit") emitClock("sz_impurity_run_kit", code, prefix) else if (f == "Sys.args") emitSysArgs(code, prefix) else if (f == "Sys.read") emitSysI64("sz_sys_read", code, vals, prefix) else if (f == "Sys.readLine") emitClock("sz_sys_read_line", code, prefix) else if (f == "IO.pure") emitIoPure(code, vals, owns, prefix, ps) else if (f == "List.range") emitListRange(code, vals, prefix) else if (f == "List.fill") emitListFill(code, vals, owns, prefix) else if (f == "List.getOrElse") emitListGetOr(code, vals, owns, prefix) else if (f == "List.padTo") emitListPadTo(code, vals, owns, prefix) else if (f == "List.max") emitListExtreme("sz_list_max", code, vals, owns, prefix, args, ps, defs) else if (f == "List.min") emitListExtreme("sz_list_min", code, vals, owns, prefix, args, ps, defs) else if (f == "List.sort") emitListAsInt("sz_list_sort", code, vals, owns, prefix, args, ps, defs) else if (f == "List.toSet") emitListToSet(code, vals, owns, prefix, args, ps) else if (f == "List.slice") emitListSlice(code, vals, owns, prefix) else if (f == "List.isDefinedAt") emitKitPtrI64I64("sz_list_is_defined_at", code, vals, owns, prefix) else if (f == "List.lengthCompare") emitKitPtrI64I64("sz_list_length_compare", code, vals, owns, prefix) else if (f == "Map.isEmpty" || f == "Set.isEmpty") emitMapSizePred(code, vals, owns, prefix, "eq") else if (f == "Map.nonEmpty" || f == "Set.nonEmpty") emitMapSizePred(code, vals, owns, prefix, "ne") else if (f == "Float.toInt") emitFloatToInt(code, vals, owns, prefix, ps) else if (f == "Float.fromInt") emitFloatFromInt(code, vals, prefix) else if (f == "Oracle.sumTo") emitOracleSumTo(code, vals, prefix) else if (hasEn(ens, f) || isCtorName(f)) emitRec(f, code, vals, owns, prefix, ens, args, ps, defs) else if (isQualCtor(f, ens)) emitQualCtor(f, code, vals, owns, prefix, ens, ps) else emitUser(f, code, vals, owns, prefix, defs, mod)
+  if (isUiKit(f)) emitUiKit(f, code, vals, owns, prefix) else if (f == "List.setAt") emitListSetAt(code, vals, owns, prefix) else if (f == "Str.fromInt") emitFromInt(code, vals, prefix, ps, owns, args) else if (f == "Str.fromBool") emitFromBool(code, vals, prefix) else if (f == "Str.concat") emitConcat(code, vals, owns, prefix) else if (f == "Str.len") emitStrLen(code, vals, owns, prefix) else if (f == "Str.byteLen") emitByteLen(code, vals, owns, prefix) else if (f == "Str.charAt") emitCharAt(code, vals, owns, prefix) else if (f == "Str.slice") emitSlice(code, vals, owns, prefix) else if (f == "Str.byteSlice") emitByteSlice(code, vals, owns, prefix) else if (f == "Str.toInt") emitToInt(code, vals, owns, prefix) else if (f == "Str.repeat") emitRepeat(code, vals, owns, prefix) else if (f == "Str.startsWith") emitStarts(code, vals, owns, prefix) else if (f == "Str.eq") emitStrEq(code, vals, owns, prefix) else if (f == "List.len") emitListLen(code, vals, owns, prefix) else if (f == "List.concat") emitListCat(code, vals, owns, prefix) else if (f == "List.reverse") emitListRev(code, vals, owns, prefix) else if (f == "List.head") emitListHead(code, vals, owns, prefix) else if (f == "List.tail") emitListTail(code, vals, owns, prefix) else if (f == "List.isEmpty") emitListEmpty(code, vals, owns, prefix) else if (f == "List.cons") emitConsCall(code, vals, owns, prefix, args, ps, defs) else if (f == "List.at") emitAt(code, vals, owns, prefix, args, ps) else if (f == "List.join") emitListJoin(code, vals, owns, prefix) else if (kitUnaryPtr(f) != "") emitKitUnaryPtr(kitUnaryPtr(f), code, vals, owns, prefix) else if (kitUnaryI64(f) != "") emitKitUnaryI64(kitUnaryI64(f), code, vals, owns, prefix) else if (kitPtrI64(f) != "") emitKitPtrI64(kitPtrI64(f), code, vals, owns, prefix) else if (kitBinaryPtr(f) != "") emitKitBinaryPtr(kitBinaryPtr(f), code, vals, owns, prefix) else if (kitBinaryI64(f) != "") emitKitBinaryI64(kitBinaryI64(f), code, vals, owns, prefix) else if (f == "Stream.zipAll") emitZipAllKit("sz_stream_zip_all", code, vals, owns, prefix) else if (f == "List.zipAll") emitZipAllKit("sz_list_zip_all", code, vals, owns, prefix) else if (f == "Str.replace") emitStrReplace(code, vals, owns, prefix) else if (f == "Str.padLeft") emitStrPad("sz_string_pad_left", code, vals, owns, prefix) else if (f == "Str.padRight") emitStrPad("sz_string_pad_right", code, vals, owns, prefix) else if (f == "List.empty") emitListNil(code, prefix) else if (f == "Map.empty" || f == "Set.empty") emitMapEmpty(code, prefix) else if (f == "Map.set") emitMapSet(code, vals, owns, prefix) else if (f == "Set.add") emitSetAdd(code, vals, owns, prefix) else if (f == "Map.getOrElse") emitMapGetOr(code, vals, owns, prefix) else if (f == "Clock.monotonic") emitClock("sz_clock_monotonic", code, prefix) else if (f == "Clock.realTime") emitClock("sz_clock_real_time", code, prefix) else if (f == "Queue.unbounded") emitClock("sz_queue_unbounded", code, prefix) else if (f == "Deferred.empty") emitClock("sz_deferred_empty", code, prefix) else if (f == "Fs.mkdirs") emitFsMkdirs(code, vals, owns, prefix) else if (f == "Builder.empty") emitBldNew(code, prefix) else if (f == "Builder.append") emitBldApp(code, vals, owns, prefix) else if (f == "Builder.result") emitBldRes(code, vals, owns, prefix) else if (f == "Fs.read") emitFsRead(code, vals, owns, prefix) else if (f == "Fs.write") emitFsWrite(code, vals, owns, prefix) else if (f == "Fs.list") emitFsList(code, vals, owns, prefix) else if (f == "Fs.canonicalize") emitFsReadRt("sz_fs_canonicalize", code, vals, owns, prefix) else if (f == "Fs.exists") emitFsReadRt("sz_fs_exists", code, vals, owns, prefix) else if (f == "Fs.walk") emitFsReadRt("sz_fs_walk", code, vals, owns, prefix) else if (f == "Fs.delete") emitFsReadRt("sz_fs_delete", code, vals, owns, prefix) else if (f == "Fs.rename") emitFsWriteRt("sz_fs_rename", code, vals, owns, prefix) else if (f == "Net.httpPost") emitFsWriteRt("sz_net_http_post", code, vals, owns, prefix) else if (f == "Net.httpPut") emitFsWriteRt("sz_net_http_put", code, vals, owns, prefix) else if (f == "Net.httpPatch") emitFsWriteRt("sz_net_http_patch", code, vals, owns, prefix) else if (f == "Net.tcpListen") emitSysI64("sz_net_tcp_listen", code, vals, prefix) else if (f == "Net.udpBind") emitSysI64("sz_net_udp_bind", code, vals, prefix) else if (f == "Net.tcpConnect") emitNetPtrI64("sz_net_tcp_connect", code, vals, owns, prefix) else if (f == "Net.tcpRead") emitNetPtrI64("sz_net_tcp_read", code, vals, owns, prefix) else if (f == "Net.udpRecv") emitNetPtrI64("sz_net_udp_recv", code, vals, owns, prefix) else if (f == "Net.tcpWrite") emitFsWriteRt("sz_net_tcp_write", code, vals, owns, prefix) else if (f == "Net.udpSend") emitNetUdpSend(code, vals, owns, prefix) else if (f == "Net.tcpAccept") emitFsReadRt("sz_net_tcp_accept", code, vals, owns, prefix) else if (f == "Net.tcpClose") emitFsReadRt("sz_net_tcp_close", code, vals, owns, prefix) else if (f == "Net.udpClose") emitFsReadRt("sz_net_udp_close", code, vals, owns, prefix) else if (f == "Random.nextInt") emitSysI64("sz_random_next_int", code, vals, prefix) else if (f == "Sys.getenv") emitFsReadRt("sz_sys_getenv", code, vals, owns, prefix) else if (f == "Sys.write") emitFsReadRt("sz_sys_write", code, vals, owns, prefix) else if (f == "Sys.exec") emitFsReadRt("sz_sys_exec", code, vals, owns, prefix) else if (f == "Sys.spawn") emitFsReadRt("sz_sys_spawn", code, vals, owns, prefix) else if (f == "Sys.kill") emitSysI64("sz_sys_kill", code, vals, prefix) else if (f == "Sys.alive") emitSysI64("sz_sys_alive", code, vals, prefix) else if (f == "Sys.childClose") emitSysI64("sz_sys_child_close", code, vals, prefix) else if (f == "Sys.childRead") emitSysI64I64("sz_sys_child_read", code, vals, prefix) else if (f == "Sys.childWrite") emitSysI64Ptr("sz_sys_child_write", code, vals, owns, prefix) else if (f == "Impurity.runKit") emitClock("sz_impurity_run_kit", code, prefix) else if (f == "Sys.args") emitSysArgs(code, prefix) else if (f == "Sys.read") emitSysI64("sz_sys_read", code, vals, prefix) else if (f == "Sys.readLine") emitClock("sz_sys_read_line", code, prefix) else if (f == "IO.pure") emitIoPure(code, vals, owns, prefix, ps) else if (f == "List.range") emitListRange(code, vals, prefix) else if (f == "List.fill") emitListFill(code, vals, owns, prefix) else if (f == "List.getOrElse") emitListGetOr(code, vals, owns, prefix) else if (f == "List.padTo") emitListPadTo(code, vals, owns, prefix) else if (f == "List.max") emitListExtreme("sz_list_max", code, vals, owns, prefix, args, ps, defs) else if (f == "List.min") emitListExtreme("sz_list_min", code, vals, owns, prefix, args, ps, defs) else if (f == "List.sort") emitListAsInt("sz_list_sort", code, vals, owns, prefix, args, ps, defs) else if (f == "List.toSet") emitListToSet(code, vals, owns, prefix, args, ps) else if (f == "List.slice") emitListSlice(code, vals, owns, prefix) else if (f == "List.isDefinedAt") emitKitPtrI64I64("sz_list_is_defined_at", code, vals, owns, prefix) else if (f == "List.lengthCompare") emitKitPtrI64I64("sz_list_length_compare", code, vals, owns, prefix) else if (f == "Map.isEmpty" || f == "Set.isEmpty") emitMapSizePred(code, vals, owns, prefix, "eq") else if (f == "Map.nonEmpty" || f == "Set.nonEmpty") emitMapSizePred(code, vals, owns, prefix, "ne") else if (f == "Float.toInt") emitFloatToInt(code, vals, owns, prefix, ps) else if (f == "Float.fromInt") emitFloatFromInt(code, vals, prefix) else if (f == "Oracle.sumTo") emitOracleSumTo(code, vals, prefix) else if (hasEn(ens, f) || isCtorName(f)) emitRec(f, code, vals, owns, prefix, ens, args, ps, defs) else if (isQualCtor(f, ens)) emitQualCtor(f, code, vals, owns, prefix, ens, ps) else emitUser(f, code, vals, owns, prefix, defs, mod)
 
 def emitUiKit(f: String, code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
   if (f == "Color.rgb") emitColorRgb(code, vals, prefix) else if (f == "Color.rgba") emitColorRgba(code, vals, prefix) else if (Str.startsWith(f, "Theme.")) emitTheme(f, code, prefix) else if (f == "Ui.run") emitUiRun(code, vals, owns, prefix) else if (Str.startsWith(f, "Ui.")) emitUiSess(f, code, vals, owns, prefix) else if (Str.startsWith(f, "Property.")) emitPropKit(f, code, vals, owns, prefix) else if (Str.startsWith(f, "Signal.")) emitSignalKit(f, code, vals, owns, prefix) else emitViewKit(f, code, vals, owns, prefix)
@@ -2001,7 +2073,7 @@ def emitViewEachJoin(src: Slot, fn: Expr, elemTy: String, prefix: String, strs:
 
 def emitEachLamTy(e: Expr, elemTy: String, prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   e match {
-    case Expr.ELam(p, body) => emitLam2(emitNethGoTy(prefix, p, body, dropParam(ps, p), strs, defs, ens, loc, false, eachBindTy(p, body, dropParam(ps, p), defs, elemTy)), emitPackEnv(copyPs(ps), Str.concat(prefix, "_e")), prefix)
+    case Expr.ELam(p, _, body) => emitLam2(emitNethGoTy(prefix, p, body, dropParam(ps, p), strs, defs, ens, loc, false, eachBindTy(p, body, dropParam(ps, p), defs, elemTy)), emitPackEnv(copyPs(ps), Str.concat(prefix, "_e")), prefix)
     case _ => emitExpr(e, prefix, strs, defs, ens, ps, loc)
   }
 
@@ -2178,44 +2250,15 @@ def emitCallKit(f: String, args: List[Expr], prefix: String, strs: List[String],
 def emitCallKit2(f: String, args: List[Expr], prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   if (f == "Property.check") emitPropCheckCall(args, prefix, strs, defs, ens, ps, loc) else emitCall2(f, emitArgList(alignArgs(f, args, defs, modOfLoc(loc)), prefix, strs, defs, ens, ps, loc, 0, "", noStr(), noBool()), prefix, defs, alignArgs(f, args, defs, modOfLoc(loc)), ens, ps, modOfLoc(loc))
 
-def hasNamedArg(xs: List[Expr]): Bool =
-  !List.isEmpty(xs) && (isNamedArg(List.at(xs, 0)) || hasNamedArg(List.tail(xs)))
-
-def isNamedArg(e: Expr): Bool =
-  e match {
-    case Expr.ENamed(_, _) => true
-    case _ => false
-  }
-
 def alignArgs(f: String, args: List[Expr], defs: List[Fun], mod: String): List[Expr] =
   alignFill(funParamsOf(defs, f, mod), args)
 
 def alignFill(ps: List[Param], args: List[Expr]): List[Expr] =
-  if (List.isEmpty(ps)) args else if (hasNamedArg(args)) alignByParams(ps, args) else fillTail(ps, args, List.len(args))
-
-def fillTail(ps: List[Param], args: List[Expr], i: Int): List[Expr] =
-  if (i >= List.len(ps)) args else fillTail(ps, List.concat(args, paramDflt(List.at(ps, i)) :: noExpr()), i + 1)
-
-def paramDflt(p: Param): Expr =
-  p match {
-    case Param(_, _, _, d) => if (d == "") Expr.EUnit else dfltExpr(d)
-  }
+  alignFillGot(alignCall(ps, args))
 
-def dfltExpr(d: String): Expr =
-  dfltExprOf(Parse.parseExprList(Lexer.lex(d), 0))
-
-def dfltExprOf(p: (Expr, Int)): Expr =
+def alignFillGot(p: (List[Expr], String)): List[Expr] =
   p match {
-    case (e, _) => e
-  }
-
-def namedHas(n: String, args: List[Expr]): Bool =
-  !List.isEmpty(args) && namedHas1(List.at(args, 0), List.tail(args), n)
-
-def namedHas1(h: Expr, rest: List[Expr], n: String): Bool =
-  h match {
-    case Expr.ENamed(nm, _) => nm == n || namedHas(n, rest)
-    case _ => namedHas(n, rest)
+    case (xs, _) => xs
   }
 
 def funParamsOf(defs: List[Fun], f: String, mod: String): List[Param] =
@@ -2229,23 +2272,6 @@ def funParamsOfD(d: Fun): List[Param] =
     case Fun(_, _, _, ps, _, _, _, _) => ps
   }
 
-def alignByParams(ps: List[Param], args: List[Expr]): List[Expr] =
-  if (List.isEmpty(ps)) noExpr() else namedOrDflt(List.at(ps, 0), args) :: alignByParams(List.tail(ps), args)
-
-def namedOrDflt(p: Param, args: List[Expr]): Expr =
-  p match {
-    case Param(n, _, _, d) => if (d == "" || namedHas(n, args)) namedLookup(n, args) else dfltExpr(d)
-  }
-
-def namedLookup(n: String, args: List[Expr]): Expr =
-  if (List.isEmpty(args)) Expr.EUnit else namedLookup1(List.at(args, 0), List.tail(args), n)
-
-def namedLookup1(h: Expr, rest: List[Expr], n: String): Expr =
-  h match {
-    case Expr.ENamed(nm, inner) => if (nm == n) inner else namedLookup(n, rest)
-    case _ => namedLookup(n, rest)
-  }
-
 def emitPropCheckCall(args: List[Expr], prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   emitPropCheckCall2(nthE(args, 0), nthE(args, 1), nthE(args, 2), prefix, strs, defs, ens, ps, loc)
 
@@ -2285,12 +2311,13 @@ def exprHasVar(e: Expr, s: String): Bool =
     case Expr.EField(recv, _, _) => exprHasVar(recv, s)
     case Expr.EBin(_, l, r, _) => exprHasVar(l, s) || exprHasVar(r, s)
     case Expr.EUn(_, inner, _) => exprHasVar(inner, s)
-    case Expr.ELam(_, body) => exprHasVar(body, s)
+    case Expr.ELam(_, _, body) => exprHasVar(body, s)
     case Expr.EIf(c, t, el, _) => exprHasVar(c, s) || exprHasVar(t, s) || exprHasVar(el, s)
     case Expr.EMatch(sc, arms, _) => exprHasVar(sc, s) || armsHasVar(arms, s)
     case Expr.EList(xs) => listHasVar(xs, s)
     case Expr.ETuple(xs) => listHasVar(xs, s)
     case Expr.ENamed(_, inner) => exprHasVar(inner, s)
+    case Expr.EAscribe(inner, _, _) => exprHasVar(inner, s)
     case Expr.EFor(bs, body, _) => bindsHasVar(bs, s) || exprHasVar(body, s)
     case _ => false
   }
@@ -2319,7 +2346,7 @@ def emitUiRunCall(args: List[Expr], prefix: String, strs: List[String], defs: Li
 
 def emitUiRunLam(e: Expr, prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   e match {
-    case Expr.ELam(p, body) => emitLam2(emitRebuildNeth(prefix, p, body, strs, defs, ens, ps, loc), emitPackEnv(copyPs(ps), Str.concat(prefix, "_e")), prefix)
+    case Expr.ELam(p, _, body) => emitLam2(emitRebuildNeth(prefix, p, body, strs, defs, ens, ps, loc), emitPackEnv(copyPs(ps), Str.concat(prefix, "_e")), prefix)
     case _ => emitExpr(e, prefix, strs, defs, ens, ps, loc)
   }
 
@@ -2353,7 +2380,7 @@ def emitSigMapJoin(src: Slot, fn: Expr, prefix: String, strs: List[String], defs
 
 def emitSigMapLam(e: Expr, prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   e match {
-    case Expr.ELam(p, body) => emitLam2(emitMapNeth(prefix, p, body, strs, defs, ens, ps, loc), emitPackEnv(copyPs(ps), Str.concat(prefix, "_e")), prefix)
+    case Expr.ELam(p, _, body) => emitLam2(emitMapNeth(prefix, p, body, strs, defs, ens, ps, loc), emitPackEnv(copyPs(ps), Str.concat(prefix, "_e")), prefix)
     case _ => emitExpr(e, prefix, strs, defs, ens, ps, loc)
   }
 
@@ -2372,7 +2399,7 @@ def emitTapViewJoin(rt: String, lab: Slot, fn: Expr, prefix: String, strs: List[
 
 def emitTapLam(e: Expr, prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   e match {
-    case Expr.ELam(p, body) => emitLam2(emitTapNeth(prefix, p, body, strs, defs, ens, ps, loc), emitPackEnv(copyPs(ps), Str.concat(prefix, "_e")), prefix)
+    case Expr.ELam(p, _, body) => emitLam2(emitTapNeth(prefix, p, body, strs, defs, ens, ps, loc), emitPackEnv(copyPs(ps), Str.concat(prefix, "_e")), prefix)
     case _ => emitExpr(e, prefix, strs, defs, ens, ps, loc)
   }
 
@@ -2436,7 +2463,7 @@ def emitApply5(unbox: Bool, code: String, prefix: String): Slot =
 
 def emitApplyRecv(recv: Expr, args: List[Expr], prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String, fid: Int): Slot =
   recv match {
-    case Expr.ELam(p, body) => emitApplyLam(p, body, args, prefix, strs, defs, ens, ps, loc, fid)
+    case Expr.ELam(p, _, body) => emitApplyLam(p, body, args, prefix, strs, defs, ens, ps, loc, fid)
     case Expr.EMatch(_, arms, _) => emitMatch(applyScrut(args), arms, prefix, strs, defs, ens, ps, loc)
     case _ => emitApplyRecvTy(funTyRecv(recv, defs, ps), recv, args, prefix, strs, defs, ens, ps, loc)
   }
@@ -2574,7 +2601,7 @@ def funTyRecv(recv: Expr, defs: List[Fun], ps: List[Param]): String =
   recv match {
     case Expr.EVar(s, _) => funTyVar(s, defs, ps)
     case Expr.ECall(f, _, _) => funRetStr(defs, f)
-    case Expr.ELam(p, _) => if (p == "__tup") "(Any, Any) => Int" else "Int => Int"
+    case Expr.ELam(p, _, _) => if (p == "__tup") "(Any, Any) => Int" else "Int => Int"
     case _ => "Any"
   }
 
@@ -2696,7 +2723,7 @@ def netHttpUnaryRt(f: String): String =
   if (f == "Net.httpDelete") "sz_net_http_delete" else if (f == "Net.httpHead") "sz_net_http_head" else "sz_net_http_get"
 
 def kitUnaryI64(f: String): String =
-  if (f == "Map.size" || f == "Set.size") "sz_map_size" else if (f == "Json.isNull") "sz_json_is_null" else if (f == "Json.isObj") "sz_json_is_obj" else if (f == "Json.isArr") "sz_json_is_arr" else if (f == "List.sum") "sz_list_sum" else if (f == "List.product") "sz_list_product" else if (f == "List.nonEmpty") "sz_list_non_empty" else if (f == "Str.isEmpty") "sz_string_is_empty" else if (f == "Str.nonEmpty") "sz_string_non_empty" else if (f == "Str.isBlank") "sz_string_is_blank" else ""
+  if (f == "Map.size" || f == "Set.size") "sz_map_size" else if (f == "Json.isNull") "sz_json_is_null" else if (f == "Json.isObj") "sz_json_is_obj" else if (f == "Json.isArr") "sz_json_is_arr" else if (f == "Json.isBool") "sz_json_is_bool" else if (f == "Json.isInt") "sz_json_is_int" else if (f == "Json.isStr") "sz_json_is_str" else if (f == "Json.isFloat") "sz_json_is_float" else if (f == "List.sum") "sz_list_sum" else if (f == "List.product") "sz_list_product" else if (f == "List.nonEmpty") "sz_list_non_empty" else if (f == "Str.isEmpty") "sz_string_is_empty" else if (f == "Str.nonEmpty") "sz_string_non_empty" else if (f == "Str.isBlank") "sz_string_is_blank" else ""
 
 def kitPtrI64(f: String): String =
   if (f == "List.take") "sz_list_take" else if (f == "List.drop") "sz_list_drop" else if (f == "List.takeRight") "sz_list_take_right" else if (f == "List.dropRight") "sz_list_drop_right" else if (f == "List.splitAt") "sz_list_split_at" else if (f == "List.grouped") "sz_list_grouped" else if (f == "List.sliding") "sz_list_sliding" else if (f == "Str.take") "sz_string_utake" else if (f == "Str.drop") "sz_string_udrop" else if (f == "Str.takeRight") "sz_string_utake_right" else if (f == "Str.dropRight") "sz_string_udrop_right" else if (f == "Json.at") "sz_json_at" else if (f == "Json.dropAt") "sz_json_drop_at" else if (f == "Stream.take") "sz_stream_take" else if (f == "Stream.drop") "sz_stream_drop" else if (f == "Stream.repeatN") "sz_stream_repeat_n" else if (f == "Stream.grouped") "sz_stream_grouped" else if (f == "Stream.takeRight") "sz_stream_take_right" else if (f == "Stream.dropRight") "sz_stream_drop_right" else if (f == "Stream.sliding") "sz_stream_sliding" else ""
@@ -2705,7 +2732,7 @@ def kitBinaryPtr(f: String): String =
   if (f == "Json.get") "sz_json_get" else if (f == "Json.merge") "sz_json_merge" else if (f == "Json.remove") "sz_json_remove" else if (f == "Json.append") "sz_json_append" else if (f == "Json.prepend") "sz_json_prepend" else if (f == "Set.union") "sz_set_union" else if (f == "Set.intersect") "sz_set_intersect" else if (f == "Set.diff") "sz_set_diff" else if (f == "Map.union") "sz_map_union" else if (f == "Map.intersect") "sz_map_intersect" else if (f == "Map.diff") "sz_map_diff" else if (f == "Map.remove" || f == "Set.remove") "sz_map_remove" else if (f == "Map.get") "sz_map_get" else kitBinaryPtrB(f)
 
 def kitBinaryPtrB(f: String): String =
-  if (f == "IO.both") "sz_io_both" else if (f == "IO.race") "sz_io_race" else if (f == "IO.ensure") "sz_io_ensure" else if (f == "Ref.set") "sz_ref_set" else if (f == "Queue.offer") "sz_queue_offer" else if (f == "Deferred.complete") "sz_deferred_complete" else if (f == "Stream.concat") "sz_stream_concat" else if (f == "Stream.zip") "sz_stream_zip" else if (f == "Stream.interleave") "sz_stream_interleave" else if (f == "Stream.orElse") "sz_stream_or_else" else if (f == "Stream.intersperse") "sz_stream_intersperse" else if (f == "List.interleave") "sz_list_interleave" else if (f == "List.append") "sz_list_append" else if (f == "List.zip") "sz_list_zip" else if (f == "List.intersperse") "sz_list_intersperse" else if (f == "List.diff") "sz_list_diff" else if (f == "List.intersect") "sz_list_intersect" else if (f == "Str.split") "sz_string_split" else if (f == "Str.stripPrefix") "sz_string_strip_prefix" else if (f == "Str.stripSuffix") "sz_string_strip_suffix" else if (f == "Fs.join") "sz_fs_join" else ""
+  if (f == "IO.both") "sz_io_both" else if (f == "IO.race") "sz_io_race" else if (f == "IO.ensure") "sz_io_ensure" else if (f == "Ref.set") "sz_ref_set" else if (f == "Queue.offer") "sz_queue_offer" else if (f == "Deferred.complete") "sz_deferred_complete" else if (f == "Deferred.fail") "sz_deferred_fail" else if (f == "Stream.concat") "sz_stream_concat" else if (f == "Stream.zip") "sz_stream_zip" else if (f == "Stream.interleave") "sz_stream_interleave" else if (f == "Stream.orElse") "sz_stream_or_else" else if (f == "Stream.intersperse") "sz_stream_intersperse" else if (f == "List.interleave") "sz_list_interleave" else if (f == "List.append") "sz_list_append" else if (f == "List.zip") "sz_list_zip" else if (f == "List.intersperse") "sz_list_intersperse" else if (f == "List.diff") "sz_list_diff" else if (f == "List.intersect") "sz_list_intersect" else if (f == "Str.split") "sz_string_split" else if (f == "Str.stripPrefix") "sz_string_strip_prefix" else if (f == "Str.stripSuffix") "sz_string_strip_suffix" else if (f == "Fs.join") "sz_fs_join" else ""
 
 def kitBinaryI64(f: String): String =
   if (f == "Map.contains" || f == "Set.contains") "sz_map_contains" else if (f == "Json.has") "sz_json_has" else if (f == "Str.contains") "sz_string_contains" else if (f == "Str.endsWith") "sz_string_ends_with" else if (f == "Str.indexOf") "sz_string_uindex_of" else if (f == "Str.lastIndexOf") "sz_string_ulast_index_of" else if (f == "Set.isSubset") "sz_set_is_subset" else if (f == "Set.isDisjoint") "sz_set_is_disjoint" else if (f == "List.contains") "sz_list_contains" else if (f == "List.indexOf") "sz_list_index_of" else if (f == "List.lastIndexOf") "sz_list_last_index_of" else if (f == "List.indexOfSlice") "sz_list_index_of_slice" else if (f == "List.lastIndexOfSlice") "sz_list_last_index_of_slice" else ""
@@ -2780,13 +2807,10 @@ def emitListJoin(code: String, vals: List[String], owns: List[Bool], prefix: Str
   emitListJoin2(code, arg0(vals), arg1(vals), headOwn(owns), headOwn(tailOwn(owns)), prefix)
 
 def emitListJoin2(code: String, xs: String, sep: String, ox: Bool, os: Bool, prefix: String): Slot =
-  Slot(join(code, join(kitJoinCstr(sep, prefix), join(kitJoinCall(xs, prefix), join(if (ox) relPtr(xs) else "", if (os) relPtr(sep) else "")))), pct(prefix, "v"), true)
-
-def kitJoinCstr(sep: String, prefix: String): String =
-  line(Str.concat(tmp(prefix, "sep"), Str.concat("call ptr @sz_string_cstr(ptr ", Str.concat(sep, ")"))))
+  Slot(join(code, join(kitJoinCall(xs, sep, prefix), join(if (ox) relPtr(xs) else "", if (os) relPtr(sep) else ""))), pct(prefix, "v"), true)
 
-def kitJoinCall(xs: String, prefix: String): String =
-  line(Str.concat(tmp(prefix, "v"), Str.concat("call ptr @sz_list_join(ptr ", Str.concat(xs, Str.concat(", ptr ", Str.concat(pct(prefix, "sep"), ")"))))))
+def kitJoinCall(xs: String, sep: String, prefix: String): String =
+  line(Str.concat(tmp(prefix, "v"), Str.concat("call ptr @sz_list_join(ptr ", Str.concat(xs, Str.concat(", ptr ", Str.concat(sep, ")"))))))
 
 def emitMapEmpty(code: String, prefix: String): Slot =
   Slot(join(code, line(Str.concat(tmp(prefix, "v"), "call ptr @sz_map_empty()"))), pct(prefix, "v"), true)
@@ -2932,7 +2956,7 @@ def packCons(prefix: String, i: Int, n: Int, hd: String, tl: String): String =
 def packDrop(v: String, o: Bool, num: Bool, prefix: String, i: Int): String =
   if (num) relPtr(pct(prefix, Str.concat("bx", Str.fromInt(i)))) else if (o) relPtr(v) else ""
 
-def emitListHead(code: String, vals: List[String], owns: List[Bool], prefix: String, args: List[Expr], ps: List[Param]): Slot =
+def emitListHead(code: String, vals: List[String], owns: List[Bool], prefix: String): Slot =
   emitListHeadPtr(code, arg0(vals), headOwn(owns), prefix)
 
 def headUnbox(args: List[Expr], ps: List[Param]): Bool =
@@ -2957,12 +2981,6 @@ def headIsInt(xs: List[Expr]): Bool =
     case _ => false
   }
 
-def emitListHead2(code: String, v: String, o: Bool, prefix: String, unbox: Bool): Slot =
-  if (unbox) emitListHeadInt(code, v, o, prefix) else emitListHeadPtr(code, v, o, prefix)
-
-def emitListHeadInt(code: String, v: String, o: Bool, prefix: String): Slot =
-  Slot(join(code, join(line(Str.concat(tmp(prefix, "v"), Str.concat("call ptr @sz_list_head(ptr ", Str.concat(v, ")")))), join(takePtr(v, o, prefix), join(line(Str.concat(tmp(prefix, "u"), Str.concat("call i64 @sz_unbox_i64(ptr ", Str.concat(pct(prefix, "v"), ")")))), if (o) relPtr(pct(prefix, "v")) else "")))), pct(prefix, "u"), false)
-
 def emitListHeadPtr(code: String, v: String, o: Bool, prefix: String): Slot =
   Slot(join(code, join(line(Str.concat(tmp(prefix, "v"), Str.concat("call ptr @sz_list_head_opt(ptr ", Str.concat(v, ")")))), if (o) relPtr(v) else "")), pct(prefix, "v"), true)
 
@@ -3299,7 +3317,7 @@ def skipCallScan(v: String): Bool =
   Str.len(v) == 0 || Str.charAt(v, 0) != 37 || isIntSsa(v) || isI64Lit(v)
 
 def hasSubTail(s: String, sub: String): Bool =
-  hasSubAt(s, sub, if (Str.len(s) > 4096) Str.len(s) - 4096 else 0)
+  hasSub(s, sub)
 
 def isIoSlot(v: String): Bool =
   hasSub(v, "_io") || hasSub(v, "_fm")
@@ -3366,11 +3384,8 @@ def emitIfPhi2(tv: String, ev: String, prefix: String, ty: String): String =
 def emitIfPhi3(prefix: String): String =
   Str.concat(", %", Str.concat(prefix, "_ej_0 ]"))
 
-def emitField(recv: Expr, name: String, prefix: String, ens: List[En], ps: List[Param]): Slot =
-  if (isTupField(name)) emitTupField(recv, name, prefix, ps) else emitFieldEn(recv, name, prefix, ens, ps)
-
-def isTupField(name: String): Bool =
-  name == "_1" || name == "_2" || name == "_3" || name == "_4"
+def emitField(recv: Expr, name: String, prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
+  if (isTupField(name)) emitTupField(recv, name, prefix, strs, defs, ens, ps, loc) else emitFieldEn(recv, name, prefix, ens, ps)
 
 def emitFieldEn(recv: Expr, name: String, prefix: String, ens: List[En], ps: List[Param]): Slot =
   recv match {
@@ -3396,10 +3411,17 @@ def emitRecFieldIdx2(pl: String, prefix: String, k: Int, unbox: Bool, n: Int): S
 def emitRecFieldMaybeUnbox(code: String, v: String, prefix: String, unbox: Bool): Slot =
   if (unbox) Slot(join(code, line(Str.concat(tmp(prefix, "ru"), Str.concat("call i64 @sz_unbox_i64(ptr ", Str.concat(v, ")"))))), pct(prefix, "ru"), false) else Slot(code, v, false)
 
-def emitTupField(recv: Expr, name: String, prefix: String, ps: List[Param]): Slot =
+def emitTupField(recv: Expr, name: String, prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String): Slot =
   recv match {
     case Expr.EVar(s, _) => emitTupSel(Str.concat("%", s), tupSlots(paramTy(ps, s)), tupIdx(name), prefix, 0)
-    case _ => Slot("", "0", false)
+    case Expr.EAscribe(inner, _, _) => emitTupField(inner, name, prefix, strs, defs, ens, ps, loc)
+    case Expr.ENamed(_, inner) => emitTupField(inner, name, prefix, strs, defs, ens, ps, loc)
+    case _ => emitTupFrom(emitExpr(recv, Str.concat(prefix, "_tf"), strs, defs, ens, ps, loc), name, prefix, recv, defs, ps)
+  }
+
+def emitTupFrom(s: Slot, name: String, prefix: String, recv: Expr, defs: List[Fun], ps: List[Param]): Slot =
+  s match {
+    case Slot(code, v, _) => emitTupSelJoin2(code, emitTupSel(v, tupSlots(exprRetTy(recv, defs, ps)), tupIdx(name), prefix, 0))
   }
 
 def emitTupSel(scrut: String, tys: List[String], k: Int, prefix: String, i: Int): Slot =
@@ -3644,7 +3666,7 @@ def emitCtorOrQual(en: String, name: String, args: List[Expr], prefix: String, s
   if (isEmitKit(Str.concat(en, Str.concat(".", name)))) emitCall(Str.concat(en, Str.concat(".", name)), args, prefix, strs, defs, ens, ps, loc) else if (hasEn(ens, en)) emitPayloadCtor(en, name, args, prefix, strs, defs, ens, ps, loc) else emitQual(en, name, args, prefix, strs, defs, ens, ps, loc)
 
 def isEmitKit(f: String): Bool =
-  isUiKit(f) || f == "List.setAt" || f == "List.join" || kitUnaryPtr(f) != "" || kitUnaryI64(f) != "" || kitPtrI64(f) != "" || kitBinaryPtr(f) != "" || kitBinaryI64(f) != "" || isJsonExtra(f) || isRtExtra(f) || isMapKit(f) || f == "Map.empty" || f == "Set.empty" || f == "List.empty" || f == "Str.replace" || f == "Str.padLeft" || f == "Str.padRight" || f == "Map.set" || f == "Set.add" || f == "Map.getOrElse" || f == "Clock.monotonic" || f == "Clock.realTime" || f == "Fs.mkdirs" || f == "Fs.canonicalize" || f == "Fs.exists" || f == "Fs.walk" || f == "Fs.delete" || f == "List.len" || f == "List.concat" || f == "List.reverse" || f == "List.head" || f == "List.tail" || f == "List.isEmpty" || f == "List.cons" || f == "List.at" || f == "Str.fromInt" || f == "Str.concat" || f == "Str.len" || f == "Str.byteLen" || f == "Str.byteSlice" || f == "Fs.read" || f == "Fs.write" || f == "Fs.list" || f == "IO.pure" || f == "Sys.getenv" || f == "Impurity.runKit" || f == "Net.serveOnce" || f == "Net.serve" || isNetEmit(f) || f == "Queue.unbounded" || f == "Deferred.empty" || f == "Float.toInt" || f == "Float.fromInt" || f == "Map.isEmpty" || f == "Set.isEmpty" || f == "Map.nonEmpty" || f == "Set.nonEmpty" || f == "List.range" || f == "List.fill" || f == "List.getOrElse" || f == "List.padTo" || f == "List.max" || f == "List.min" || f == "List.sort" || f == "List.toSet" || f == "List.slice" || f == "List.isDefinedAt" || f == "List.lengthCompare" || f == "List.tabulate" || f == "List.segmentLength" || isTlKit(f) || f == "Oracle.sumTo" || f == "Fs.rename" || f == "Random.nextInt"
+  isUiKit(f) || f == "List.setAt" || f == "List.join" || kitUnaryPtr(f) != "" || kitUnaryI64(f) != "" || kitPtrI64(f) != "" || kitBinaryPtr(f) != "" || kitBinaryI64(f) != "" || isJsonExtra(f) || isRtExtra(f) || isMapKit(f) || f == "Map.empty" || f == "Set.empty" || f == "List.empty" || f == "Str.replace" || f == "Str.padLeft" || f == "Str.padRight" || f == "Map.set" || f == "Set.add" || f == "Map.getOrElse" || f == "Clock.monotonic" || f == "Clock.realTime" || f == "Fs.mkdirs" || f == "Fs.canonicalize" || f == "Fs.exists" || f == "Fs.walk" || f == "Fs.delete" || f == "List.len" || f == "List.concat" || f == "List.reverse" || f == "List.head" || f == "List.tail" || f == "List.isEmpty" || f == "List.cons" || f == "List.at" || f == "Str.fromInt" || f == "Str.fromBool" || f == "Str.concat" || f == "Str.len" || f == "Str.byteLen" || f == "Str.byteSlice" || f == "Fs.read" || f == "Fs.write" || f == "Fs.list" || f == "IO.pure" || f == "Sys.getenv" || f == "Impurity.runKit" || f == "Net.serveOnce" || f == "Net.serve" || isNetEmit(f) || f == "Queue.unbounded" || f == "Deferred.empty" || f == "Float.toInt" || f == "Float.fromInt" || f == "Map.isEmpty" || f == "Set.isEmpty" || f == "Map.nonEmpty" || f == "Set.nonEmpty" || f == "List.range" || f == "List.fill" || f == "List.getOrElse" || f == "List.padTo" || f == "List.max" || f == "List.min" || f == "List.sort" || f == "List.toSet" || f == "List.slice" || f == "List.isDefinedAt" || f == "List.lengthCompare" || f == "List.tabulate" || f == "List.segmentLength" || isTlKit(f) || f == "Oracle.sumTo" || f == "Fs.rename" || f == "Random.nextInt"
 
 def isNetEmit(f: String): Bool =
   f == "Net.httpPost" || f == "Net.httpPut" || f == "Net.httpPatch" || f == "Net.tcpConnect" || f == "Net.tcpListen" || f == "Net.tcpAccept" || f == "Net.tcpRead" || f == "Net.tcpWrite" || f == "Net.tcpClose" || f == "Net.udpBind" || f == "Net.udpSend" || f == "Net.udpRecv" || f == "Net.udpClose"
@@ -4406,12 +4428,13 @@ def rewriteBind1(e: Expr, from: String, to: String): Expr =
     case Expr.EField(recv, name, _) => Expr.EField(rewriteBind(recv, from, to), name, 0)
     case Expr.EBin(op, l, r, _) => Expr.EBin(op, rewriteBind(l, from, to), rewriteBind(r, from, to), 0)
     case Expr.EUn(op, inner, _) => Expr.EUn(op, rewriteBind(inner, from, to), 0)
-    case Expr.ELam(p, body) => Expr.ELam(p, rewriteBind(body, from, to))
+    case Expr.ELam(p, ty, body) => Expr.ELam(p, ty, rewriteBind(body, from, to))
     case Expr.EIf(c, t, el, _) => Expr.EIf(rewriteBind(c, from, to), rewriteBind(t, from, to), rewriteBind(el, from, to), 0)
     case Expr.EMatch(s, arms, _) => Expr.EMatch(rewriteBind(s, from, to), rewriteBindArms(arms, from, to), 0)
     case Expr.EList(xs) => Expr.EList(rewriteBindList(xs, from, to))
     case Expr.ETuple(xs) => Expr.ETuple(rewriteBindList(xs, from, to))
     case Expr.ENamed(n, inner) => Expr.ENamed(n, rewriteBind(inner, from, to))
+    case Expr.EAscribe(inner, ty, off) => Expr.EAscribe(rewriteBind(inner, from, to), ty, off)
     case Expr.EFor(bs, body, _) => Expr.EFor(rewriteBindBinds(bs, from, to), rewriteBind(body, from, to), 0)
     case Expr.EInt(n, _) => Expr.EInt(n, 0)
     case Expr.EBool(b) => Expr.EBool(b)
@@ -4607,6 +4630,9 @@ def fromIntUnbox(v: String, ps: List[Param]): Bool =
 def emitFromIntI64(code: String, v: String, prefix: String): Slot =
   Slot(join(code, line(Str.concat(tmp(prefix, "v"), Str.concat("call ptr @sz_string_from_int(i64 ", Str.concat(v, ")"))))), pct(prefix, "v"), true)
 
+def emitFromBool(code: String, vals: List[String], prefix: String): Slot =
+  Slot(join(code, line(Str.concat(tmp(prefix, "v"), Str.concat("call ptr @sz_string_from_bool(i64 ", Str.concat(if (List.isEmpty(vals)) "0" else List.at(vals, 0), ")"))))), pct(prefix, "v"), true)
+
 def emitFromIntUnbox(code: String, v: String, prefix: String): Slot =
   emitFromIntUnbox2(join(code, join(unboxLine(v, prefix), fromIntLine(prefix))), prefix)
 
@@ -4932,12 +4958,13 @@ def rwFields(e: Expr, env: List[(String, String)], funs: List[Fun], ens: List[En
     case Expr.EField(recv, name, _) => rwField(rwFields(recv, env, funs, ens, mod), name, env, funs, ens)
     case Expr.EBin(op, l, r, _) => Expr.EBin(op, rwFields(l, env, funs, ens, mod), rwFields(r, env, funs, ens, mod), 0)
     case Expr.EUn(op, inner, _) => Expr.EUn(op, rwFields(inner, env, funs, ens, mod), 0)
-    case Expr.ELam(p, body) => Expr.ELam(p, rwFields(body, env, funs, ens, mod))
+    case Expr.ELam(p, ty, body) => Expr.ELam(p, ty, rwFields(body, env, funs, ens, mod))
     case Expr.EIf(c, t, el, _) => Expr.EIf(rwFields(c, env, funs, ens, mod), rwFields(t, env, funs, ens, mod), rwFields(el, env, funs, ens, mod), 0)
     case Expr.EMatch(s, arms, _) => Expr.EMatch(rwFields(s, env, funs, ens, mod), rwFieldArms(arms, env, funs, ens, mod), 0)
     case Expr.EList(xs) => Expr.EList(rwFieldList(xs, env, funs, ens, mod))
     case Expr.ETuple(xs) => Expr.ETuple(rwFieldList(xs, env, funs, ens, mod))
     case Expr.ENamed(n, inner) => Expr.ENamed(n, rwFields(inner, env, funs, ens, mod))
+    case Expr.EAscribe(inner, ty, off) => Expr.EAscribe(rwFields(inner, env, funs, ens, mod), ty, off)
     case Expr.EFor(bs, body, _) => Expr.EFor(rwForBinds(bs, env, funs, ens, mod), rwFields(body, env, funs, ens, mod), 0)
     case _ => e
   }
@@ -5019,9 +5046,6 @@ def tupField(recv: Expr, name: String, ty: String): Expr =
 def tupField2(recv: Expr, idx: Int, ns: List[String]): Expr =
   if (List.isEmpty(ns)) Expr.EMatch(recv, Arm(if (idx == 0) "(__f0, _)" else "(_, __f1)", "", Expr.EVar(if (idx == 0) "__f0" else "__f1", 0)) :: noArm(), 0) else Expr.EMatch(recv, Arm(Str.concat("(", Str.concat(bindsSelect(0, List.len(ns), idx), ")")), "", Expr.EVar(fakeBind(idx), 0)) :: noArm(), 0)
 
-def tupIdx(name: String): Int =
-  if (name == "_1") 0 else if (name == "_2") 1 else if (name == "_3") 2 else if (name == "_4") 3 else 1
-
 def recField(recv: Expr, name: String, ns: List[String], ty: String, ens: List[En]): Expr =
   if (List.isEmpty(ns)) Expr.EField(recv, name, 0) else recFieldGo(recv, name, ns, ty, ens)
 
@@ -5248,12 +5272,13 @@ def internSigExpr(e: Expr, acc: List[String]): List[String] =
     case Expr.EPrint(inner, _) => internSigExpr(inner, acc)
     case Expr.EBin(_, l, r, _) => internSigExpr(r, internSigExpr(l, acc))
     case Expr.EUn(_, inner, _) => internSigExpr(inner, acc)
-    case Expr.ELam(_, body) => internSigExpr(body, acc)
+    case Expr.ELam(_, _, body) => internSigExpr(body, acc)
     case Expr.EIf(c, t, el, _) => internSigExpr(el, internSigExpr(t, internSigExpr(c, acc)))
     case Expr.EMatch(s, arms, _) => internSigArms(arms, internSigExpr(s, acc))
     case Expr.EList(xs) => internSigList(xs, acc)
     case Expr.ETuple(xs) => internSigList(xs, acc)
     case Expr.ENamed(_, inner) => internSigExpr(inner, acc)
+    case Expr.EAscribe(inner, _, _) => internSigExpr(inner, acc)
     case _ => acc
   }
 
@@ -5709,12 +5734,13 @@ def fmCount(e: Expr): Int =
   e match {
     case Expr.EMethod(recv, name, args, _) => fmCountMeth(recv, name, args)
     case Expr.EPrint(inner, _) => fmCount(inner)
-    case Expr.ELam(_, body) => fmCount(body)
+    case Expr.ELam(_, _, body) => fmCount(body)
     case Expr.ECall(_, args, _) => fmCountSkipLam(args)
     case Expr.EBin(_, l, r, _) => fmCount(l) + fmCount(r)
     case Expr.EUn(_, inner, _) => fmCount(inner)
     case Expr.EIf(c, t, el, _) => fmCount(c) + fmCount(t) + fmCount(el)
     case Expr.ENamed(_, inner) => fmCount(inner)
+    case Expr.EAscribe(inner, _, _) => fmCount(inner)
     case Expr.EMatch(s, arms, _) => fmCount(s) + fmCountArms(arms)
     case Expr.EList(xs) => fmCountArgs(xs)
     case Expr.ETuple(xs) => fmCountArgs(xs)
@@ -5736,7 +5762,7 @@ def fmCountSkipLam(xs: List[Expr]): Int =
 
 def fmCountSkipLam1(e: Expr): Int =
   e match {
-    case Expr.ELam(_, _) => 0
+    case Expr.ELam(_, _, _) => 0
     case _ => fmCount(e)
   }
 
@@ -5776,19 +5802,25 @@ def fmCountArgsHit(xs: List[Expr]): Int =
 def emitIoMap(recv: Expr, args: List[Expr], prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String, fid: Int): Slot =
   recv match {
     case Expr.EVar(_, _) => emitCtorCall(recv, "map", args, prefix, strs, defs, ens, ps, loc)
-    case _ => emitFmRt("sz_io_flatmap", recv, wrapIoMapArgs(args), prefix, strs, defs, ens, ps, loc, fid)
+    case _ => emitFmRt("sz_io_flatmap", recv, wrapIoMapArgs(args, ps, defs, modOfLoc(loc)), prefix, strs, defs, ens, ps, loc, fid)
   }
 
-def wrapIoMapArgs(args: List[Expr]): List[Expr] =
-  if (List.isEmpty(args)) args else wrapIoMapLam(List.at(args, 0)) :: List.tail(args)
+def wrapIoMapArgs(args: List[Expr], ps: List[Param], defs: List[Fun], mod: String): List[Expr] =
+  if (List.isEmpty(args)) args else wrapIoMapLam(List.at(args, 0), ps, defs, mod) :: List.tail(args)
+
+def wrapIoMapLam(e: Expr, ps: List[Param], defs: List[Fun], mod: String): Expr =
+  wrapIoMapLam1(wrapPh(e, ps, defs, mod))
 
-def wrapIoMapLam(e: Expr): Expr =
+def wrapIoMapLam1(e: Expr): Expr =
   e match {
-    case Expr.ELam(p, body) => Expr.ELam(p, Expr.ECall("IO.pure", body :: noExpr(), 0))
-    case Expr.EMatch(s, arms, _) => Expr.ELam("__p", Expr.ECall("IO.pure", Expr.EMatch(s, arms, 0) :: noExpr(), 0))
-    case _ => Expr.ECall("IO.pure", e :: noExpr(), 0)
+    case Expr.ELam(p, ty, body) => Expr.ELam(p, ty, Expr.ECall("IO.pure", body :: noExpr(), 0))
+    case Expr.EMatch(s, arms, _) => Expr.ELam("__p", "", Expr.ECall("IO.pure", Expr.EMatch(s, arms, 0) :: noExpr(), 0))
+    case _ => Expr.ELam("_ph", "", Expr.ECall("IO.pure", e :: noExpr(), 0))
   }
 
+def wrapIoMapCont(args: List[Expr]): List[Expr] =
+  if (List.isEmpty(args)) args else wrapIoMapLam1(List.at(args, 0)) :: List.tail(args)
+
 def emitFmRt(rt: String, recv: Expr, args: List[Expr], prefix: String, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String, fid: Int): Slot =
   emitFmCounted(rt, recv, args, prefix, strs, defs, ens, ps, loc, fid, fmCount(recv) + fmCountArgs(args))
 
@@ -5889,7 +5921,7 @@ def nameUnBool(e: Expr, n: String): Bool =
     case Expr.EIf(c, t, el, _) => nameUnBool(c, n) || nameUnBool(t, n) || nameUnBool(el, n)
     case Expr.ECall(_, args, _) => nameUnBoolList(args, n)
     case Expr.EMethod(r, _, args, _) => nameUnBool(r, n) || nameUnBoolList(args, n)
-    case Expr.ELam(p, body) => if (p == n) false else nameUnBool(body, n)
+    case Expr.ELam(p, _, body) => if (p == n) false else nameUnBool(body, n)
     case _ => false
   }
 
@@ -5987,10 +6019,11 @@ def emitContsAt(e: Expr, strs: List[String], defs: List[Fun], ens: List[En], ps:
   e match {
     case Expr.EMethod(recv, name, args, _) => if (isFmName(name)) emitContsFm(recv, args, strs, defs, ens, ps, loc, id) else if (name == "map") emitContsMap(recv, args, strs, defs, ens, ps, loc, id) else if (name == "apply") emitContsApply(recv, args, strs, defs, ens, ps, loc, id) else emitContsCtor(recv, args, strs, defs, ens, ps, loc, id)
     case Expr.EPrint(inner, _) => emitContsAtGo(inner, strs, defs, ens, ps, loc, id)
-    case Expr.ELam(_, _) => ("", id)
+    case Expr.ELam(_, _, _) => ("", id)
     case Expr.ECall(_, args, _) => emitContsArgs(args, strs, defs, ens, ps, loc, id)
     case Expr.EIf(c, t, el, _) => emitContsIf(c, t, el, strs, defs, ens, ps, loc, id)
     case Expr.ENamed(_, inner) => emitContsAtGo(inner, strs, defs, ens, ps, loc, id)
+    case Expr.EAscribe(inner, _, _) => emitContsAtGo(inner, strs, defs, ens, ps, loc, id)
     case Expr.EBin(_, l, r, _) => emitContsIf(l, r, Expr.EUnit, strs, defs, ens, ps, loc, id)
     case Expr.EUn(_, inner, _) => emitContsAtGo(inner, strs, defs, ens, ps, loc, id)
     case Expr.EField(recv, _, _) => emitContsAtGo(recv, strs, defs, ens, ps, loc, id)
@@ -6006,7 +6039,7 @@ def emitContsAtGo(e: Expr, strs: List[String], defs: List[Fun], ens: List[En], p
 
 def emitContsApply(recv: Expr, args: List[Expr], strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String, id: Int): (String, Int) =
   recv match {
-    case Expr.ELam(p, body) => emitContsApplyLam(p, body, args, strs, defs, ens, ps, loc, id)
+    case Expr.ELam(p, _, body) => emitContsApplyLam(p, body, args, strs, defs, ens, ps, loc, id)
     case _ => emitContsCtor(recv, args, strs, defs, ens, ps, loc, id)
   }
 
@@ -6048,7 +6081,7 @@ def emitContsArmList2(p: (String, Int), rest: List[Arm], strs: List[String], def
 def emitContsMap(recv: Expr, args: List[Expr], strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String, id: Int): (String, Int) =
   recv match {
     case Expr.EVar(_, _) => emitContsCtor(recv, args, strs, defs, ens, ps, loc, id)
-    case _ => emitContsFm(recv, wrapIoMapArgs(args), strs, defs, ens, ps, loc, id)
+    case _ => emitContsFm(recv, wrapIoMapCont(args), strs, defs, ens, ps, loc, id)
   }
 
 def emitContsFm(recv: Expr, args: List[Expr], strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String, id: Int): (String, Int) =
@@ -6079,7 +6112,8 @@ def recvBindTyPure(args: List[Expr], ens: List[En], defs: List[Fun], ps: List[Pa
 def recvBindTyPure1(e: Expr, ens: List[En], defs: List[Fun], ps: List[Param]): String =
   e match {
     case Expr.ENamed(_, inner) => recvBindTyPure1(inner, ens, defs, ps)
-    case Expr.ELam(_, _) => "Any"
+    case Expr.EAscribe(inner, _, _) => recvBindTyPure1(inner, ens, defs, ps)
+    case Expr.ELam(_, _, _) => "Any"
     case Expr.ECall(f, _, _) => recvBindTyNamed(recvCallTy(f, ens, defs), e, ps, defs)
     case Expr.EMethod(r, name, _, _) => recvBindTyPureMeth(r, name, e, ens, defs, ps)
     case Expr.EVar(s, _) => if (paramIsI64(ps, s)) "Int" else recvBindTyNamed(ctorHead(s, ens), e, ps, defs)
@@ -6127,7 +6161,7 @@ def emitContsFm2(p: (String, Int), lam: Expr, strs: List[String], defs: List[Fun
 
 def emitContsFm3(code: String, id: Int, lam: Expr, strs: List[String], defs: List[Fun], ens: List[En], ps: List[Param], loc: String, bty: String): (String, Int) =
   lam match {
-    case Expr.ELam(p, body) => emitContsFm3Body(code, id, p, body, strs, defs, ens, ps, loc, bty)
+    case Expr.ELam(p, _, body) => emitContsFm3Body(code, id, p, body, strs, defs, ens, ps, loc, bty)
     case _ => (code, id)
   }
 
@@ -6273,7 +6307,7 @@ def declsR(): String =
   join(decl("ptr @sz_string_lines(ptr)"), join(decl("ptr @sz_string_trim(ptr)"), join(decl("ptr @sz_string_to_lower(ptr)"), join(decl("ptr @sz_string_to_upper(ptr)"), join(decl("ptr @sz_string_capitalize(ptr)"), join(decl("ptr @sz_string_ureverse(ptr)"), join(decl("i64 @sz_string_is_empty(ptr)"), join(decl("i64 @sz_string_non_empty(ptr)"), join(decl("i64 @sz_string_is_blank(ptr)"), join(decl("ptr @sz_string_split(ptr, ptr)"), join(decl("ptr @sz_string_strip_prefix(ptr, ptr)"), join(decl("ptr @sz_string_strip_suffix(ptr, ptr)"), join(decl("i64 @sz_string_ends_with(ptr, ptr)"), join(decl("i64 @sz_string_uindex_of(ptr, ptr)"), join(decl("i64 @sz_string_ulast_index_of(ptr, ptr)"), join(decl("ptr @sz_string_replace(ptr, ptr, ptr)"), join(decl("ptr @sz_string_pad_left(ptr, i64, ptr)"), decl("ptr @sz_string_pad_right(ptr, i64, ptr)"))))))))))))))))))
 
 def declsS(): String =
-  join(decl("ptr @sz_map_union(ptr, ptr)"), join(decl("ptr @sz_map_intersect(ptr, ptr)"), join(decl("ptr @sz_map_diff(ptr, ptr)"), join(decl("ptr @sz_list_set_at(ptr, i64, ptr)"), join(decl("i64 @sz_list_starts_with(ptr, ptr)"), join(decl("i64 @sz_list_ends_with(ptr, ptr)"), join(decl("i64 @sz_list_same_elements(ptr, ptr)"), join(decl("ptr @sz_list_patch(ptr, i64, ptr, i64)"), join(decl("ptr @sz_json_stringify(ptr)"), join(decl("ptr @sz_fs_exists(ptr)"), join(decl("ptr @sz_fs_delete(ptr)"), join(decl("ptr @sz_fs_rename(ptr, ptr)"), join(decl("ptr @sz_fs_walk(ptr)"), join(decl("ptr @sz_fs_join(ptr, ptr)"), join(decl("ptr @sz_fs_dirname(ptr)"), join(decl("ptr @sz_fs_basename(ptr)"), join(decl("i64 @sz_oracle_sum_to(i64)"), decl("ptr @sz_string_from_float(double)"))))))))))))))))))
+  join(decl("ptr @sz_map_union(ptr, ptr)"), join(decl("ptr @sz_map_intersect(ptr, ptr)"), join(decl("ptr @sz_map_diff(ptr, ptr)"), join(decl("ptr @sz_list_set_at(ptr, i64, ptr)"), join(decl("i64 @sz_list_starts_with(ptr, ptr)"), join(decl("i64 @sz_list_ends_with(ptr, ptr)"), join(decl("i64 @sz_list_same_elements(ptr, ptr)"), join(decl("ptr @sz_list_patch(ptr, i64, ptr, i64)"), join(decl("ptr @sz_json_stringify(ptr)"), join(decl("i64 @sz_json_is_bool(ptr)"), join(decl("i64 @sz_json_is_int(ptr)"), join(decl("i64 @sz_json_is_str(ptr)"), join(decl("i64 @sz_json_is_float(ptr)"), join(decl("i64 @sz_json_bool_or(ptr, i64)"), join(decl("ptr @sz_json_str_or(ptr, ptr)"), join(decl("double @sz_json_get_float(ptr, ptr, double)"), join(decl("ptr @sz_fs_exists(ptr)"), join(decl("ptr @sz_fs_delete(ptr)"), join(decl("ptr @sz_fs_rename(ptr, ptr)"), join(decl("ptr @sz_fs_walk(ptr)"), join(decl("ptr @sz_fs_join(ptr, ptr)"), join(decl("ptr @sz_fs_dirname(ptr)"), join(decl("ptr @sz_fs_basename(ptr)"), join(decl("i64 @sz_oracle_sum_to(i64)"), decl("ptr @sz_string_from_float(double)")))))))))))))))))))))))))
 
 def declsT(): String =
   join(declsT1(), join(declsT2(), join(declsT3(), join(declsT4(), join(declsT5(), declsT6())))))
@@ -6315,7 +6349,7 @@ def declsX(): String =
   join(decl("ptr @sz_net_http_post(ptr, ptr)"), join(decl("ptr @sz_net_http_put(ptr, ptr)"), join(decl("ptr @sz_net_http_patch(ptr, ptr)"), join(decl("ptr @sz_net_http_delete(ptr)"), join(decl("ptr @sz_net_http_head(ptr)"), join(decl("ptr @sz_net_tcp_connect(ptr, i64)"), join(decl("ptr @sz_net_tcp_listen(i64)"), join(decl("ptr @sz_net_tcp_accept(ptr)"), join(decl("ptr @sz_net_tcp_read(ptr, i64)"), join(decl("ptr @sz_net_tcp_write(ptr, ptr)"), join(decl("ptr @sz_net_tcp_close(ptr)"), join(decl("ptr @sz_net_udp_bind(i64)"), join(decl("ptr @sz_net_udp_send(ptr, ptr, i64, ptr)"), join(decl("ptr @sz_net_udp_recv(ptr, i64)"), decl("ptr @sz_net_udp_close(ptr)")))))))))))))))
 
 def declsA(): String =
-  join(decl("ptr @sz_string_from_cstr(ptr)"), join(decl("void @sz_retain(ptr)"), join(decl("void @sz_release(ptr)"), join(decl("ptr @sz_string_from_int(i64)"), join(decl("ptr @sz_string_concat(ptr, ptr)"), join(decl("ptr @sz_adt_new(i32, ptr)"), join(decl("i32 @sz_adt_tag(ptr)"), decl("ptr @sz_box_i64(i64)"))))))))
+  join(decl("ptr @sz_string_from_cstr(ptr)"), join(decl("void @sz_retain(ptr)"), join(decl("void @sz_release(ptr)"), join(decl("ptr @sz_string_from_int(i64)"), join(decl("ptr @sz_string_from_bool(i64)"), join(decl("ptr @sz_string_concat(ptr, ptr)"), join(decl("ptr @sz_adt_new(i32, ptr)"), join(decl("i32 @sz_adt_tag(ptr)"), decl("ptr @sz_box_i64(i64)")))))))))
 
 def declsB(): String =
   join(decl("ptr @sz_list_nil()"), join(decl("ptr @sz_list_cons(ptr, ptr)"), join(decl("i64 @sz_list_len(ptr)"), join(decl("ptr @sz_list_concat(ptr, ptr)"), join(decl("ptr @sz_list_reverse(ptr)"), join(decl("ptr @sz_io_println(ptr)"), join(decl("ptr @sz_io_flatmap(ptr, ptr, ptr)"), decl("i32 @sz_runtime_main_args(ptr, i32, ptr)"))))))))
@@ -6348,7 +6382,7 @@ def declsJ(): String =
   join(decl("ptr @sz_io_both(ptr, ptr)"), join(decl("ptr @sz_io_race(ptr, ptr)"), join(decl("ptr @sz_io_ensure(ptr, ptr)"), join(decl("ptr @sz_io_sleep_ms(i64)"), join(decl("ptr @sz_io_fail(ptr)"), join(decl("ptr @sz_io_timeout(i64, ptr)"), join(decl("ptr @sz_io_when(i64, ptr)"), join(decl("ptr @sz_io_unless(i64, ptr)"), join(decl("ptr @sz_io_repeat_n(i64, ptr)"), join(decl("ptr @sz_io_retry_n(i64, ptr)"), join(decl("ptr @sz_io_forever(ptr)"), join(decl("ptr @sz_io_handle_error_with(ptr, ptr, ptr)"), join(decl("ptr @sz_error_new(i32, ptr)"), decl("void @sz_property_sometimes(ptr)"))))))))))))))
 
 def declsK(): String =
-  join(decl("ptr @sz_net_http_get(ptr)"), join(decl("ptr @sz_net_serve_once(i64, ptr, ptr)"), join(decl("ptr @sz_net_serve(i64, ptr, ptr)"), join(decl("ptr @sz_ref_of(ptr)"), join(decl("ptr @sz_ref_get(ptr)"), join(decl("ptr @sz_ref_set(ptr, ptr)"), join(decl("ptr @sz_queue_unbounded()"), join(decl("ptr @sz_queue_offer(ptr, ptr)"), join(decl("ptr @sz_queue_take(ptr)"), join(decl("ptr @sz_deferred_empty()"), join(decl("ptr @sz_deferred_complete(ptr, ptr)"), join(decl("ptr @sz_deferred_get(ptr)"), join(decl("ptr @sz_fiber_fork(ptr)"), join(decl("ptr @sz_fiber_join(ptr)"), decl("ptr @sz_fiber_interrupt(ptr)")))))))))))))))
+  join(decl("ptr @sz_net_http_get(ptr)"), join(decl("ptr @sz_net_serve_once(i64, ptr, ptr)"), join(decl("ptr @sz_net_serve(i64, ptr, ptr)"), join(decl("ptr @sz_ref_of(ptr)"), join(decl("ptr @sz_ref_get(ptr)"), join(decl("ptr @sz_ref_set(ptr, ptr)"), join(decl("ptr @sz_queue_unbounded()"), join(decl("ptr @sz_queue_offer(ptr, ptr)"), join(decl("ptr @sz_queue_take(ptr)"), join(decl("ptr @sz_deferred_empty()"), join(decl("ptr @sz_deferred_complete(ptr, ptr)"), join(decl("ptr @sz_deferred_fail(ptr, ptr)"), join(decl("ptr @sz_deferred_get(ptr)"), join(decl("ptr @sz_fiber_fork(ptr)"), join(decl("ptr @sz_fiber_join(ptr)"), decl("ptr @sz_fiber_interrupt(ptr)"))))))))))))))))
 
 def declsL(): String =
   join(decl("ptr @sz_stream_emit(ptr)"), join(decl("ptr @sz_stream_emits(ptr)"), join(decl(Str.concat("ptr @sz_stream_e", "val(ptr)")), join(decl("ptr @sz_stream_concat(ptr, ptr)"), join(decl("ptr @sz_stream_take(ptr, i64)"), join(decl("ptr @sz_stream_drop(ptr, i64)"), join(decl("ptr @sz_stream_compile_to_list(ptr)"), join(decl("ptr @sz_stream_drain(ptr)"), join(decl("ptr @sz_stream_range(i64, i64)"), join(decl("ptr @sz_stream_repeat_n(ptr, i64)"), join(decl("ptr @sz_stream_zip(ptr, ptr)"), join(decl("ptr @sz_stream_interleave(ptr, ptr)"), join(decl("ptr @sz_list_interleave(ptr, ptr)"), join(decl("ptr @sz_stream_zip_with_index(ptr)"), join(decl("ptr @sz_stream_intersperse(ptr, ptr)"), join(decl("ptr @sz_stream_grouped(ptr, i64)"), join(decl("ptr @sz_stream_flatten(ptr)"), join(decl("ptr @sz_stream_head(ptr)"), join(decl("ptr @sz_stream_last(ptr)"), join(decl("ptr @sz_stream_count(ptr)"), join(decl("ptr @sz_stream_changes(ptr)"), join(decl("ptr @sz_stream_or_else(ptr, ptr)"), join(decl("ptr @sz_stream_take_right(ptr, i64)"), join(decl("ptr @sz_stream_drop_right(ptr, i64)"), decl("ptr @sz_stream_sliding(ptr, i64)")))))))))))))))))))))))))
diff --git a/examples/compiler/src/Lsp.scuzz b/examples/compiler/src/Lsp.scuzz
index bce90965..226e50d1 100644
--- a/examples/compiler/src/Lsp.scuzz
+++ b/examples/compiler/src/Lsp.scuzz
@@ -79,16 +79,49 @@ def newNameOf(j: Json): String =
   jStr(jGet(paramsOf(j), "newName"))
 
 def pathOfUri(uri: String): String =
+  pctDecode(stripFileUri(uri))
+
+def stripFileUri(uri: String): String =
   if (Str.startsWith(uri, "file://")) Str.drop(uri, 7) else uri
 
+def latin1(): String =
+  Str.concat(" !\"#$%&'()*+,-./0123456789:;<=>?@", Str.concat("ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`", "abcdefghijklmnopqrstuvwxyz{|}~"))
+
+def hexVal(c: Int): Int =
+  if (c >= 48 && c <= 57) c - 48 else if (c >= 97 && c <= 102) c - 87 else if (c >= 65 && c <= 70) c - 55 else 0 - 1
+
+def pctByte(n: Int): String =
+  if (n >= 32 && n <= 126) Str.slice(latin1(), n - 32, n - 31) else ""
+
+def pctDecode(s: String): String =
+  pctGo(s, 0, Builder.empty())
+
+def pctGo(s: String, i: Int, b: Builder): String =
+  if (i >= Str.len(s)) Builder.result(b) else if (Str.charAt(s, i) == 37 && i + 2 < Str.len(s)) pctHex(s, i, b, hexVal(Str.charAt(s, i + 1)), hexVal(Str.charAt(s, i + 2))) else pctGo(s, i + 1, Builder.append(b, Str.slice(s, i, i + 1)))
+
+def pctHex(s: String, i: Int, b: Builder, hi: Int, lo: Int): String =
+  if (hi < 0 || lo < 0) pctGo(s, i + 1, Builder.append(b, "%")) else pctPut(s, i, b, hi * 16 + lo)
+
+def pctPut(s: String, i: Int, b: Builder, n: Int): String =
+  pctPut2(s, i, b, pctByte(n))
+
+def pctPut2(s: String, i: Int, b: Builder, ch: String): String =
+  if (Str.isEmpty(ch)) pctGo(s, i + 3, Builder.append(b, Str.slice(s, i, i + 3))) else pctGo(s, i + 3, Builder.append(b, ch))
+
 def uriOfPath(path: String): String =
   Str.concat("file://", path)
 
 def offsetOf(src: String, line: Int, col: Int): Int =
   offsetGo(src, 0, 0, line, col)
 
+def lineEnd(src: String, i: Int): Int =
+  if (i >= Str.len(src)) i else if (Str.charAt(src, i) == 10) i else lineEnd(src, i + 1)
+
+def clampCol(col: Int, n: Int): Int =
+  if (col < 0) 0 else if (col > n) n else col
+
 def offsetGo(src: String, i: Int, ln: Int, want: Int, col: Int): Int =
-  if (ln == want) i + col else if (i >= Str.len(src)) Str.len(src) else if (Str.charAt(src, i) == 10) offsetGo(src, i + 1, ln + 1, want, col) else offsetGo(src, i + 1, ln, want, col)
+  if (ln == want) i + clampCol(col, lineEnd(src, i) - i) else if (i >= Str.len(src)) Str.len(src) else if (Str.charAt(src, i) == 10) offsetGo(src, i + 1, ln + 1, want, col) else offsetGo(src, i + 1, ln, want, col)
 
 def isIdentCh(c: Int): Bool =
   c >= 65 && c <= 90 || c >= 97 && c <= 122 || c >= 48 && c <= 57 || c == 95
@@ -160,7 +193,7 @@ def hoverJson(text: String): String =
   if (text == "") "null" else Str.concat("{\"contents\":{\"kind\":\"plaintext\",\"value\":", Str.concat(Check.jsonStr(text), "}}"))
 
 def completeNames(src: String): List[String] =
-  completeNames2(Parse.parse(Lexer.lex(src)).defs, "IO.println" :: "Str.concat" :: "List.len" :: "Sys.args" :: "Fs.read" :: [])
+  completeNames2(Parse.parse(Lexer.lex(src)).defs, Check.kitNames())
 
 def completeNames2(ds: List[Fun], acc: List[String]): List[String] =
   if (List.isEmpty(ds)) acc else completeNamesHd(List.at(ds, 0), List.tail(ds), acc)
@@ -192,10 +225,22 @@ def completeItem(name: String): String =
   Str.concat("{\"label\":", Str.concat(Check.jsonStr(name), "}"))
 
 def defJson(uri: String, src: String, line: Int, col: Int): String =
-  defJsonName(uri, src, identAt(src, offsetOf(src, line, col)))
+  defJsonName(uri, src, qualIdentAt(src, offsetOf(src, line, col)))
 
 def defJsonName(uri: String, src: String, name: String): String =
-  defJsonOff(uri, src, name, findFunOff(Parse.parse(Lexer.lex(src)).defs, name))
+  defJsonOff(uri, src, name, findFunOffNamed(Parse.parse(Lexer.lex(src)).defs, name))
+
+def findFunOffNamed(ds: List[Fun], name: String): Int =
+  findFunOffNamed2(ds, name, findFunOff(ds, name))
+
+def findFunOffNamed2(ds: List[Fun], name: String, off: Int): Int =
+  if (off >= 0) off else findFunOff(ds, identAfterDot(name))
+
+def identAfterDot(name: String): String =
+  identAfterDotAt(name, Str.lastIndexOf(name, "."))
+
+def identAfterDotAt(name: String, i: Int): String =
+  if (i < 0) name else Str.drop(name, i + 1)
 
 def defJsonOff(uri: String, src: String, name: String, off: Int): String =
   if (name == "" || off < 0) "null" else Str.concat("[{\"uri\":", Str.concat(Check.jsonStr(uri), Str.concat(",\"range\":", Str.concat(rangeOf(src, off), "}]"))))
@@ -228,11 +273,14 @@ def lineCount(src: String): Int =
 def lineCountGo(src: String, i: Int, n: Int): Int =
   if (i >= Str.len(src)) n else if (Str.charAt(src, i) == 10) lineCountGo(src, i + 1, n + 1) else lineCountGo(src, i + 1, n)
 
-def renameJson(src: String, line: Int, col: Int, nu: String): String =
-  renameJson2(src, identAt(src, offsetOf(src, line, col)), nu)
+def renameJson(uri: String, src: String, line: Int, col: Int, nu: String): String =
+  renameJson2(uri, src, identAt(src, offsetOf(src, line, col)), nu)
 
-def renameJson2(src: String, name: String, nu: String): String =
-  if (name == "" || nu == "") "null" else Str.concat("{\"changes\":{},\"newText\":", Str.concat(Check.jsonStr(renameIdents(src, name, nu)), "}"))
+def renameJson2(uri: String, src: String, name: String, nu: String): String =
+  if (name == "" || nu == "") "null" else Str.concat("{\"changes\":{", Str.concat(Check.jsonStr(uri), Str.concat(":", Str.concat(wholeEdit(src, renameIdents(src, name, nu)), "}"))))
+
+def wholeEdit(src: String, text: String): String =
+  Str.concat("[{\"range\":{\"start\":{\"line\":0,\"character\":0},\"end\":{\"line\":", Str.concat(Str.fromInt(lineCount(src)), Str.concat(",\"character\":0}},\"newText\":", Str.concat(Check.jsonStr(text), "}]"))))
 
 def renameIdents(src: String, name: String, nu: String): String =
   Builder.result(renameToks(Lexer.lex(src), src, name, nu, 0, Builder.empty()))
@@ -254,9 +302,6 @@ def renameTokKind(tok: Tok, rest: List[SpTok], src: String, name: String, nu: St
 def renameTokIdent(s: String, rest: List[SpTok], src: String, name: String, nu: String, prev: Int, off: Int, b: Builder): Builder =
   if (s == name) renameToks(rest, src, name, nu, off + Str.len(name), Builder.append(Builder.append(b, Str.slice(src, prev, off)), nu)) else renameToks(rest, src, name, nu, prev, b)
 
-def emptyArr(): String =
-  "[]"
-
 def tokensJson(src: String): String =
   Str.concat("{\"data\":[", Str.concat(tokensJoin(tokenInts(Lexer.lex(src), src, 0, 0, [])), "]}"))
 
@@ -304,7 +349,10 @@ def tokensJoinHd(n: Int, rest: List[Int], b: Builder): String =
   if (List.isEmpty(rest)) Builder.result(Builder.append(b, Str.fromInt(n))) else tokensJoinGo(rest, Builder.append(Builder.append(b, Str.fromInt(n)), ","))
 
 def caps(): String =
-  "{\"capabilities\":{\"textDocumentSync\":{\"openClose\":true,\"change\":1},\"hoverProvider\":true,\"completionProvider\":{\"triggerCharacters\":[\".\"]},\"definitionProvider\":true,\"declarationProvider\":true,\"documentSymbolProvider\":true,\"documentFormattingProvider\":true,\"renameProvider\":{\"prepareProvider\":true},\"foldingRangeProvider\":true,\"inlayHintProvider\":true,\"semanticTokensProvider\":{\"legend\":{\"tokenTypes\":[\"keyword\",\"function\",\"string\",\"number\"],\"tokenModifiers\":[]},\"full\":true,\"range\":true},\"codeActionProvider\":{\"codeActionKinds\":[\"quickfix\",\"source.formatDocument\"],\"resolveProvider\":true}}}"
+  "{\"capabilities\":{\"positionEncoding\":\"utf-8\",\"textDocumentSync\":{\"openClose\":true,\"change\":1},\"hoverProvider\":true,\"completionProvider\":true,\"definitionProvider\":true,\"documentFormattingProvider\":true,\"renameProvider\":true,\"semanticTokensProvider\":{\"legend\":{\"tokenTypes\":[\"keyword\",\"function\",\"string\",\"number\"],\"tokenModifiers\":[]},\"full\":true}}}"
+
+def errorMsg(id: String, code: Int, message: String): String =
+  Str.concat("{\"jsonrpc\":\"2.0\",\"id\":", Str.concat(id, Str.concat(",\"error\":{\"code\":", Str.concat(Str.fromInt(code), Str.concat(",\"message\":", Str.concat(Check.jsonStr(message), "}}"))))))
 
 def resultMsg(id: String, result: String): String =
   Str.concat("{\"jsonrpc\":\"2.0\",\"id\":", Str.concat(id, Str.concat(",\"result\":", Str.concat(result, "}"))))
@@ -334,7 +382,13 @@ def publishDiags(uri: String, raw: String): String =
   publishDiags2(uri, parseJson(raw))
 
 def publishDiags2(uri: String, j: Json): String =
-  notifyMsg("textDocument/publishDiagnostics", Str.concat("{\"uri\":", Str.concat(Check.jsonStr(uri), Str.concat(",\"diagnostics\":[", Str.concat(diagsArr(jArr(j)), "]}")))))
+  notifyMsg("textDocument/publishDiagnostics", Str.concat("{\"uri\":", Str.concat(Check.jsonStr(uri), Str.concat(",\"diagnostics\":[", Str.concat(diagsArr(diagsKeep(jArr(j), Fs.basename(pathOfUri(uri)))), "]}")))))
+
+def diagsKeep(xs: List[Json], file: String): List[Json] =
+  if (List.isEmpty(xs)) [] else diagsKeepHd(List.at(xs, 0), List.tail(xs), file)
+
+def diagsKeepHd(h: Json, rest: List[Json], file: String): List[Json] =
+  if (jStr(jGet(h, "file")) == file) h :: diagsKeep(rest, file) else diagsKeep(rest, file)
 
 def overlayGet(open: List[Open], path: String): String =
   if (List.isEmpty(open)) "" else overlayGetHd(List.at(open, 0), List.tail(open), path)
@@ -355,11 +409,24 @@ def overlayDropHd(h: Open, rest: List[Open], path: String): List[Open] =
     case Open(p, _) => if (p == path) overlayDrop(rest, path) else h :: overlayDrop(rest, path)
   }
 
-def srcOf(open: List[Open], path: String): IO[String] =
-  srcOf2(path, overlayGet(open, path))
+def overlayHas(open: List[Open], path: String): Bool =
+  if (List.isEmpty(open)) false else overlayHasHd(List.at(open, 0), List.tail(open), path)
 
-def srcOf2(path: String, hit: String): IO[String] =
-  if (Str.nonEmpty(hit)) IO.pure(hit) else Fs.read(path).handleErrorWith(_ => IO.pure(""))
+def overlayHasHd(h: Open, rest: List[Open], path: String): Bool =
+  h match {
+    case Open(p, _) => if (p == path) true else overlayHas(rest, path)
+  }
+
+def overlayPairs(open: List[Open]): List[(String, String)] =
+  if (List.isEmpty(open)) Manifest.noPairs() else overlayPairsHd(List.at(open, 0), List.tail(open))
+
+def overlayPairsHd(h: Open, rest: List[Open]): List[(String, String)] =
+  h match {
+    case Open(p, src) => (p, src) :: overlayPairs(rest)
+  }
+
+def srcOf(open: List[Open], path: String): IO[String] =
+  if (overlayHas(open, path)) IO.pure(overlayGet(open, path)) else Fs.read(path).handleErrorWith(_ => IO.pure(""))
 
 def handle(root: String, open: List[Open], body: String): IO[List[Open]] =
   handleJ(root, open, parseJson(body), body)
@@ -368,24 +435,64 @@ def handleJ(root: String, open: List[Open], j: Json, _body: String): IO[List[Ope
   handleM(root, open, j, methodOf(j), idJson(j))
 
 def handleM(root: String, open: List[Open], j: Json, method: String, id: String): IO[List[Open]] =
-  if (method == "initialize") reply(id, caps()).map(_ => open) else if (method == "shutdown") reply(id, "null").map(_ => open) else if (method == "exit") IO.pure(open) else if (method == "initialized") IO.pure(open) else if (method == "textDocument/didOpen" || method == "textDocument/didChange") didOpen(root, open, j) else if (method == "textDocument/didClose") IO.pure(overlayDrop(open, pathOfUri(uriOf(j)))) else if (method == "textDocument/hover") hover(open, j, id) else if (method == "textDocument/completion") complete(open, j, id) else if (method == "textDocument/definition" || method == "textDocument/declaration" || method == "textDocument/typeDefinition" || method == "textDocument/implementation") definition(open, j, id) else if (method == "textDocument/formatting") format(open, j, id) else if (method == "textDocument/rename") rename(open, j, id) else if (method == "textDocument/semanticTokens/full" || method == "textDocument/semanticTokens/range") tokens(open, j, id) else if (method == "textDocument/inlayHint" || method == "textDocument/foldingRange" || method == "textDocument/codeAction" || method == "textDocument/documentSymbol" || method == "textDocument/references" || method == "textDocument/documentHighlight" || method == "textDocument/selectionRange" || method == "textDocument/codeLens" || method == "textDocument/documentLink") reply(id, emptyArr()).map(_ => open) else if (id == "null") IO.pure(open) else reply(id, "null").map(_ => open)
+  if (method == "initialize") lspReplyKeep(id, caps(), open) else if (method == "shutdown") lspReplyKeep(id, "null", open) else if (method == "exit") IO.pure(open) else if (method == "initialized") IO.pure(open) else handleM2(root, open, j, method, id)
+
+def lspReplyKeep(id: String, result: String, open: List[Open]): IO[List[Open]] =
+  reply(id, result).flatMap(_ => IO.pure(open))
+
+def handleM2(root: String, open: List[Open], j: Json, method: String, id: String): IO[List[Open]] =
+  if (method == "textDocument/didOpen") didOpen(root, open, j) else if (method == "textDocument/didChange") didChange(root, open, j) else if (method == "textDocument/didClose") didClose(open, j) else handleM3(root, open, j, method, id)
+
+def handleM3(_root: String, open: List[Open], j: Json, method: String, id: String): IO[List[Open]] =
+  if (method == "textDocument/hover") hover(open, j, id) else if (method == "textDocument/completion") complete(open, j, id) else if (method == "textDocument/definition") definition(open, j, id) else if (method == "textDocument/formatting") format(open, j, id) else if (method == "textDocument/rename") rename(open, j, id) else if (method == "textDocument/semanticTokens/full") tokens(open, j, id) else handleM4(open, id)
+
+def handleM4(open: List[Open], id: String): IO[List[Open]] =
+  if (id == "null") IO.pure(open) else lspReplyErrKeep(open, id)
+
+def lspReplyErrKeep(open: List[Open], id: String): IO[List[Open]] =
+  replyErr(id, 0 - 32601, "MethodNotFound").flatMap(_ => IO.pure(open))
 
 def reply(id: String, result: String): IO[Unit] =
   Sys.write(frame(resultMsg(id, result)))
 
+def replyErr(id: String, code: Int, message: String): IO[Unit] =
+  Sys.write(frame(errorMsg(id, code, message)))
+
 def notify(body: String): IO[Unit] =
   Sys.write(frame(body))
 
+def openSrc(j: Json): String =
+  Json.getStr(jGet(paramsOf(j), "textDocument"), "text", "")
+
+def changeSrc(j: Json): String =
+  changeSrcArr(jArr(jGet(paramsOf(j), "contentChanges")))
+
+def changeSrcArr(xs: List[Json]): String =
+  if (List.isEmpty(xs)) "" else changeSrcOne(List.at(xs, List.len(xs) - 1))
+
+def changeSrcOne(c: Json): String =
+  Json.getStr(c, "text", "")
+
 def didOpen(root: String, open: List[Open], j: Json): IO[List[Open]] =
-  didOpen2(root, open, pathOfUri(uriOf(j)), jStr(jGet(jGet(jGet(paramsOf(j), "textDocument"), "text"), "text")) match {
-  case s => if (Str.nonEmpty(s)) s else jStr(jGet(jGet(paramsOf(j), "textDocument"), "text"))
-})
+  didOpen2(root, open, pathOfUri(uriOf(j)), openSrc(j))
+
+def didChange(root: String, open: List[Open], j: Json): IO[List[Open]] =
+  didOpen2(root, open, pathOfUri(uriOf(j)), changeSrc(j))
 
 def didOpen2(root: String, open: List[Open], path: String, src: String): IO[List[Open]] =
-  didOpen3(root, overlayPut(open, path, src), path, src)
+  didOpen3(root, overlayPut(open, path, src), path)
+
+def didOpen3(root: String, open: List[Open], path: String): IO[List[Open]] =
+  Drive.checkOverlay(root, overlayPairs(open)).handleErrorWith(_ => IO.pure("[]")).flatMap(raw => lspNotifyKeep(publishDiags(uriOfPath(path), raw), open))
+
+def lspNotifyKeep(msg: String, open: List[Open]): IO[List[Open]] =
+  notify(msg).flatMap(_ => IO.pure(open))
 
-def didOpen3(_root: String, open: List[Open], path: String, src: String): IO[List[Open]] =
-  notify(publishDiags(uriOfPath(path), Check.check(src))).map(_ => open)
+def didClose(open: List[Open], j: Json): IO[List[Open]] =
+  didClose2(open, uriOf(j))
+
+def didClose2(open: List[Open], uri: String): IO[List[Open]] =
+  notify(publishDiags(uri, "[]")).flatMap(_ => IO.pure(overlayDrop(open, pathOfUri(uri))))
 
 def hover(open: List[Open], j: Json, id: String): IO[List[Open]] =
   srcOf(open, pathOfUri(uriOf(j))).flatMap(src => reply(id, hoverJson(hoverAt(src, posLine(j), posCol(j)))).flatMap(_ => IO.pure(open)))
@@ -409,7 +516,7 @@ def format(open: List[Open], j: Json, id: String): IO[List[Open]] =
   srcOf(open, pathOfUri(uriOf(j))).flatMap(src => reply(id, formatJson(src)).flatMap(_ => IO.pure(open)))
 
 def rename(open: List[Open], j: Json, id: String): IO[List[Open]] =
-  srcOf(open, pathOfUri(uriOf(j))).flatMap(src => reply(id, renameJson(src, posLine(j), posCol(j), newNameOf(j))).flatMap(_ => IO.pure(open)))
+  srcOf(open, pathOfUri(uriOf(j))).flatMap(src => reply(id, renameJson(uriOf(j), src, posLine(j), posCol(j), newNameOf(j))).flatMap(_ => IO.pure(open)))
 
 def headerBody(acc: String): Int =
   headerBodyGo(acc, 0, 0)
@@ -420,14 +527,11 @@ def headerBodyGo(acc: String, i: Int, nl: Int): Int =
 def headerBodyNl(acc: String, i: Int, nl: Int): Int =
   if (nl == 1) i + 1 else headerBodyGo(acc, i + 1, 1)
 
-def readUntilHeader(acc: String): IO[String] =
-  if (headerBody(acc) >= 0) IO.pure(acc) else Sys.read(256).flatMap(c => if (Str.isEmpty(c)) IO.pure(acc) else readUntilHeader(Str.concat(acc, c)))
-
-def fillTo(acc: String, need: Int): IO[String] =
-  if (Str.byteLen(acc) >= need) IO.pure(acc) else Sys.read(256).flatMap(c => if (Str.isEmpty(c)) IO.pure(acc) else fillTo(Str.concat(acc, c), need))
-
 def parseLen(head: String): Int =
-  parseLenGo(head, Str.indexOf(head, "Content-Length:") + 15)
+  parseLenAt(head, Str.indexOf(head, "Content-Length:"))
+
+def parseLenAt(head: String, i: Int): Int =
+  if (i < 0) 0 else parseLenGo(head, i + 15)
 
 def parseLenGo(head: String, i: Int): Int =
   if (i < 0 || i >= Str.len(head)) 0 else if (Str.charAt(head, i) == 32 || Str.charAt(head, i) == 9) parseLenGo(head, i + 1) else parseLenDigits(head, i, i)
@@ -435,14 +539,29 @@ def parseLenGo(head: String, i: Int): Int =
 def parseLenDigits(head: String, a: Int, b: Int): Int =
   if (b >= Str.len(head) || Str.charAt(head, b) < 48 || Str.charAt(head, b) > 57) Str.toInt(Str.slice(head, a, b), 0) else parseLenDigits(head, a, b + 1)
 
+def readUntilHeader(acc: String): IO[String] =
+  if (headerBody(acc) >= 0) IO.pure(acc) else Sys.read(256).flatMap(c => readUntilGot(acc, c))
+
+def readUntilGot(acc: String, c: String): IO[String] =
+  if (Str.isEmpty(c)) readUntilEof(acc) else readUntilHeader(Str.concat(acc, c))
+
+def readUntilEof(acc: String): IO[String] =
+  if (Str.isEmpty(acc)) IO.pure(acc) else IO.fail("lsp: truncated header")
+
+def fillTo(acc: String, need: Int): IO[String] =
+  if (Str.byteLen(acc) >= need) IO.pure(acc) else Sys.read(256).flatMap(c => if (Str.isEmpty(c)) IO.pure(acc) else fillTo(Str.concat(acc, c), need))
+
 def readMsg(acc: String): IO[(String, String)] =
   readUntilHeader(acc).flatMap(got => readMsgGot(got, headerBody(got)))
 
 def readMsgGot(acc: String, start: Int): IO[(String, String)] =
-  if (start < 0) IO.pure(("", "")) else readMsg4(acc, parseLen(acc), start)
+  if (start < 0) IO.pure(("", "")) else readMsgLen(acc, parseLen(acc), start)
+
+def readMsgLen(acc: String, len: Int, start: Int): IO[(String, String)] =
+  if (len < 1) IO.fail("lsp: missing Content-Length") else fillTo(acc, start + len).flatMap(full => readMsgFull(full, start, len))
 
-def readMsg4(acc: String, len: Int, start: Int): IO[(String, String)] =
-  fillTo(acc, start + len).map(full => readMsg5(full, start, len))
+def readMsgFull(full: String, start: Int, len: Int): IO[(String, String)] =
+  if (Str.byteLen(full) < start + len) IO.fail("lsp: truncated body") else IO.pure(readMsg5(full, start, len))
 
 def readMsg5(full: String, start: Int, len: Int): (String, String) =
   (Str.byteSlice(full, start, start + len), Str.byteSlice(full, start + len, Str.byteLen(full)))
@@ -459,7 +578,16 @@ def serveGot(root: String, open: List[Open], body: String, rest: String): IO[Uni
   if (Str.isEmpty(body)) IO.pure(()) else handle(root, open, body).flatMap(nxt => serveStop(root, nxt, parseJson(body), rest))
 
 def serveStop(root: String, open: List[Open], j: Json, rest: String): IO[Unit] =
-  if (methodOf(j) == "exit") IO.pure(()) else serve(root, open, rest)
+  if (methodOf(j) == "exit") IO.pure(()) else serve(rootNext(root, j), open, rest)
+
+def rootNext(root: String, j: Json): String =
+  if (methodOf(j) == "initialize") rootFromInit(j, root) else root
+
+def rootFromInit(j: Json, fallback: String): String =
+  rootFromInit2(pathOfUri(jStr(jGet(paramsOf(j), "rootUri"))), fallback)
+
+def rootFromInit2(path: String, fallback: String): String =
+  if (Str.nonEmpty(path)) path else fallback
 
 def run(root: String): IO[Unit] =
   serve(root, [], "")
diff --git a/examples/compiler/src/Manifest.scuzz b/examples/compiler/src/Manifest.scuzz
index b77042bf..7b154934 100644
--- a/examples/compiler/src/Manifest.scuzz
+++ b/examples/compiler/src/Manifest.scuzz
@@ -1,6 +1,8 @@
-record Man(ok: Bool, name: String, version: String, hasUi: Bool, deps: List[(String, String)], err: String)
+record UiMan(width: String, height: String, scale: String, tapN: String, bundleId: String, runtime: String)
 
-record St(sec: String, name: String, version: String, hasUi: Bool, deps: List[(String, String)], err: String)
+record Man(ok: Bool, name: String, version: String, hasUi: Bool, deps: List[(String, String)], ui: UiMan, err: String)
+
+record St(sec: String, name: String, version: String, hasUi: Bool, deps: List[(String, String)], ui: UiMan, err: String)
 
 def noPairs(): List[(String, String)] =
   []
@@ -8,11 +10,14 @@ def noPairs(): List[(String, String)] =
 def noLines(): List[String] =
   []
 
+def defUi(): UiMan =
+  UiMan("200", "120", "1", "", "dev.scuzz.app", "headless")
+
 def fail(msg: String): Man =
-  Man(false, "", "0.0.0", false, noPairs(), msg)
+  Man(false, "", "0.0.0", false, noPairs(), defUi(), msg)
 
 def isSpace(c: Int): Bool =
-  c == 32 || c == 9
+  c == 32 || c == 9 || c == 13
 
 def ltrim(s: String, i: Int): Int =
   if (i >= Str.len(s)) i else if (isSpace(Str.charAt(s, i))) ltrim(s, i + 1) else i
@@ -33,7 +38,13 @@ def findEq(s: String, i: Int): Int =
   if (i >= Str.len(s)) 0 - 1 else if (Str.charAt(s, i) == 61) i else findEq(s, i + 1)
 
 def findComma(s: String, i: Int): Int =
-  if (i >= Str.len(s)) 0 - 1 else if (Str.charAt(s, i) == 44) i else findComma(s, i + 1)
+  findCommaQ(s, i, false)
+
+def findCommaQ(s: String, i: Int, q: Bool): Int =
+  if (i >= Str.len(s)) 0 - 1 else findCommaC(Str.charAt(s, i), s, i, q)
+
+def findCommaC(c: Int, s: String, i: Int, q: Bool): Int =
+  if (!q && c == 44) i else findCommaQ(s, i + 1, if (c == 34) !q else q)
 
 def unquote(s: String): String =
   unquote2(trim(s))
@@ -41,6 +52,9 @@ def unquote(s: String): String =
 def unquote2(s: String): String =
   if (Str.len(s) >= 2 && Str.charAt(s, 0) == 34 && Str.charAt(s, Str.len(s) - 1) == 34) Str.slice(s, 1, Str.len(s) - 1) else s
 
+def unquoteName(s: String): String =
+  trim(unquote(s))
+
 def splitEq(s: String): (String, String) =
   splitEq2(s, findEq(s, 0))
 
@@ -60,7 +74,7 @@ def pkgKey(k: String): Bool =
   k == "name" || k == "version" || k == "description"
 
 def uiKey(k: String): Bool =
-  k == "default_runtime" || k == "headless_size" || k == "headless_scale" || k == "tap_button" || k == "tap_text" || k == "bundle_id"
+  k == "default_runtime" || k == "headless_size" || k == "headless_scale" || k == "tap_button" || k == "bundle_id"
 
 def unkTable(t: String): String =
   Str.concat("unknown scuzz.toml table [", Str.concat(t, "]; known tables: package, dependencies, ui"))
@@ -69,7 +83,7 @@ def unkPkg(k: String): String =
   Str.concat("unknown scuzz.toml key `", Str.concat(k, "` in [package]; known keys: name, version, description"))
 
 def unkUi(k: String): String =
-  Str.concat("unknown scuzz.toml key `", Str.concat(k, "` in [ui]; known keys: default_runtime, headless_size, headless_scale, tap_button, tap_text, bundle_id"))
+  Str.concat("unknown scuzz.toml key `", Str.concat(k, "` in [ui]; known keys: default_runtime, headless_size, headless_scale, tap_button, bundle_id"))
 
 def strDep(): String =
   "string dependencies are unsupported; use `{ path = \"...\" }`"
@@ -89,14 +103,90 @@ def missName(): String =
 def emptyBundle(): String =
   "bundle_id must not be empty"
 
+def badRuntime(): String =
+  "default_runtime must be headless, desktop, or mobile"
+
+def badSize(): String =
+  "headless_size must be a pair of positive integers"
+
+def badScale(): String =
+  "headless_scale must be positive"
+
+def keyOutside(): String =
+  "key outside a table"
+
+def unclosedDep(): String =
+  "unclosed `{` in dependency"
+
+def dupDep(name: String): String =
+  Str.concat("duplicate dependency name `", Str.concat(name, "`"))
+
+def badPkgName(): String =
+  "package name must be [A-Za-z_][A-Za-z0-9_-]*"
+
+def okPkgName(s: String): Bool =
+  s != "" && okNameStart(Str.charAt(s, 0)) && okNameRest(s, 1)
+
+def okNameStart(c: Int): Bool =
+  c >= 65 && c <= 90 || c >= 97 && c <= 122 || c == 95
+
+def okNameRest(s: String, i: Int): Bool =
+  if (i >= Str.len(s)) true else okNameChar(Str.charAt(s, i)) && okNameRest(s, i + 1)
+
+def okNameChar(c: Int): Bool =
+  okNameStart(c) || c >= 48 && c <= 57 || c == 45
+
 def start(): St =
-  St("", "", "0.0.0", false, noPairs(), "")
+  St("", "", "0.0.0", false, noPairs(), defUi(), "")
 
 def withErr(st: St, msg: String): St =
-  St(st.sec, st.name, st.version, st.hasUi, st.deps, msg)
+  St(st.sec, st.name, st.version, st.hasUi, st.deps, stUi(st), msg)
+
+def withUi(st: St, ui: UiMan): St =
+  St(st.sec, st.name, st.version, st.hasUi, st.deps, ui, st.err)
+
+def stUi(st: St): UiMan =
+  st match {
+    case St(_sec, _name, _ver, _has, _deps, ui, _err) => ui
+  }
+
+def manUi(m: Man): UiMan =
+  m match {
+    case Man(_ok, _name, _ver, _has, _deps, ui, _err) => ui
+  }
+
+def uiWidth(ui: UiMan): String =
+  ui match {
+    case UiMan(w, _h, _sc, _t, _id, _rt) => w
+  }
+
+def uiHeight(ui: UiMan): String =
+  ui match {
+    case UiMan(_w, h, _sc, _t, _id, _rt) => h
+  }
+
+def uiScale(ui: UiMan): String =
+  ui match {
+    case UiMan(_w, _h, sc, _t, _id, _rt) => sc
+  }
+
+def uiTap(ui: UiMan): String =
+  ui match {
+    case UiMan(_w, _h, _sc, t, _id, _rt) => t
+  }
+
+def uiBundle(ui: UiMan): String =
+  ui match {
+    case UiMan(_w, _h, _sc, _t, id, _rt) => id
+  }
+
+def uiRuntime(ui: UiMan): String =
+  ui match {
+    case UiMan(_w, _h, _sc, _t, _id, rt) => rt
+  }
 
 def finish(st: St): Man =
-  if (Str.len(st.err) > 0) fail(st.err) else if (st.name == "") fail(missName()) else Man(true, st.name, st.version, st.hasUi, List.reverse(st.deps), "")
+  if (Str.len(st.err) > 0) fail(st.err) else if (st.name == "") fail(missName()) else Man(true, st.name, st.version, st.hasUi, List.reverse(st.deps), stUi(st), "")
 
 def parse(text: String): Man =
   finish(parseLines(linesOf(text), start()))
@@ -105,34 +195,99 @@ def parseLines(xs: List[String], st: St): St =
   if (Str.len(st.err) > 0) st else if (List.isEmpty(xs)) st else parseLine(trim(List.at(xs, 0)), List.tail(xs), st)
 
 def parseLine(line: String, rest: List[String], st: St): St =
+  parseLine2(trim(cutHash(line)), rest, st)
+
+def cutHash(s: String): String =
+  cutHash2(s, 0, false)
+
+def cutHash2(s: String, i: Int, q: Bool): String =
+  if (i >= Str.len(s)) s else cutHash3(Str.charAt(s, i), s, i, q)
+
+def cutHash3(c: Int, s: String, i: Int, q: Bool): String =
+  if (!q && c == 35) Str.slice(s, 0, i) else cutHash2(s, i + 1, if (c == 34) !q else q)
+
+def parseLine2(line: String, rest: List[String], st: St): St =
   if (line == "" || Str.startsWith(line, "#")) parseLines(rest, st) else if (Str.startsWith(line, "[")) parseSec(tableOf(line), rest, st) else parseKey(line, rest, st)
 
 def parseSec(t: String, rest: List[String], st: St): St =
-  if (t == "") withErr(st, unkTable(t)) else if (!knownTable(t)) withErr(st, unkTable(t)) else parseLines(rest, St(t, st.name, st.version, st.hasUi || t == "ui", st.deps, st.err))
+  if (t == "") withErr(st, unkTable(t)) else if (!knownTable(t)) withErr(st, unkTable(t)) else parseLines(rest, St(t, st.name, st.version, st.hasUi || t == "ui", st.deps, stUi(st), st.err))
 
 def parseKey(line: String, rest: List[String], st: St): St =
   parseKey2(splitEq(line), rest, st)
 
 def parseKey2(kv: (String, String), rest: List[String], st: St): St =
-  if (st.sec == "package") parsePkg(kv._1, kv._2, rest, st) else if (st.sec == "dependencies") parseDep(kv._1, kv._2, rest, st) else if (st.sec == "ui") parseUi(kv._1, kv._2, rest, st) else withErr(st, unkTable(st.sec))
+  if (st.sec == "package") parsePkg(kv._1, kv._2, rest, st) else if (st.sec == "dependencies") parseDep(kv._1, kv._2, rest, st) else if (st.sec == "ui") parseUi(kv._1, kv._2, rest, st) else withErr(st, if (st.sec == "") keyOutside() else unkTable(st.sec))
 
 def parsePkg(k: String, v: String, rest: List[String], st: St): St =
-  if (!pkgKey(k)) withErr(st, unkPkg(k)) else if (k == "name") parseLines(rest, St(st.sec, unquote(v), st.version, st.hasUi, st.deps, st.err)) else if (k == "version") parseLines(rest, St(st.sec, st.name, unquote(v), st.hasUi, st.deps, st.err)) else parseLines(rest, st)
+  if (!pkgKey(k)) withErr(st, unkPkg(k)) else if (k == "name") parsePkgName(unquoteName(v), rest, st) else if (k == "version") parseLines(rest, St(st.sec, st.name, unquote(v), st.hasUi, st.deps, stUi(st), st.err)) else parseLines(rest, st)
+
+def parsePkgName(name: String, rest: List[String], st: St): St =
+  if (!okPkgName(name)) withErr(st, badPkgName()) else parseLines(rest, St(st.sec, name, st.version, st.hasUi, st.deps, stUi(st), st.err))
 
 def parseUi(k: String, v: String, rest: List[String], st: St): St =
-  if (!uiKey(k)) withErr(st, unkUi(k)) else if (k == "bundle_id" && unquote(v) == "") withErr(st, emptyBundle()) else parseLines(rest, st)
+  if (!uiKey(k)) withErr(st, unkUi(k)) else parseUiVal(k, v, rest, st)
+
+def parseUiVal(k: String, v: String, rest: List[String], st: St): St =
+  if (k == "default_runtime") parseRuntime(unquote(v), rest, st) else if (k == "headless_size") parseSize(v, rest, st) else if (k == "headless_scale") parseScale(trim(v), rest, st) else if (k == "tap_button") parseTap(trim(v), rest, st) else parseBundle(unquote(v), rest, st)
+
+def parseRuntime(v: String, rest: List[String], st: St): St =
+  if (v == "headless" || v == "desktop" || v == "mobile") parseLines(rest, withUi(st, UiMan(uiWidth(stUi(st)), uiHeight(stUi(st)), uiScale(stUi(st)), uiTap(stUi(st)), uiBundle(stUi(st)), v))) else withErr(st, badRuntime())
+
+def parseSize(raw: String, rest: List[String], st: St): St =
+  parseSizeGot(sizePairVal(trim(raw)), rest, st)
+
+def parseSizeGot(wh: (Bool, String, String), rest: List[String], st: St): St =
+  wh match {
+    case (ok, w, h) => if (!ok) withErr(st, badSize()) else parseLines(rest, withUi(st, UiMan(w, h, uiScale(stUi(st)), uiTap(stUi(st)), uiBundle(stUi(st)), uiRuntime(stUi(st)))))
+  }
+
+def sizePairVal(v: String): (Bool, String, String) =
+  if (Str.len(v) < 5 || Str.charAt(v, 0) != 91 || Str.charAt(v, Str.len(v) - 1) != 93) (false, "", "") else sizePairInner(trim(Str.slice(v, 1, Str.len(v) - 1)))
+
+def sizePairInner(inner: String): (Bool, String, String) =
+  sizePairComma(inner, findComma(inner, 0))
+
+def sizePairComma(inner: String, c: Int): (Bool, String, String) =
+  if (c < 0) (false, "", "") else sizePairWH(trim(Str.slice(inner, 0, c)), trim(Str.slice(inner, c + 1, Str.len(inner))))
+
+def sizePairWH(w: String, h: String): (Bool, String, String) =
+  if (!isPosInt(w) || !isPosInt(h)) (false, "", "") else (true, w, h)
+
+def isPosInt(s: String): Bool =
+  s != "" && allDigits(s, 0) && Str.toInt(s, 0) > 0
+
+def allDigits(s: String, i: Int): Bool =
+  if (i >= Str.len(s)) true else if (Str.charAt(s, i) < 48 || Str.charAt(s, i) > 57) false else allDigits(s, i + 1)
+
+def parseScale(v: String, rest: List[String], st: St): St =
+  if (!isPosScale(v)) withErr(st, badScale()) else parseLines(rest, withUi(st, UiMan(uiWidth(stUi(st)), uiHeight(stUi(st)), v, uiTap(stUi(st)), uiBundle(stUi(st)), uiRuntime(stUi(st)))))
+
+def isPosScale(s: String): Bool =
+  if (s == "" || Str.charAt(s, 0) == 45) false else scaleForm(s, 0, 0, false) && hasNonZero(s, 0)
+
+def scaleForm(s: String, i: Int, dots: Int, digit: Bool): Bool =
+  if (i >= Str.len(s)) digit else scaleFormC(Str.charAt(s, i), s, i, dots, digit)
+
+def scaleFormC(c: Int, s: String, i: Int, dots: Int, digit: Bool): Bool =
+  if (c == 46) if (dots >= 1) false else scaleForm(s, i + 1, 1, false) else if (c >= 48 && c <= 57) scaleForm(s, i + 1, dots, true) else false
+
+def hasNonZero(s: String, i: Int): Bool =
+  if (i >= Str.len(s)) false else if (Str.charAt(s, i) >= 49 && Str.charAt(s, i) <= 57) true else hasNonZero(s, i + 1)
+
+def parseTap(v: String, rest: List[String], st: St): St =
+  if (!allDigits(v, 0) || v == "") withErr(st, "tap_button must be a non-negative integer") else parseLines(rest, withUi(st, UiMan(uiWidth(stUi(st)), uiHeight(stUi(st)), uiScale(stUi(st)), v, uiBundle(stUi(st)), uiRuntime(stUi(st)))))
+
+def parseBundle(v: String, rest: List[String], st: St): St =
+  if (v == "") withErr(st, emptyBundle()) else parseLines(rest, withUi(st, UiMan(uiWidth(stUi(st)), uiHeight(stUi(st)), uiScale(stUi(st)), uiTap(stUi(st)), v, uiRuntime(stUi(st)))))
 
 def parseDep(name: String, raw: String, rest: List[String], st: St): St =
-  parseDep2(name, trim(raw), rest, st)
+  parseDep2(trim(name), trim(raw), rest, st)
 
 def parseDep2(name: String, raw: String, rest: List[String], st: St): St =
-  if (Str.len(raw) > 0 && Str.charAt(raw, 0) == 34) withErr(st, strDep()) else if (Str.len(raw) > 0 && Str.charAt(raw, 0) == 123) parseInline(name, raw, rest, st) else withErr(st, strDep())
+  if (Str.len(raw) > 0 && Str.charAt(raw, 0) == 34) withErr(st, strDep()) else if (Str.len(raw) > 0 && Str.charAt(raw, 0) == 123) parseInline(name, raw, rest, st) else withErr(st, needPath())
 
 def parseInline(name: String, raw: String, rest: List[String], st: St): St =
-  parseInline2(name, innerOf(raw), rest, st)
-
-def innerOf(raw: String): String =
-  if (Str.len(raw) >= 2 && Str.charAt(raw, Str.len(raw) - 1) == 125) trim(Str.slice(raw, 1, Str.len(raw) - 1)) else trim(Str.slice(raw, 1, Str.len(raw)))
+  if (Str.len(raw) < 2 || Str.charAt(raw, Str.len(raw) - 1) != 125) withErr(st, unclosedDep()) else parseInline2(name, trim(Str.slice(raw, 1, Str.len(raw) - 1)), rest, st)
 
 def parseInline2(name: String, inner: String, rest: List[String], st: St): St =
   if (inner == "") withErr(st, needPath()) else takePath(name, kvs(inner, noPairs()), rest, st)
@@ -158,5 +313,13 @@ def takePathHd(name: String, h: (String, String), restXs: List[(String, String)]
   }
 
 def takePath3(name: String, path: String, found: Bool, rest: List[String], st: St): St =
-  if (!found) withErr(st, needPath()) else if (path == "") withErr(st, emptyPath()) else parseLines(rest, St(st.sec, st.name, st.version, st.hasUi, (name, path) :: st.deps, st.err))
+  if (!found) withErr(st, needPath()) else if (path == "") withErr(st, emptyPath()) else if (hasDep(st.deps, name)) withErr(st, dupDep(name)) else parseLines(rest, St(st.sec, st.name, st.version, st.hasUi, (name, path) :: st.deps, stUi(st), st.err))
+
+def hasDep(xs: List[(String, String)], name: String): Bool =
+  if (List.isEmpty(xs)) false else hasDepHd(List.at(xs, 0), List.tail(xs), name)
+
+def hasDepHd(h: (String, String), rest: List[(String, String)], name: String): Bool =
+  h match {
+    case (n, _p) => n == name || hasDep(rest, name)
+  }
 
diff --git a/examples/compiler/src/Mutate.scuzz b/examples/compiler/src/Mutate.scuzz
index 51162d35..593c661d 100644
--- a/examples/compiler/src/Mutate.scuzz
+++ b/examples/compiler/src/Mutate.scuzz
@@ -4,6 +4,8 @@ record Walks(xs: List[Expr], n: Int, hi: Int)
 
 record FunWalk(ds: List[Fun], n: Int)
 
+record ImplWalk(xs: List[Im], n: Int)
+
 record ArmWalk(xs: List[Arm], n: Int, hi: Int)
 
 record BindWalk(xs: List[Bind], n: Int, hi: Int)
@@ -14,6 +16,7 @@ import Parse.Prog
 import Parse.Arm
 import Parse.Bind
 import Parse.Param
+import Parse.Im
 
 def wrapStem(): String =
   "__verify"
@@ -31,10 +34,10 @@ def progSite(inO: Bool, o: Bool): Bool =
   !o && live(inO, o)
 
 def isOracle(f: String): Bool =
-  f == "Property.check" || f == "Property.assert"
+  f == "Property.check" || f == "Property.assert" || f == "Property.force"
 
 def isHandler(f: String): Bool =
-  f == "View.button" || f == "View.iconButton" || f == "View.outlinedButton" || f == "View.textButton" || f == "View.fab" || f == "View.inkWell"
+  f == "View.button" || f == "View.iconButton" || f == "View.fab" || f == "View.outlinedButton" || f == "View.textButton" || f == "View.actionChip" || f == "View.onSecondary"
 
 def flipRel(op: String): String =
   if (op == "==") "!=" else if (op == "!=") "==" else if (op == "<") ">=" else if (op == "<=") ">" else if (op == ">") "<=" else if (op == ">=") "<" else if (op == "&&") "||" else if (op == "||") "&&" else ""
@@ -94,7 +97,15 @@ def countFilesPick(stem: String, src: String, rest: List[(String, String)], o: B
 
 def countProg(p: Prog, o: Bool): Int =
   p match {
-    case Prog(_, _, _, _, _, _, defs, _, body) => countFuns(defs, 0, o) + countExpr(body, o)
+    case Prog(_, _, _, _, impls, _, defs, _, body) => countImpls(impls, 0, o) + countFuns(defs, 0, o) + countExpr(body, o)
+  }
+
+def countImpls(xs: List[Im], n: Int, o: Bool): Int =
+  if (List.isEmpty(xs)) n else countImplsHd(List.at(xs, 0), List.tail(xs), n, o)
+
+def countImplsHd(im: Im, rest: List[Im], n: Int, o: Bool): Int =
+  im match {
+    case Im(_, _, _, methods) => countImpls(rest, countFuns(methods, n, o), o)
   }
 
 def countFuns(ds: List[Fun], n: Int, o: Bool): Int =
@@ -106,7 +117,7 @@ def countFunsHd(d: Fun, rest: List[Fun], n: Int, o: Bool): Int =
   }
 
 def countExpr(e: Expr, o: Bool): Int =
-  walk(e, 0 - 1, 0, false, noExprs(), 0, o).n
+  walk(e, 0 - 1, 0, false, collectHs(e, noExprs()), 0, o).n
 
 def applyFiles(files: List[(String, String)], site: Int, o: Bool): List[(String, String)] =
   applyFilesGo(files, site, 0, o)
@@ -133,11 +144,28 @@ def applyFilesLive3(stem: String, src: String, rest: List[(String, String)], sit
 
 def applyProg(p: Prog, site: Int, o: Bool): Prog =
   p match {
-    case Prog(pkg, ens, als, trs, ims, imps, defs, main, body) => applyFuns(defs, site, 0, o) match {
+    case Prog(pkg, ens, als, trs, impls, imps, defs, main, body) => applyImpls(impls, site, 0, o) match {
+  case ImplWalk(ims, n0) => applyFuns(defs, site, n0, o) match {
   case FunWalk(ds, n) => walk(body, site, n, false, collectHs(body, noExprs()), 0, o) match {
   case Walk(b, _, _) => Prog(pkg, ens, als, trs, ims, imps, ds, main, b)
 }
 }
+}
+  }
+
+def applyImpls(xs: List[Im], site: Int, seen: Int, o: Bool): ImplWalk =
+  if (List.isEmpty(xs)) ImplWalk(Parse.noIm(), seen) else applyImplsHd(List.at(xs, 0), List.tail(xs), site, seen, o)
+
+def applyImplsHd(im: Im, rest: List[Im], site: Int, seen: Int, o: Bool): ImplWalk =
+  im match {
+    case Im(tn, targs, forTy, methods) => applyFuns(methods, site, seen, o) match {
+  case FunWalk(ms, n) => applyImplsRest(Im(tn, targs, forTy, ms), rest, site, n, o)
+}
+  }
+
+def applyImplsRest(im: Im, rest: List[Im], site: Int, seen: Int, o: Bool): ImplWalk =
+  applyImpls(rest, site, seen, o) match {
+    case ImplWalk(xs, n) => ImplWalk(im :: xs, n)
   }
 
 def applyFuns(ds: List[Fun], site: Int, seen: Int, o: Bool): FunWalk =
@@ -166,25 +194,26 @@ def collectHs(e: Expr, acc: List[Expr]): List[Expr] =
     case Expr.EField(recv, _, _) => collectHs(recv, acc)
     case Expr.EBin(_, l, r, _) => collectHs(r, collectHs(l, acc))
     case Expr.EUn(_, inner, _) => collectHs(inner, acc)
-    case Expr.ELam(_, body) => collectHs(body, acc)
+    case Expr.ELam(_, _, body) => collectHs(body, acc)
     case Expr.EIf(c, t, el, _) => collectHs(el, collectHs(t, collectHs(c, acc)))
     case Expr.EMatch(s, arms, _) => collectHsArms(arms, collectHs(s, acc))
     case Expr.EFor(bs, body, _) => collectHs(body, collectHsBinds(bs, acc))
     case Expr.EList(xs) => collectHsList(xs, acc)
     case Expr.ETuple(xs) => collectHsList(xs, acc)
     case Expr.ENamed(_, inner) => collectHs(inner, acc)
+    case Expr.EAscribe(inner, _, _) => collectHs(inner, acc)
     case _ => acc
   }
 
 def collectHsCall(f: String, args: List[Expr], acc: List[Expr], _e: Expr): List[Expr] =
-  collectHsList(args, if (isHandler(f) && isLamAt(args, 1)) handlerBody(args) :: acc else acc)
+  collectHsList(args, if (isHandler(f) && isLamAt(args, 1)) List.concat(acc, handlerBody(args) :: noExprs()) else acc)
 
 def isLamAt(args: List[Expr], i: Int): Bool =
   if (List.len(args) <= i) false else isLam(List.at(args, i))
 
 def isLam(e: Expr): Bool =
   e match {
-    case Expr.ELam(_, _) => true
+    case Expr.ELam(_, _, _) => true
     case _ => false
   }
 
@@ -193,7 +222,7 @@ def handlerBody(args: List[Expr]): Expr =
 
 def handlerBodyAt(e: Expr): Expr =
   e match {
-    case Expr.ELam(_, body) => body
+    case Expr.ELam(_, _, body) => body
     case _ => Expr.EUnit
   }
 
@@ -219,6 +248,7 @@ def collectHsBindsHd(b: Bind, rest: List[Bind], acc: List[Expr]): List[Expr] =
 def walk(e: Expr, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
   e match {
     case Expr.EInt(k, _) => walkInt(k, target, seen, inO, hi, o)
+    case Expr.EBool(b) => walkBool(b, target, seen, inO, hi, o)
     case Expr.EBin(op, l, r, _) => walkBin(op, l, r, target, seen, inO, hs, hi, o)
     case Expr.EIf(c, t, el, off) => walkIf(c, t, el, off, target, seen, inO, hs, hi, o)
     case Expr.ECall(f, args, _) => walkCall(f, args, target, seen, inO, hs, hi, o)
@@ -226,18 +256,22 @@ def walk(e: Expr, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o:
     case Expr.EMethod(recv, name, args, _) => walkMethod(recv, name, args, target, seen, inO, hs, hi, o)
     case Expr.EField(recv, name, _) => walkField(recv, name, target, seen, inO, hs, hi, o)
     case Expr.EUn(op, inner, off) => walkUn(op, inner, off, target, seen, inO, hs, hi, o)
-    case Expr.ELam(p, body) => walkLam(p, body, target, seen, inO, hs, hi, o)
+    case Expr.ELam(p, ty, body) => walkLam(p, ty, body, target, seen, inO, hs, hi, o)
     case Expr.EMatch(s, arms, _) => walkMatch(s, arms, target, seen, inO, hs, hi, o)
     case Expr.EFor(bs, body, _) => walkFor(bs, body, target, seen, inO, hs, hi, o)
     case Expr.EList(xs) => walkListExpr(xs, target, seen, inO, hs, hi, o)
     case Expr.ETuple(xs) => walkTuple(xs, target, seen, inO, hs, hi, o)
     case Expr.ENamed(name, inner) => walkNamed(name, inner, target, seen, inO, hs, hi, o)
+    case Expr.EAscribe(inner, ty, off) => walkAscribe(inner, ty, off, target, seen, inO, hs, hi, o)
     case _ => Walk(e, seen, hi)
   }
 
 def walkInt(k: Int, target: Int, seen: Int, inO: Bool, hi: Int, o: Bool): Walk =
   if ((k == 0 || k == 1) && live(inO, o)) Walk(Expr.EInt(if (seen == target) 1 - k else k, 0), seen + 1, hi) else Walk(Expr.EInt(k, 0), seen, hi)
 
+def walkBool(b: Bool, target: Int, seen: Int, inO: Bool, hi: Int, o: Bool): Walk =
+  if (live(inO, o)) Walk(Expr.EBool(if (seen == target) !b else b), seen + 1, hi) else Walk(Expr.EBool(b), seen, hi)
+
 def walkBin(op: String, l: Expr, r: Expr, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
   if (live(inO, o) && binN(op) > 0) walkBinHit(op, l, r, target, seen, inO, hs, hi, o) else walkBinKids(op, l, r, target, seen, inO, hs, hi, o)
 
@@ -317,7 +351,7 @@ def mapParam(args: List[Expr]): String =
 
 def mapParamAt(e: Expr): String =
   e match {
-    case Expr.ELam(p, _) => if (p == "_") "" else p
+    case Expr.ELam(p, _, _) => if (p == "_") "" else p
     case _ => ""
   }
 
@@ -331,7 +365,7 @@ def mapIdent(args: List[Expr], p: String): List[Expr] =
 
 def mapIdentLam(e: Expr, p: String): Expr =
   e match {
-    case Expr.ELam(q, _) => Expr.ELam(q, Expr.EVar(p, 0))
+    case Expr.ELam(q, ty, _) => Expr.ELam(q, ty, Expr.EVar(p, 0))
     case _ => e
   }
 
@@ -356,7 +390,7 @@ def nextH(hs: List[Expr], hi: Int): Expr =
 
 def swapHandlerLam(e: Expr, body: Expr): Expr =
   e match {
-    case Expr.ELam(p, _) => Expr.ELam(p, body)
+    case Expr.ELam(p, ty, _) => Expr.ELam(p, ty, body)
     case _ => e
   }
 
@@ -388,13 +422,26 @@ def walkField(recv: Expr, name: String, target: Int, seen: Int, inO: Bool, hs: L
   }
 
 def walkUn(op: String, inner: Expr, off: Int, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
+  if (op == "!" && live(inO, o)) walkUnNot(inner, off, target, seen, inO, hs, hi, o) else walkUnGo(op, inner, off, target, seen, inO, hs, hi, o)
+
+def walkUnNot(inner: Expr, off: Int, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
+  walk(inner, target, seen + 1, inO, hs, hi, o) match {
+    case Walk(e2, n, h) => Walk(if (seen == target) e2 else Expr.EUn("!", e2, off), n, h)
+  }
+
+def walkUnGo(op: String, inner: Expr, off: Int, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
   walk(inner, target, seen, inO, hs, hi, o) match {
     case Walk(e2, n, h) => Walk(Expr.EUn(op, e2, off), n, h)
   }
 
-def walkLam(p: String, body: Expr, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
+def walkLam(p: String, ty: String, body: Expr, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
   walk(body, target, seen, inO, hs, hi, o) match {
-    case Walk(b, n, h) => Walk(Expr.ELam(p, b), n, h)
+    case Walk(b, n, h) => Walk(Expr.ELam(p, ty, b), n, h)
+  }
+
+def walkAscribe(inner: Expr, ty: String, off: Int, target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
+  walk(inner, target, seen, inO, hs, hi, o) match {
+    case Walk(e2, n, h) => Walk(Expr.EAscribe(e2, ty, off), n, h)
   }
 
 def walkMatch(s: Expr, arms: List[Arm], target: Int, seen: Int, inO: Bool, hs: List[Expr], hi: Int, o: Bool): Walk =
@@ -479,5 +526,40 @@ def fuzzMutLine(killed: Int, survived: Int, inert: Int, ran: Int, sites: Int): S
   Str.concat("mutate: ", Str.concat(Str.fromInt(killed), Str.concat(" killed, ", Str.concat(Str.fromInt(survived), Str.concat(" survived, ", Str.concat(Str.fromInt(inert), Str.concat(" inert (", Str.concat(Str.fromInt(ran), Str.concat(" of ", Str.concat(Str.fromInt(sites), " sites)"))))))))))
 
 def mutateHead(take: Int, sites: Int, o: Bool): String =
-  Str.concat("scuzz fuzz mutate: ", Str.concat(Str.fromInt(take), Str.concat(" of ", Str.concat(Str.fromInt(sites), if (o) " residual oracle sites (negate/flip/0-1/arith/drop); idle + corpus replay" else " live-code sites (flip/if/0-1/sibling); idle + corpus replay"))))
+  Str.concat("scuzz fuzz mutate: ", Str.concat(Str.fromInt(take), Str.concat(" of ", Str.concat(Str.fromInt(sites), if (o) " residual oracle sites (negate/flip/0-1/arith/drop); idle + corpus replay" else " live-code sites (flip/if/0-1/map/handler); idle + corpus replay"))))
+
+def noFiles(): List[(String, String)] =
+  []
+
+def oneSrc(src: String): List[(String, String)] =
+  ("Main", src) :: noFiles()
+
+def srcTwoBtn(): String =
+  "@main def main: IO[Unit] =\n  Ui.run(_ => View.column(View.button(\"A\", _ => Signal.set(a, 3)), View.button(\"B\", _ => Signal.set(b, 4))))\n"
+
+def srcArithBtn(): String =
+  "@main def main: IO[Unit] =\n  Ui.run(_ => View.column(View.button(\"A\", _ => Signal.set(a, Signal.get(a) + 3)), View.button(\"B\", _ => Signal.set(b, 4))))\n"
+
+def fileSrc(files: List[(String, String)]): String =
+  if (List.isEmpty(files)) "" else fileSrcHd(List.at(files, 0))
+
+def fileSrcHd(h: (String, String)): String =
+  h match {
+    case (_, src) => src
+  }
+
+def sitesOk(): Bool =
+  twoBtnOk() && arithBtnOk()
+
+def twoBtnOk(): Bool =
+  countFiles(oneSrc(srcTwoBtn()), false) == 2 && twoBtnSwap()
+
+def twoBtnSwap(): Bool =
+  Str.contains(fileSrc(applyFiles(oneSrc(srcTwoBtn()), 0, false)), "View.button(\"A\", _ => Signal.set(b, 4))") && !Str.contains(fileSrc(applyFiles(oneSrc(srcTwoBtn()), 0, false)), "Signal.set(a, 3)")
+
+def arithBtnOk(): Bool =
+  countFiles(oneSrc(srcArithBtn()), false) == 3 && arithBtnOp()
+
+def arithBtnOp(): Bool =
+  Str.contains(fileSrc(applyFiles(oneSrc(srcArithBtn()), 1, false)), "Signal.get(a) - 3") && Str.contains(fileSrc(applyFiles(oneSrc(srcArithBtn()), 1, false)), "Signal.set(a,") && Str.contains(fileSrc(applyFiles(oneSrc(srcArithBtn()), 1, false)), "Signal.set(b, 4)")
 
diff --git a/examples/compiler/src/Verify.scuzz b/examples/compiler/src/Verify.scuzz
index 7432b121..c955ad33 100644
--- a/examples/compiler/src/Verify.scuzz
+++ b/examples/compiler/src/Verify.scuzz
@@ -137,11 +137,11 @@ def noCase(): List[EnCase] =
 def intTok(w: String): String =
   if (w == "") "i" else if (findIdx(w, ">=", 0) >= 0) Str.concat("i>=", trimNum(afterOp(w, ">="))) else if (findIdx(w, "<=", 0) >= 0) Str.concat("i<=", trimNum(afterOp(w, "<="))) else if (findIdx(w, ">", 0) >= 0) Str.concat("i>", trimNum(afterOp(w, ">"))) else if (findIdx(w, "<", 0) >= 0) Str.concat("i<", trimNum(afterOp(w, "<"))) else "i"
 
-def friendly(p: Param): Bool =
-  p.ty == "Int" || p.ty == "String" || p.ty == "Bool" || isGenTy(p.ty)
+def friendly(p: Param, ens: List[En]): Bool =
+  friendlyTy(p.ty, ens)
 
-def isGenTy(t: String): Bool =
-  if (t == "" || t == "Unit" || t == "Any" || t == "Float" || t == "Timeline" || t == "Verdict") false else if (Str.startsWith(t, "IO")) false else if (hasSub(t, "=>")) false else if (opaqueTy(t)) false else true
+def friendlyTy(t: String, ens: List[En]): Bool =
+  if (t == "Int" || t == "String" || t == "Bool") true else if (isListTy(t)) friendlyTy(listInner(t), ens) else if (opaqueTy(tyHead(t))) false else if (t == "" || t == "Unit" || t == "Any" || t == "Float" || t == "Timeline" || t == "Verdict") false else if (Str.startsWith(t, "IO")) false else if (hasSub(t, "=>")) false else !List.isEmpty(findEn(ens, tyHead(t)))
 
 def opaqueTy(t: String): Bool =
   t == "Fiber" || t == "Ref" || t == "Queue" || t == "Deferred" || t == "Resource" || t == "Stream" || t == "Map" || t == "Set"
@@ -149,20 +149,51 @@ def opaqueTy(t: String): Bool =
 def hasSub(s: String, n: String): Bool =
   findIdx(s, n, 0) >= 0
 
-def allFriendly(ps: List[Param]): Bool =
-  List.isEmpty(ps) || friendly(List.at(ps, 0)) && allFriendly(List.tail(ps))
+def allFriendly(ps: List[Param], ens: List[En]): Bool =
+  List.isEmpty(ps) || friendly(List.at(ps, 0), ens) && allFriendly(List.tail(ps), ens)
 
-def isDrive(d: Fun): Bool =
-  d.ret == "Bool" && allFriendly(d.params)
+def isAdtOrList(p: Param): Bool =
+  isListTy(p.ty) || !(p.ty == "Int" || p.ty == "String" || p.ty == "Bool")
+
+def hasAdtOrList(ps: List[Param]): Bool =
+  if (List.isEmpty(ps)) false else isAdtOrList(List.at(ps, 0)) || hasAdtOrList(List.tail(ps))
+
+def unaryAdtOk(ps: List[Param]): Bool =
+  List.len(ps) <= 1 || !hasAdtOrList(ps)
+
+def simpleWhere(w: String): Bool =
+  w == "" || !hasSub(w, "&&") && !hasSub(w, "||")
+
+def allSimpleWhere(ps: List[Param]): Bool =
+  if (List.isEmpty(ps)) true else allSimpleWhere1(List.at(ps, 0), List.tail(ps))
+
+def allSimpleWhere1(p: Param, rest: List[Param]): Bool =
+  p match {
+    case Param(_, _, w, _) => simpleWhere(w) && allSimpleWhere(rest)
+  }
+
+def isDrive(d: Fun, ens: List[En]): Bool =
+  !d.priv && d.ret == "Bool" && List.len(d.params) <= 3 && allFriendly(d.params, ens) && unaryAdtOk(d.params) && allSimpleWhere(d.params)
 
 def isClaim(d: Fun): Bool =
-  d.ret == "Verdict"
+  !d.priv && d.ret == "Verdict" && claimPs(d.params)
 
-def drives(ds: List[Fun]): List[Fun] =
-  if (List.isEmpty(ds)) noFun() else drives1(List.at(ds, 0), List.tail(ds))
+def claimPs(ps: List[Param]): Bool =
+  (List.len(ps) == 1 || List.len(ps) == 2) && allTimeline(ps)
 
-def drives1(d: Fun, rest: List[Fun]): List[Fun] =
-  if (isDrive(d)) d :: drives(rest) else drives(rest)
+def allTimeline(ps: List[Param]): Bool =
+  if (List.isEmpty(ps)) true else allTimeline1(List.at(ps, 0), List.tail(ps))
+
+def allTimeline1(p: Param, rest: List[Param]): Bool =
+  p match {
+    case Param(_, ty, _, _) => ty == "Timeline" && allTimeline(rest)
+  }
+
+def drives(ds: List[Fun], ens: List[En]): List[Fun] =
+  if (List.isEmpty(ds)) noFun() else drives1(List.at(ds, 0), List.tail(ds), ens)
+
+def drives1(d: Fun, rest: List[Fun], ens: List[En]): List[Fun] =
+  if (isDrive(d, ens)) d :: drives(rest, ens) else drives(rest, ens)
 
 def specOfE(d: Fun, ens: List[En]): String =
   if (List.isEmpty(d.params)) d.name else Str.concat(d.name, Str.concat(" ", specs(d.params, ens)))
@@ -213,10 +244,16 @@ def parseEvSkip(src: String, i: Int): List[String] =
   if (i >= Str.len(src)) noStr() else parseEvCh(src, i, Str.charAt(src, i))
 
 def parseEvCh(src: String, i: Int, c: Int): List[String] =
-  if (c == 32 || c == 10 || c == 13 || c == 9 || c == 44) parseEvSkip(src, i + 1) else if (c == 93) noStr() else if (c == 34) parseEvStr(src, i + 1, i + 1) else parseEvSkip(src, i + 1)
+  if (c == 32 || c == 10 || c == 13 || c == 9 || c == 44) parseEvSkip(src, i + 1) else if (c == 93) noStr() else if (c == 34) parseEvStr(src, i + 1, "") else parseEvSkip(src, i + 1)
+
+def parseEvStr(src: String, i: Int, acc: String): List[String] =
+  if (i >= Str.len(src)) noStr() else parseEvStrCh(src, i, Str.charAt(src, i), acc)
+
+def parseEvStrCh(src: String, i: Int, c: Int, acc: String): List[String] =
+  if (c == 92) parseEvEsc(src, i + 1, acc) else if (c == 34) acc :: parseEvSkip(src, i + 1) else parseEvStr(src, i + 1, Str.concat(acc, Str.slice(src, i, i + 1)))
 
-def parseEvStr(src: String, start: Int, i: Int): List[String] =
-  if (i >= Str.len(src)) noStr() else if (Str.charAt(src, i) == 34) Str.slice(src, start, i) :: parseEvSkip(src, i + 1) else parseEvStr(src, start, i + 1)
+def parseEvEsc(src: String, i: Int, acc: String): List[String] =
+  if (i >= Str.len(src)) acc :: noStr() else parseEvStr(src, i + 1, Str.concat(acc, Str.slice(src, i, i + 1)))
 
 def tomlQuoted(src: String, key: String): String =
   tomlQuotedAt(src, findIdx(src, Str.concat(key, " = \""), 0), Str.len(key) + 4)
@@ -231,7 +268,13 @@ def quoteEvents(xs: List[String]): String =
   if (List.isEmpty(xs)) "" else if (List.isEmpty(List.tail(xs))) quoteEv(List.at(xs, 0)) else Str.concat(quoteEv(List.at(xs, 0)), Str.concat(", ", quoteEvents(List.tail(xs))))
 
 def quoteEv(e: String): String =
-  Str.concat("\"", Str.concat(e, "\""))
+  Str.concat("\"", Str.concat(escEv(e, 0, Builder.empty()), "\""))
+
+def escEv(s: String, i: Int, b: Builder): String =
+  if (i >= Str.len(s)) Builder.result(b) else escEv(s, i + 1, Builder.append(b, escEvCh(Str.charAt(s, i), s, i)))
+
+def escEvCh(c: Int, s: String, i: Int): String =
+  if (c == 92) "\\\\" else if (c == 34) "\\\"" else Str.slice(s, i, i + 1)
 
 def reproText(seed: Int, sched: String, fault: String, events: List[String]): String =
   Str.concat("""[fuzz]
@@ -239,8 +282,12 @@ seed = """, Str.concat(Str.fromInt(seed), Str.concat(reproSched(sched), Str.conc
 """))))))
 
 def reproSched(sched: String): String =
-  if (sched == "") """
-""" else Str.concat("\nschedule_seed = \"", Str.concat(sched, "\"\n"))
+  if (sched == "") nl() else Str.concat("\nschedule_seed = \"", Str.concat(sched, Str.concat("\"\n", pctLines(sched))))
+
+def pctLines(sched: String): String =
+  Str.concat("pct_d = ", Str.concat(Str.fromInt(decodeD(parseSeed(sched))), Str.concat("""
+pct_k = """, Str.concat(Str.fromInt(decodeK(parseSeed(sched))), """
+"""))))
 
 def reproFault(fault: String): String =
   if (fault == "") "" else Str.concat("fault_seed = \"", Str.concat(fault, "\"\n"))
@@ -248,36 +295,54 @@ def reproFault(fault: String): String =
 def summaryToml(ok: Bool, seed: Int, iterations: Int, search: Int, failures: Int, corpus: Int, corpFail: Int, promo: String, repro: String, killed: Int, survived: Int, inert: Int, ran: Int, sites: Int, oracles: Bool, classText: String): String =
   Str.concat(summaryFuzz(ok, seed, iterations, search, failures, corpus, repro), summaryRest(corpus, corpFail, promo, killed, survived, inert, ran, sites, oracles, classText))
 
+def kv(k: String, v: String): String =
+  Str.concat(k, Str.concat(" = ", v))
+
+def kvn(k: String, v: String): String =
+  Str.concat(kv(k, v), nl())
+
+def quote1(s: String): String =
+  Str.concat("\"", Str.concat(s, "\""))
+
 def summaryFuzz(ok: Bool, seed: Int, iterations: Int, search: Int, failures: Int, corpus: Int, repro: String): String =
   Str.concat("""[fuzz]
-ok = """, Str.concat(if (ok) "true" else "false", Str.concat("""
-seed = """, Str.concat(Str.fromInt(seed), Str.concat("""
-iterations = """, Str.concat(Str.fromInt(iterations), Str.concat("""
-search = """, Str.concat(Str.fromInt(search), Str.concat("""
-search_failures = """, Str.concat(Str.fromInt(failures), Str.concat("""
-corpus = """, Str.concat(Str.fromInt(corpus), Str.concat("\ndrivers = []\nevents = []\ndeclared = []\nreachability = []\nmissing_budget = []\nmissing_corpus = []\nrepro = \"", Str.concat(repro, "\"\nreplay = \"\"\n\n"))))))))))))))
+""", Str.concat(kvn("ok", if (ok) "true" else "false"), summaryFuzzNums(seed, iterations, search, failures, corpus, repro)))
+
+def summaryFuzzNums(seed: Int, iterations: Int, search: Int, failures: Int, corpus: Int, repro: String): String =
+  Str.concat(kvn("seed", Str.fromInt(seed)), Str.concat(kvn("iterations", Str.fromInt(iterations)), Str.concat(kvn("search", Str.fromInt(search)), Str.concat(kvn("search_failures", Str.fromInt(failures)), Str.concat(kvn("corpus", Str.fromInt(corpus)), summaryRepro(repro))))))
+
+def summaryRepro(repro: String): String =
+  if (repro == "") "" else kvn("repro", quote1(repro))
 
 def summaryRest(corpus: Int, corpFail: Int, promo: String, killed: Int, survived: Int, inert: Int, ran: Int, sites: Int, oracles: Bool, classText: String): String =
-  Str.concat("""[coverage]
-unclaimed_varied = []
+  Str.concat(summaryCorpus(corpus, corpFail, promo), Str.concat(summaryClass(classText), summaryMut(killed, survived, inert, ran, sites, oracles)))
 
+def summaryCorpus(corpus: Int, corpFail: Int, promo: String): String =
+  Str.concat("""
 [corpus]
-entries = """, Str.concat(Str.fromInt(corpus), Str.concat("""
-failures = """, Str.concat(Str.fromInt(corpFail), Str.concat("""
-reached = []
-promoted = """, Str.concat(promo, Str.concat("""
+""", Str.concat(kvn("entries", Str.fromInt(corpus)), Str.concat(kvn("failures", Str.fromInt(corpFail)), kvn("promoted", promo))))
 
+def summaryClass(classText: String): String =
+  if (classText == "") "" else Str.concat("""
 [classify]
-""", Str.concat(classText, Str.concat("""[mutate]
-killed = """, Str.concat(Str.fromInt(killed), Str.concat("""
-survived = """, Str.concat(Str.fromInt(survived), Str.concat("""
-inert = """, Str.concat(Str.fromInt(inert), Str.concat("""
-ran = """, Str.concat(Str.fromInt(ran), Str.concat("""
-sites = """, Str.concat(Str.fromInt(sites), Str.concat("""
-oracles = """, Str.concat(if (oracles) "true" else "false", """
-score = 1.000
-survivors = []
-"""))))))))))))))))))))
+""", classText)
+
+def summaryMut(killed: Int, survived: Int, inert: Int, ran: Int, sites: Int, oracles: Bool): String =
+  Str.concat("""
+[mutate]
+""", Str.concat(kvn("killed", Str.fromInt(killed)), Str.concat(kvn("survived", Str.fromInt(survived)), Str.concat(kvn("inert", Str.fromInt(inert)), Str.concat(kvn("ran", Str.fromInt(ran)), Str.concat(kvn("sites", Str.fromInt(sites)), Str.concat(kvn("oracles", if (oracles) "true" else "false"), summaryScore(killed, sites))))))))
+
+def summaryScore(killed: Int, sites: Int): String =
+  if (sites <= 0) "" else kvn("score", score3(killed, sites))
+
+def score3(killed: Int, sites: Int): String =
+  score3n(killed * 1000 / sites)
+
+def score3n(n: Int): String =
+  Str.concat(Str.fromInt(n / 1000), Str.concat(".", pad3(n % 1000)))
+
+def pad3(n: Int): String =
+  if (n < 10) Str.concat("00", Str.fromInt(n)) else if (n < 100) Str.concat("0", Str.fromInt(n)) else Str.fromInt(n)
 
 def classToml(text: String): String =
   classLines(linesOf(text))
@@ -364,11 +429,14 @@ def mapSpecE(ds: List[Fun], ens: List[En]): List[String] =
   if (List.isEmpty(ds)) noStr() else specOfE(List.at(ds, 0), ens) :: mapSpecE(List.tail(ds), ens)
 
 def parseVerify(src: String): List[Fun] =
-  parseVerifyProg(Parse.parse(Lexer.lex(src)))
+  parseVerifyEns(src, noEn())
+
+def parseVerifyEns(src: String, ens: List[En]): List[Fun] =
+  parseVerifyProg(Parse.parse(Lexer.lex(src)), ens)
 
-def parseVerifyProg(p: Prog): List[Fun] =
+def parseVerifyProg(p: Prog, ens: List[En]): List[Fun] =
   p match {
-    case Prog(_, _, _, _, _, _, defs, _, _) => drives(defs)
+    case Prog(_, _, _, _, _, _, defs, _, _) => drives(defs, ens)
   }
 
 def parseClaims(src: String): List[Fun] =
@@ -389,7 +457,10 @@ def wrapMod(): String =
   "__verify"
 
 def wrapSrc(stem: String, src: String): String =
-  Str.concat(wrapFuns(stem, parseVerify(src)), wrapRelFuns(parseClaims(src)))
+  wrapSrcEns(stem, src, noEn())
+
+def wrapSrcEns(stem: String, src: String, ens: List[En]): String =
+  Str.concat(wrapFuns(stem, parseVerifyEns(src, ens)), wrapRelFuns(parseClaims(src)))
 
 def wrapFuns(stem: String, ds: List[Fun]): String =
   if (List.isEmpty(ds)) "" else Str.concat(wrapFun(stem, List.at(ds, 0)), wrapFuns(stem, List.tail(ds)))
@@ -426,11 +497,14 @@ def wrapRel2(name: String, ps: String, body: String): String =
 """))))))
 
 def wrapFiles(files: List[(String, String)]): String =
-  if (List.isEmpty(files)) "" else wrapFiles2(List.at(files, 0), List.tail(files))
+  wrapFilesEns(files, noEn())
+
+def wrapFilesEns(files: List[(String, String)], ens: List[En]): String =
+  if (List.isEmpty(files)) "" else wrapFilesEns2(List.at(files, 0), List.tail(files), ens)
 
-def wrapFiles2(h: (String, String), rest: List[(String, String)]): String =
+def wrapFilesEns2(h: (String, String), rest: List[(String, String)], ens: List[En]): String =
   h match {
-    case (stem, src) => Str.concat(wrapSrc(stem, src), wrapFiles(rest))
+    case (stem, src) => Str.concat(wrapSrcEns(stem, src, ens), wrapFilesEns(rest, ens))
   }
 
 def applySim(live: String, sim: String): String =
@@ -485,12 +559,13 @@ def exprHasReq(e: Expr): Bool =
     case Expr.EField(recv, _, _) => exprHasReq(recv)
     case Expr.EBin(_, l, r, _) => exprHasReq(l) || exprHasReq(r)
     case Expr.EUn(_, inner, _) => exprHasReq(inner)
-    case Expr.ELam(_, body) => exprHasReq(body)
+    case Expr.ELam(_, _, body) => exprHasReq(body)
     case Expr.EIf(c, t, el, _) => exprHasReq(c) || exprHasReq(t) || exprHasReq(el)
     case Expr.EMatch(s, arms, _) => exprHasReq(s) || armsHaveReq(arms)
     case Expr.EList(xs) => listHasReq(xs)
     case Expr.ETuple(xs) => listHasReq(xs)
     case Expr.ENamed(_, inner) => exprHasReq(inner)
+    case Expr.EAscribe(inner, _, _) => exprHasReq(inner)
     case Expr.EFor(bs, body, _) => bindsHaveReq(bs) || exprHasReq(body)
     case _ => false
   }
@@ -529,24 +604,25 @@ def rewriteReqFun(d: Fun): Fun =
 
 def rewriteReq(e: Expr): Expr =
   e match {
-    case Expr.EPrint(inner, _) => Expr.EPrint(rewriteReq(inner), 0)
-    case Expr.ECall(f, args, _) => Expr.ECall(f, rewriteReqList(args), 0)
-    case Expr.EMethod(recv, name, args, _) => rewriteReqMeth(rewriteReq(recv), name, rewriteReqList(args))
-    case Expr.EField(recv, name, _) => Expr.EField(rewriteReq(recv), name, 0)
-    case Expr.EBin(op, l, r, _) => Expr.EBin(op, rewriteReq(l), rewriteReq(r), 0)
-    case Expr.EUn(op, inner, _) => Expr.EUn(op, rewriteReq(inner), 0)
-    case Expr.ELam(p, body) => Expr.ELam(p, rewriteReq(body))
-    case Expr.EIf(c, t, el, _) => Expr.EIf(rewriteReq(c), rewriteReq(t), rewriteReq(el), 0)
-    case Expr.EMatch(s, arms, _) => Expr.EMatch(rewriteReq(s), rewriteReqArms(arms), 0)
+    case Expr.EPrint(inner, off) => Expr.EPrint(rewriteReq(inner), off)
+    case Expr.ECall(f, args, off) => Expr.ECall(f, rewriteReqList(args), off)
+    case Expr.EMethod(recv, name, args, off) => rewriteReqMeth(rewriteReq(recv), name, rewriteReqList(args), off)
+    case Expr.EField(recv, name, off) => Expr.EField(rewriteReq(recv), name, off)
+    case Expr.EBin(op, l, r, off) => Expr.EBin(op, rewriteReq(l), rewriteReq(r), off)
+    case Expr.EUn(op, inner, off) => Expr.EUn(op, rewriteReq(inner), off)
+    case Expr.ELam(p, ty, body) => Expr.ELam(p, ty, rewriteReq(body))
+    case Expr.EIf(c, t, el, off) => Expr.EIf(rewriteReq(c), rewriteReq(t), rewriteReq(el), off)
+    case Expr.EMatch(s, arms, off) => Expr.EMatch(rewriteReq(s), rewriteReqArms(arms), off)
     case Expr.EList(xs) => Expr.EList(rewriteReqList(xs))
     case Expr.ETuple(xs) => Expr.ETuple(rewriteReqList(xs))
     case Expr.ENamed(n, inner) => Expr.ENamed(n, rewriteReq(inner))
-    case Expr.EFor(bs, body, _) => Expr.EFor(rewriteReqBinds(bs), rewriteReq(body), 0)
+    case Expr.EAscribe(inner, ty, off) => Expr.EAscribe(rewriteReq(inner), ty, off)
+    case Expr.EFor(bs, body, off) => Expr.EFor(rewriteReqBinds(bs), rewriteReq(body), off)
     case _ => e
   }
 
-def rewriteReqMeth(recv: Expr, name: String, args: List[Expr]): Expr =
-  if (name == "require") Expr.ECall("Property.check", reqNameE(args) :: reqPredE(args) :: recv :: noExpr(), 0) else Expr.EMethod(recv, name, args, 0)
+def rewriteReqMeth(recv: Expr, name: String, args: List[Expr], off: Int): Expr =
+  if (name == "require") Expr.ECall("Property.check", reqNameE(args) :: reqPredE(args) :: recv :: noExpr(), off) else Expr.EMethod(recv, name, args, off)
 
 def reqNameE(args: List[Expr]): Expr =
   if (List.len(args) < 2) Expr.EStr("require", 0) else reqNameHit(List.at(args, 0))
@@ -566,12 +642,23 @@ def forcePred(e: Expr): Expr =
 def isIoPred(e: Expr): Bool =
   e match {
     case Expr.EFor(bs, body, _) => hasDraw(bs) || isIoPred(body)
-    case Expr.ECall(f, _, _) => Str.startsWith(f, "IO.")
+    case Expr.ECall(f, _, _) => ioCall(f)
     case Expr.EMethod(_, name, _, _) => name == "flatMap" || name == "map" || name == "handleErrorWith"
     case Expr.EIf(_, t, el, _) => isIoPred(t) || isIoPred(el)
     case _ => false
   }
 
+def ioCall(f: String): Bool =
+  Str.startsWith(f, "IO.") || Str.startsWith(f, "Fs.") || Str.startsWith(f, "Net.") || Str.startsWith(f, "Sys.") || Str.startsWith(f, "Clock.") || Str.startsWith(f, "Random.")
+
+def hasDraw(bs: List[Bind]): Bool =
+  if (List.isEmpty(bs)) false else bindIsDraw(List.at(bs, 0)) || hasDraw(List.tail(bs))
+
+def bindIsDraw(b: Bind): Bool =
+  b match {
+    case Bind(draw, _, _) => draw
+  }
+
 def rewriteReqList(xs: List[Expr]): List[Expr] =
   if (List.isEmpty(xs)) xs else rewriteReq(List.at(xs, 0)) :: rewriteReqList(List.tail(xs))
 
@@ -606,10 +693,13 @@ def drivers(src: String): String =
   nls(mapSpec(parseVerify(src)))
 
 def driversFrom(srcs: List[String], ens: List[En]): String =
-  nls(mapSpecE(parseVerifyAll(srcs), ens))
+  nls(mapSpecE(parseVerifyAllEns(srcs, ens), ens))
 
 def parseVerifyAll(srcs: List[String]): List[Fun] =
-  if (List.isEmpty(srcs)) noFun() else List.concat(parseVerify(List.at(srcs, 0)), parseVerifyAll(List.tail(srcs)))
+  parseVerifyAllEns(srcs, noEn())
+
+def parseVerifyAllEns(srcs: List[String], ens: List[En]): List[Fun] =
+  if (List.isEmpty(srcs)) noFun() else List.concat(parseVerifyEns(List.at(srcs, 0), ens), parseVerifyAllEns(List.tail(srcs), ens))
 
 def ensOfFiles(files: List[(String, String)]): List[En] =
   if (List.isEmpty(files)) noEn() else List.concat(ensOfFile(List.at(files, 0)), ensOfFiles(List.tail(files)))
@@ -625,7 +715,7 @@ def ensOfProg(p: Prog): List[En] =
   }
 
 def emptyVerify(file: String): String =
-  Str.concat(file, Str.concat(":1:1: error: ", Str.concat(file, ": verify file needs a Timeline => Verdict claim or a drive oracle; write a claim or delete the file")))
+  Str.concat(file, ":1:1: error: verify file needs a Timeline => Verdict claim or a drive oracle; write a claim or delete the file")
 
 def ioRet(d: Fun): Bool =
   Str.len(d.ret) >= 2 && Str.slice(d.ret, 0, 2) == "IO"
@@ -648,7 +738,10 @@ def ioDefNamesHd(d: Fun, rest: List[Fun]): List[String] =
   if (ioRet(d)) d.name :: ioDefNames(rest) else ioDefNames(rest)
 
 def oracleNames(srcs: List[String]): List[String] =
-  funNames(parseVerifyAll(srcs))
+  oracleNamesEns(srcs, noEn())
+
+def oracleNamesEns(srcs: List[String], ens: List[En]): List[String] =
+  funNames(parseVerifyAllEns(srcs, ens))
 
 def funNames(ds: List[Fun]): List[String] =
   if (List.isEmpty(ds)) noStr() else funNamesHd(List.at(ds, 0), List.tail(ds))
@@ -674,8 +767,116 @@ def driveRule(names: List[String]): String =
 def driveDupMsgGo(dup: String): String =
   if (dup == "") "" else driveDupMsg(dup)
 
+def intentMsg(file: String): String =
+  Str.concat(file, ":1:1: error: leftover *.scuzz_intent; rename to *.scuzz_verify or delete the file")
+
+def isBlank(s: String): Bool =
+  isBlankAt(s, 0)
+
+def isBlankAt(s: String, i: Int): Bool =
+  if (i >= Str.len(s)) true else if (isWs(Str.charAt(s, i))) isBlankAt(s, i + 1) else false
+
+def isWs(c: Int): Bool =
+  c == 32 || c == 9 || c == 10 || c == 13
+
+def firstTokOff(src: String): Int =
+  firstTokOffAt(src, 0)
+
+def firstTokOffAt(src: String, i: Int): Int =
+  if (i >= Str.len(src)) 0 else if (isWs(Str.charAt(src, i))) firstTokOffAt(src, i + 1) else i
+
+def atLoc(file: String, src: String, off: Int, msg: String): String =
+  atLoc2(file, Check.locOf(src, off), msg)
+
+def atLoc2(file: String, loc: (Int, Int, Int, Int), msg: String): String =
+  loc match {
+    case (line, col, _, _) => Str.concat(file, Str.concat(":", Str.concat(Str.fromInt(line), Str.concat(":", Str.concat(Str.fromInt(col), Str.concat(": error: ", msg))))))
+  }
+
+def fmtMsg(file: String): String =
+  Str.concat(file, ":1:1: error: needs formatting (run scuzz fmt)")
+
+def leftoverMsg(file: String, src: String): String =
+  atLoc(file, src, firstTokOff(src), "leftover tokens after parse")
+
 def checkVerify(src: String, file: String): String =
-  if (List.isEmpty(parseVerify(src)) && List.isEmpty(parseClaims(src))) emptyVerify(file) else "scuzz check ok"
+  checkVerifyEns(src, file, noEn())
+
+def checkVerifyEns(src: String, file: String, ens: List[En]): String =
+  if (isBlank(src)) emptyVerify(file) else checkVerifyProg(src, file, ens, Parse.parse(Lexer.lex(src)))
+
+def checkVerifyProg(src: String, file: String, ens: List[En], p: Prog): String =
+  if (List.isEmpty(p.defs) && p.main == "") leftoverMsg(file, src) else checkVerifyShape(src, file, ens, p)
+
+def checkVerifyShape(src: String, file: String, ens: List[En], p: Prog): String =
+  if (p.main != "") Str.concat(file, ":1:1: error: verify file must not define @main") else if (!List.isEmpty(p.enums)) Str.concat(file, ":1:1: error: verify file must not define enums") else if (!List.isEmpty(p.aliases)) Str.concat(file, ":1:1: error: verify file must not define aliases") else if (!List.isEmpty(p.traits)) Str.concat(file, ":1:1: error: verify file must not define traits") else if (!List.isEmpty(p.impls)) Str.concat(file, ":1:1: error: verify file must not define impls") else if (!List.isEmpty(p.imps)) Str.concat(file, ":1:1: error: verify file must not define imports") else checkVerifyBody(src, file, ens, p)
+
+def checkVerifyBody(src: String, file: String, ens: List[En], p: Prog): String =
+  if (defsHaveForbid(p.defs) || exprHasForbid(p.body)) Str.concat(file, ":1:1: error: verify bodies must not call Property.* or .require") else checkVerifyDefs(src, file, ens, p)
+
+def checkVerifyDefs(src: String, file: String, ens: List[En], p: Prog): String =
+  checkVerifyDefsGo(src, file, ens, p, p.defs)
+
+def checkVerifyDefsGo(src: String, file: String, ens: List[En], p: Prog, ds: List[Fun]): String =
+  if (List.isEmpty(ds)) checkVerifyEmpty(src, file, ens, p) else checkVerifyDefHit(src, file, ens, p, List.at(ds, 0), List.tail(ds))
+
+def checkVerifyDefHit(src: String, file: String, ens: List[En], p: Prog, d: Fun, rest: List[Fun]): String =
+  if (d.priv) checkVerifyDefsGo(src, file, ens, p, rest) else if (isDrive(d, ens)) checkVerifyDefsGo(src, file, ens, p, rest) else if (isClaim(d)) checkVerifyDefsGo(src, file, ens, p, rest) else defFail(d, file, src)
+
+def defFail(d: Fun, file: String, src: String): String =
+  if (d.ret == "Bool") atLoc(file, src, d.off, Str.concat("drive ", Str.concat(d.name, " params must be generator-friendly (at most 3; ADT or List only as the sole param)"))) else if (d.ret == "Verdict") atLoc(file, src, d.off, Str.concat("claim ", Str.concat(d.name, " must take 1 or 2 Timeline params"))) else atLoc(file, src, d.off, Str.concat("public def ", Str.concat(d.name, " is not a drive oracle or a Timeline => Verdict claim")))
+
+def checkVerifyEmpty(src: String, file: String, ens: List[En], p: Prog): String =
+  if (List.isEmpty(drives(p.defs, ens)) && List.isEmpty(claims(p.defs))) emptyVerify(file) else checkVerifyFmt(src, file, p)
+
+def checkVerifyFmt(src: String, file: String, p: Prog): String =
+  if (Parse.pretty(p) == src) "scuzz check ok" else fmtMsg(file)
+
+def defsHaveForbid(ds: List[Fun]): Bool =
+  if (List.isEmpty(ds)) false else funHasForbid(List.at(ds, 0)) || defsHaveForbid(List.tail(ds))
+
+def funHasForbid(d: Fun): Bool =
+  d match {
+    case Fun(_, _, _, _, _, body, _, _) => exprHasForbid(body)
+  }
+
+def exprHasForbid(e: Expr): Bool =
+  e match {
+    case Expr.EPrint(inner, _) => exprHasForbid(inner)
+    case Expr.ECall(f, args, _) => Str.startsWith(f, "Property.") || listHasForbid(args)
+    case Expr.EMethod(recv, name, args, _) => name == "require" || exprHasForbid(recv) || listHasForbid(args)
+    case Expr.EField(recv, _, _) => exprHasForbid(recv)
+    case Expr.EBin(_, l, r, _) => exprHasForbid(l) || exprHasForbid(r)
+    case Expr.EUn(_, inner, _) => exprHasForbid(inner)
+    case Expr.ELam(_, _, body) => exprHasForbid(body)
+    case Expr.EIf(c, t, el, _) => exprHasForbid(c) || exprHasForbid(t) || exprHasForbid(el)
+    case Expr.EMatch(s, arms, _) => exprHasForbid(s) || armsHaveForbid(arms)
+    case Expr.EList(xs) => listHasForbid(xs)
+    case Expr.ETuple(xs) => listHasForbid(xs)
+    case Expr.ENamed(_, inner) => exprHasForbid(inner)
+    case Expr.EAscribe(inner, _, _) => exprHasForbid(inner)
+    case Expr.EFor(bs, body, _) => bindsHaveForbid(bs) || exprHasForbid(body)
+    case _ => false
+  }
+
+def listHasForbid(xs: List[Expr]): Bool =
+  if (List.isEmpty(xs)) false else exprHasForbid(List.at(xs, 0)) || listHasForbid(List.tail(xs))
+
+def armsHaveForbid(xs: List[Arm]): Bool =
+  if (List.isEmpty(xs)) false else armHasForbid(List.at(xs, 0)) || armsHaveForbid(List.tail(xs))
+
+def armHasForbid(a: Arm): Bool =
+  a match {
+    case Arm(_, _, body) => exprHasForbid(body)
+  }
+
+def bindsHaveForbid(xs: List[Bind]): Bool =
+  if (List.isEmpty(xs)) false else bindHasForbid(List.at(xs, 0)) || bindsHaveForbid(List.tail(xs))
+
+def bindHasForbid(b: Bind): Bool =
+  b match {
+    case Bind(_, _, e) => exprHasForbid(e)
+  }
 
 def testOut(checkOk: Bool): String =
   if (!checkOk) "scuzz test fail" else Str.concat("project compile smoke ok", Str.concat(nl(), Str.concat("IO smoke ok", Str.concat(nl(), "scuzz test ok"))))
diff --git a/examples/counter/count.scuzz_verify b/examples/counter/count.scuzz_verify
index 35113bc4..9bf4f95f 100644
--- a/examples/counter/count.scuzz_verify
+++ b/examples/counter/count.scuzz_verify
@@ -15,3 +15,4 @@ def countStaysNonNeg(t: Timeline): Verdict =
 
 def countMatchesAcrossSchedules(a: Timeline, b: Timeline): Verdict =
   if (Timeline.signalInt(a, Timeline.len(a) - 1, "count") == Timeline.signalInt(b, Timeline.len(b) - 1, "count")) Verdict.ok() else Verdict.fail(0, "final count differs across schedules")
+
diff --git a/examples/editor/chrome.scuzz_verify b/examples/editor/chrome.scuzz_verify
index 785cde1f..f482fae6 100644
--- a/examples/editor/chrome.scuzz_verify
+++ b/examples/editor/chrome.scuzz_verify
@@ -9,3 +9,4 @@ def afterCheckShowsDiag(t: Timeline): Verdict =
 
 def afterCompleteShowsItem(t: Timeline): Verdict =
   Verdict.afterHit(t, "button:Complete", "button:foo")
+
diff --git a/examples/editor/goldens/editor.dump b/examples/editor/goldens/editor.dump
index 72fbec03..7b9dbef4 100644
--- a/examples/editor/goldens/editor.dump
+++ b/examples/editor/goldens/editor.dump
@@ -1,20 +1,12 @@
 [signals]
-str[0] buf = "hello
-world
-"
-str[1] orig = "hello
-world
-"
+str[0] buf = "hello\nworld\n"
+str[1] orig = "hello\nworld\n"
 str[2] pathSig = "sample.txt"
 str[3] dirSig = "."
 int[4] dirty = 0
 list[5] paths = ["sample.txt"]
-list[6] bodies = ["hello
-world
-"]
-list[7] origs = ["hello
-world
-"]
+list[6] bodies = ["hello\nworld\n"]
+list[7] origs = ["hello\nworld\n"]
 int[8] idx = 0
 list[9] diags = []
 int[10] showDiags = 0
diff --git a/examples/editor/goldens/editor_after_tap.dump b/examples/editor/goldens/editor_after_tap.dump
index 41c281b5..c1198cba 100644
--- a/examples/editor/goldens/editor_after_tap.dump
+++ b/examples/editor/goldens/editor_after_tap.dump
@@ -1,20 +1,12 @@
 [signals]
-str[0] buf = "hello
-world
-"
-str[1] orig = "hello
-world
-"
+str[0] buf = "hello\nworld\n"
+str[1] orig = "hello\nworld\n"
 str[2] pathSig = "sample.txt"
 str[3] dirSig = "."
 int[4] dirty = 0
 list[5] paths = ["sample.txt"]
-list[6] bodies = ["hello
-world
-"]
-list[7] origs = ["hello
-world
-"]
+list[6] bodies = ["hello\nworld\n"]
+list[7] origs = ["hello\nworld\n"]
 int[8] idx = 0
 list[9] diags = []
 int[10] showDiags = 0
diff --git a/examples/editor/scuzz.toml b/examples/editor/scuzz.toml
index e08ebf74..ac1bbb49 100644
--- a/examples/editor/scuzz.toml
+++ b/examples/editor/scuzz.toml
@@ -4,7 +4,7 @@ version = "0.1.0"
 description = "Open a path from Sys.args, edit in View.editor, check JSON, save tabs"
 
 [ui]
-default_runtime = "headless"
+default_runtime = "desktop"
 headless_size = [960, 560]
 headless_scale = 1.0
 tap_button = 3
diff --git a/examples/editor/src/Lsp.scuzz b/examples/editor/src/Lsp.scuzz
index b6242996..9022e814 100644
--- a/examples/editor/src/Lsp.scuzz
+++ b/examples/editor/src/Lsp.scuzz
@@ -107,7 +107,7 @@ def formatText(j: Json, fallback: String): String =
   }
 
 def renameText(j: Json, fallback: String): String =
-  Check.jsonStr(Check.jsonField(Check.jsonField(j, "result"), "newText")) match {
+  firstNewText(Check.jsonField(Check.jsonField(j, "result"), "changes")) match {
     case t => if (Str.isEmpty(t)) fallback else t
   }
 
diff --git a/examples/editor/src/Lsp.scuzz_sim b/examples/editor/src/Lsp.scuzz_sim
index b8b007cc..c0de3c45 100644
--- a/examples/editor/src/Lsp.scuzz_sim
+++ b/examples/editor/src/Lsp.scuzz_sim
@@ -4,7 +4,7 @@ def lspCall(_root: String, _path: String, _body: String, method: String): IO[Jso
   case "textDocument/completion" => "{\"result\":{\"items\":[{\"label\":\"foo\"}]}}"
   case "textDocument/definition" => "{\"result\":[{\"uri\":\"\",\"range\":{\"start\":{\"line\":0,\"character\":0}}}]}"
   case "textDocument/formatting" => "{\"result\":[]}"
-  case "textDocument/rename" => "{\"result\":{\"newText\":\"\"}}"
+  case "textDocument/rename" => "{\"result\":{\"changes\":{\"file://x\":[{\"newText\":\"\"}]}}}"
   case "textDocument/codeAction" => "{\"result\":[{\"title\":\"fix\",\"edit\":{\"changes\":{\"file://x\":[{\"newText\":\"fixed\"}]}}}]}"
   case "textDocument/semanticTokens/full" => "{\"result\":{\"data\":[0,0,5,8,0]}}"
   case "textDocument/inlayHint" => "{\"result\":[{\"position\":{\"line\":0,\"character\":5},\"label\":\"Int\"}]}"
diff --git a/examples/editor/src/Main.scuzz b/examples/editor/src/Main.scuzz
index 28284c4b..7ea30b94 100644
--- a/examples/editor/src/Main.scuzz
+++ b/examples/editor/src/Main.scuzz
@@ -100,6 +100,7 @@ bc""", 3)._1 == 1, true)
     _ = Property.check("ms", Lsp.msgSlice("aabbcc", Str.len("aa"), Str.len("bb")) == "bb", true)
     _ = Property.check("idm", Check.jsonInt(Check.jsonField(Lsp.takeIfMatch(Lsp.parseJson("{\"id\":2}"), Str.len("xy")), "id")) == Str.len("xy"), true)
     _ = Property.check("fix", Lsp.fixText(Lsp.parseJson("{\"result\":[{\"title\":\"fix\",\"edit\":{\"changes\":{\"u\":[{\"newText\":\"fixed\"}]}}}]}"), "x") == "fixed", true)
+    _ = Property.check("rename", Lsp.renameText(Lsp.parseJson("{\"result\":{\"changes\":{\"u\":[{\"newText\":\"renamed\"}]}}}"), "x") == "renamed", true)
     _ = Property.check("duri", Lsp.defUri(Lsp.parseJson("{\"result\":[{\"uri\":\"file://x\",\"range\":{\"start\":{\"line\":0,\"character\":0}}}]}")) == "file://x", true)
     _ = Property.check("dobj", Lsp.defUri(Lsp.parseJson("{\"result\":{\"uri\":\"u\"}}")) == "u", true)
     _ <- Ui.setTitle(Fs.basename(file))
diff --git a/examples/fmt/fmt.scuzz_verify b/examples/fmt/fmt.scuzz_verify
index d2c0ae1d..a703ef4d 100644
--- a/examples/fmt/fmt.scuzz_verify
+++ b/examples/fmt/fmt.scuzz_verify
@@ -17,7 +17,7 @@ def fmtOpt(): Bool =
   Main.fmtDiff(Main.srcOpt(), Main.wantOpt())
 
 def fmtFor(): Bool =
-  Main.fmtDiff(Main.srcFor(), Main.wantFor())
+  Main.fmtDiff(Main.srcFor(), Main.wantFor()) && Main.fmtDiff(Main.srcForIf(), Main.wantForIf()) && Main.fmtIdem(Main.srcForIf())
 
 def fmtIf(): Bool =
   Main.fmtDiff(Main.srcIf(), Main.wantIf())
@@ -56,7 +56,7 @@ def fmtTriple(): Bool =
   Main.fmtDiff(Main.srcTriple(), Main.wantTriple())
 
 def fmtCons(): Bool =
-  Main.fmtDiff(Main.srcCons(), Main.wantCons())
+  Main.fmtDiff(Main.srcCons(), Main.wantCons()) && Main.fmtDiff(Main.srcConsL(), Main.wantConsL()) && Main.fmtIdem(Main.srcConsL()) && Main.fmtDiff(Main.srcConsEq(), Main.wantConsEq()) && Main.fmtIdem(Main.srcConsEq()) && Main.fmtDiff(Main.srcConsMul(), Main.wantConsMul()) && Main.fmtIdem(Main.srcConsMul())
 
 def fmtGuard(): Bool =
   Main.fmtDiff(Main.srcGuard(), Main.wantGuard())
@@ -80,7 +80,7 @@ def fmtBits(): Bool =
   Main.fmtDiff(Main.srcBits(), Main.wantBits())
 
 def fmtHex(): Bool =
-  Main.fmtDiff(Main.srcHex(), Main.wantHex())
+  Main.fmtDiff(Main.srcHex(), Main.wantHex()) && Main.fmtDiff(Main.srcAsc(), Main.wantAsc()) && Main.fmtDiff(Main.srcLamTy(), Main.wantLamTy()) && Main.format(Main.srcBinBad()) != Main.wantBinWrong()
 
 def fmtIdemHi(): Bool =
   Main.fmtIdem(Main.srcHi())
diff --git a/examples/fmt/src/Main.scuzz b/examples/fmt/src/Main.scuzz
index f74e6535..87369093 100644
--- a/examples/fmt/src/Main.scuzz
+++ b/examples/fmt/src/Main.scuzz
@@ -233,6 +233,30 @@ def srcCons2(): String =
 def wantCons2(): String =
   "def cons(a: Int, b: Int, xs: List[Int]): List[Int] =\n  (a == b) :: xs\n\n@main def main: IO[Unit] =\n  IO.println(\"x\")\n"
 
+def srcConsL(): String =
+  "def nest(xs: List[Int], ys: List[Int], zs: List[Int]): List[Int] = (xs :: ys) :: zs\n@main def main: IO[Unit] = IO.println(\"x\")"
+
+def wantConsL(): String =
+  "def nest(xs: List[Int], ys: List[Int], zs: List[Int]): List[Int] =\n  (xs :: ys) :: zs\n\n@main def main: IO[Unit] =\n  IO.println(\"x\")\n"
+
+def srcConsEq(): String =
+  "def cons(a: Bool, b: Bool): List[Bool] = true :: (a == b)\n@main def main: IO[Unit] = IO.println(\"x\")"
+
+def wantConsEq(): String =
+  "def cons(a: Bool, b: Bool): List[Bool] =\n  true :: (a == b)\n\n@main def main: IO[Unit] =\n  IO.println(\"x\")\n"
+
+def srcConsMul(): String =
+  "def wrap(n: Int, xs: List[Int]): List[Int] = n * (1 :: xs)\n@main def main: IO[Unit] = IO.println(\"x\")"
+
+def wantConsMul(): String =
+  "def wrap(n: Int, xs: List[Int]): List[Int] =\n  n * (1 :: xs)\n\n@main def main: IO[Unit] =\n  IO.println(\"x\")\n"
+
+def srcForIf(): String =
+  "def go(e: IO[Int], pred: Bool): IO[Int] = for { x <- e\n    if pred\n  } yield x\n@main def main: IO[Unit] = IO.println(\"x\")"
+
+def wantForIf(): String =
+  "def go(e: IO[Int], pred: Bool): IO[Int] =\n  for {\n    x <- e\n    if pred\n  } yield x\n\n@main def main: IO[Unit] =\n  IO.println(\"x\")\n"
+
 def srcNamed(): String =
   """def add(n: Int, m: Int): Int = n + m
 @main def main: IO[Unit] = IO.println(Str.fromInt(add(m = 2, n = 1)))"""
@@ -314,8 +338,28 @@ def wantIfOp(): String =
   IO.println(Str.fromInt((if (1 < 2) 3 else 4) / 2))
 """
 
+def srcAsc(): String =
+  "def n(): Int = 1: Int\n@main def main: IO[Unit] = IO.println(\"x\")"
+
+def wantAsc(): String =
+  "def n(): Int =\n  1: Int\n\n@main def main: IO[Unit] =\n  IO.println(\"x\")\n"
+
+def srcLamTy(): String =
+  "@main def main: IO[Unit] = IO.println(Str.fromInt(((n: Int) => n + 1)(3)))"
+
+def wantLamTy(): String =
+  """@main def main: IO[Unit] =
+  IO.println(Str.fromInt(((n: Int) => n + 1)(3)))
+"""
+
+def srcBinBad(): String =
+  "def n(): Int = 0b21\n@main def main: IO[Unit] = IO.println(\"x\")"
+
+def wantBinWrong(): String =
+  "def n(): Int =\n  1\n\n@main def main: IO[Unit] =\n  IO.println(\"x\")\n"
+
 def allOk(): Bool =
-  fmtDiff(srcHi(), wantHi()) && fmtIdem(srcHi()) && fmtDiff(srcPriv(), wantPriv()) && fmtIdem(srcPriv()) && fmtDiff(srcHello(), wantHello()) && fmtIdem(srcHello()) && fmtDiff(srcAdd(), wantAdd()) && fmtIdem(srcAdd()) && fmtDiff(srcEnum(), wantEnum()) && fmtIdem(srcEnum()) && fmtDiff(srcOpt(), wantOpt()) && fmtIdem(srcOpt()) && fmtDiff(srcFor(), wantFor()) && fmtIdem(srcFor()) && fmtDiff(srcIf(), wantIf()) && fmtIdem(srcIf()) && fmtDiff(srcRec(), wantRec()) && fmtIdem(srcRec()) && fmtDiff(srcType(), wantType()) && fmtIdem(srcType()) && fmtDiff(srcImp(), wantImp()) && fmtIdem(srcImp()) && fmtDiff(srcTrait(), wantTrait()) && fmtIdem(srcTrait()) && fmtDiff(srcWhere(), wantWhere()) && fmtIdem(srcWhere()) && fmtDiff(srcFloat(), wantFloat()) && fmtIdem(srcFloat()) && fmtDiff(srcList(), wantList()) && fmtIdem(srcList()) && fmtDiff(srcTup(), wantTup()) && fmtIdem(srcTup()) && fmtDiff(srcGet(), wantGet()) && fmtIdem(srcGet()) && fmtDiff(srcPkg(), wantPkg()) && fmtIdem(srcPkg()) && fmtDiff(srcTriple(), wantTriple()) && fmtIdem(srcTriple()) && fmtDiff(srcCons(), wantCons()) && fmtIdem(srcCons()) && fmtDiff(srcGuard(), wantGuard()) && fmtIdem(srcGuard()) && fmtDiff(srcDefArg(), wantDefArg()) && fmtIdem(srcDefArg()) && fmtDiff(srcTDef(), wantTDef()) && fmtIdem(srcTDef()) && fmtDiff(srcCons2(), wantCons2()) && fmtIdem(srcCons2()) && fmtDiff(srcNamed(), wantNamed()) && fmtIdem(srcNamed()) && fmtDiff(srcCopy(), wantCopy()) && fmtIdem(srcCopy()) && fmtDiff(srcOr(), wantOr()) && fmtIdem(srcOr()) && fmtDiff(srcOr2(), wantOr2()) && fmtIdem(srcOr2()) && fmtDiff(srcBits(), wantBits()) && fmtIdem(srcBits()) && fmtDiff(srcHex(), wantHex()) && fmtIdem(srcHex()) && fmtDiff(srcAs(), wantAs()) && fmtIdem(srcAs()) && fmtDiff(srcAnd(), wantAnd()) && fmtIdem(srcAnd()) && fmtDiff(srcUn(), wantUn()) && fmtIdem(srcUn()) && fmtDiff(srcIfOp(), wantIfOp()) && fmtIdem(srcIfOp())
+  fmtDiff(srcHi(), wantHi()) && fmtIdem(srcHi()) && fmtDiff(srcPriv(), wantPriv()) && fmtIdem(srcPriv()) && fmtDiff(srcHello(), wantHello()) && fmtIdem(srcHello()) && fmtDiff(srcAdd(), wantAdd()) && fmtIdem(srcAdd()) && fmtDiff(srcEnum(), wantEnum()) && fmtIdem(srcEnum()) && fmtDiff(srcOpt(), wantOpt()) && fmtIdem(srcOpt()) && fmtDiff(srcFor(), wantFor()) && fmtIdem(srcFor()) && fmtDiff(srcIf(), wantIf()) && fmtIdem(srcIf()) && fmtDiff(srcRec(), wantRec()) && fmtIdem(srcRec()) && fmtDiff(srcType(), wantType()) && fmtIdem(srcType()) && fmtDiff(srcImp(), wantImp()) && fmtIdem(srcImp()) && fmtDiff(srcTrait(), wantTrait()) && fmtIdem(srcTrait()) && fmtDiff(srcWhere(), wantWhere()) && fmtIdem(srcWhere()) && fmtDiff(srcFloat(), wantFloat()) && fmtIdem(srcFloat()) && fmtDiff(srcList(), wantList()) && fmtIdem(srcList()) && fmtDiff(srcTup(), wantTup()) && fmtIdem(srcTup()) && fmtDiff(srcGet(), wantGet()) && fmtIdem(srcGet()) && fmtDiff(srcPkg(), wantPkg()) && fmtIdem(srcPkg()) && fmtDiff(srcTriple(), wantTriple()) && fmtIdem(srcTriple()) && fmtDiff(srcCons(), wantCons()) && fmtIdem(srcCons()) && fmtDiff(srcGuard(), wantGuard()) && fmtIdem(srcGuard()) && fmtDiff(srcDefArg(), wantDefArg()) && fmtIdem(srcDefArg()) && fmtDiff(srcTDef(), wantTDef()) && fmtIdem(srcTDef()) && fmtDiff(srcCons2(), wantCons2()) && fmtIdem(srcCons2()) && fmtDiff(srcConsL(), wantConsL()) && fmtIdem(srcConsL()) && fmtDiff(srcConsEq(), wantConsEq()) && fmtIdem(srcConsEq()) && fmtDiff(srcConsMul(), wantConsMul()) && fmtIdem(srcConsMul()) && fmtDiff(srcForIf(), wantForIf()) && fmtIdem(srcForIf()) && fmtDiff(srcNamed(), wantNamed()) && fmtIdem(srcNamed()) && fmtDiff(srcCopy(), wantCopy()) && fmtIdem(srcCopy()) && fmtDiff(srcOr(), wantOr()) && fmtIdem(srcOr()) && fmtDiff(srcOr2(), wantOr2()) && fmtIdem(srcOr2()) && fmtDiff(srcBits(), wantBits()) && fmtIdem(srcBits()) && fmtDiff(srcHex(), wantHex()) && fmtIdem(srcHex()) && fmtDiff(srcAs(), wantAs()) && fmtIdem(srcAs()) && fmtDiff(srcAnd(), wantAnd()) && fmtIdem(srcAnd()) && fmtDiff(srcUn(), wantUn()) && fmtIdem(srcUn()) && fmtDiff(srcIfOp(), wantIfOp()) && fmtIdem(srcIfOp()) && fmtDiff(srcAsc(), wantAsc()) && fmtIdem(srcAsc()) && fmtDiff(srcLamTy(), wantLamTy()) && fmtIdem(srcLamTy()) && format(srcBinBad()) != wantBinWrong()
 
 @main def main: IO[Unit] =
   IO.println(if (allOk()) "fmt-ok" else "fmt-bad")
diff --git a/examples/io/net.scuzz_verify b/examples/io/net.scuzz_verify
index b1ec1fd9..657d7190 100644
--- a/examples/io/net.scuzz_verify
+++ b/examples/io/net.scuzz_verify
@@ -1,2 +1,3 @@
 def pingHitsNet(t: Timeline): Verdict =
   Verdict.any(t, i => Timeline.effectHas(t, i, "Net.httpPost"))
+
diff --git a/examples/io/src/Concurrency.scuzz b/examples/io/src/Concurrency.scuzz
index 187084b9..6f18bf39 100644
--- a/examples/io/src/Concurrency.scuzz
+++ b/examples/io/src/Concurrency.scuzz
@@ -49,6 +49,9 @@ def run(): IO[Unit] =
     _ <- Deferred.complete(id, 8)
     g <- Deferred.get(id)
     _ <- IO.println(s"defN:${Str.fromInt(g)}")
+    fd <- Deferred.empty()
+    _ <- Deferred.fail(fd, "boom")
+    _ <- Deferred.get(fd).handleErrorWith(_ => IO.println("defFail:boom"))
     nf <- Fiber.fork(IO.pure(9))
     nj <- Fiber.join(nf)
     _ <- IO.println(s"forkN:${Str.fromInt(nj)}")
diff --git a/examples/io/src/Query.scuzz b/examples/io/src/Query.scuzz
index e290f879..718c2d1a 100644
--- a/examples/io/src/Query.scuzz
+++ b/examples/io/src/Query.scuzz
@@ -68,6 +68,8 @@ private def objKitOk(j: Json): IO[Unit] =
     _ <- printHas(j, "missing")
     _ <- printStr(j, "s")
     _ <- printBool(j, "ok")
+    _ <- IO.println(Str.concat("isBool:", if (Json.isBool(j)) "1" else "0"))
+    _ <- IO.println(if (Json.getFloat(j, "x", 0.0) > 1.0) "getFloat:pos" else "getFloat:z")
     _ <- printTags(j)
     _ <- printArr(j)
     got = Json.get(j, "xs")
@@ -86,7 +88,7 @@ private def objKitOk(j: Json): IO[Unit] =
   } yield ()
 
 private def objKit(): IO[Unit] =
-  Json.parse("{\"n\":1,\"ok\":true,\"s\":\"hi\",\"xs\":[2,3]}") match {
+  Json.parse("{\"n\":1,\"ok\":true,\"s\":\"hi\",\"x\":1.5,\"xs\":[2,3]}") match {
     case Result.Err(_) => IO.println("query:err")
     case Result.Ok(j) => objKitOk(j)
   }
@@ -107,13 +109,22 @@ private def missKit(): IO[Unit] =
     _ <- printAt(Json.Null(), 0)
     _ <- printHas(Json.Null(), "a")
     _ <- IO.println(Str.concat("asInt:", Str.fromInt(List.len(Json.asInt(Json.Null())))))
+    _ <- IO.println(Str.concat("asFloat:", Str.fromInt(List.len(Json.asFloat(Json.Float(1.5))))))
+    _ <- IO.println(Str.concat("asFloatMiss:", Str.fromInt(List.len(Json.asFloat(Json.Null())))))
   } yield ()
 
+private def parseErr(): IO[Unit] =
+  Json.parse("{") match {
+    case Result.Err(_) => IO.println("parse:err")
+    case Result.Ok(_) => IO.println("parse:ok")
+  }
+
 def run(): IO[Unit] =
   for {
     _ <- objKit()
     _ <- mergeKit()
     _ <- missKit()
+    _ <- parseErr()
     _ <- printArrWrite()
   } yield ()
 
diff --git a/examples/kernel/add.scuzz_verify b/examples/kernel/add.scuzz_verify
index 2ddae870..d38426b9 100644
--- a/examples/kernel/add.scuzz_verify
+++ b/examples/kernel/add.scuzz_verify
@@ -15,3 +15,37 @@ def termDiff(t: Term): Bool =
 
 def utf8Ops(): Bool =
   Main.utf8Check() == 1
+
+def mixedDefault(): Bool =
+  Main.addDefault(3, m = 4) == 7
+
+def mixedGreet(): Bool =
+  Main.greet("hi", punct = "?") == "hi?"
+
+def tupFive(): Bool =
+  (1, 2, 3, 4, 5)._5 == 5
+
+def tupEight(): Bool =
+  (1, 2, 3, 4, 5, 6, 7, 8)._8 == 8
+
+def tupCall(): Bool =
+  Main.rot3((1, "x", true))._1 == "x"
+
+def smapN(): Bool =
+  Main.mapSetSizeOk()
+
+def smapHas(): Bool =
+  Main.mapSetHasOk()
+
+def smapEq(): Bool =
+  Main.mapSetEqOk()
+
+def scollapse(): Bool =
+  Main.mapSetCollapseOk()
+
+def tosetVar(): Bool =
+  Main.toSetFromVarOk()
+
+def mapEmptyGet(): Bool =
+  Main.mapGetEmptyOk()
+
diff --git a/examples/kernel/src/Main.scuzz b/examples/kernel/src/Main.scuzz
index f3bfceb6..ea97ac6f 100644
--- a/examples/kernel/src/Main.scuzz
+++ b/examples/kernel/src/Main.scuzz
@@ -289,6 +289,36 @@ def scale(x: Float): Float =
 def trunc(x: Float): Int =
   Float.toInt(x)
 
+def bangKeys(): Set =
+  Set.map(Set.add(Set.add(Set.empty(), "x"), "y"), x => Str.concat(x, "!"))
+
+def mapSetSizeOk(): Bool =
+  Set.size(bangKeys()) == 2
+
+def mapSetHasOk(): Bool =
+  Set.contains(bangKeys(), "x!") && Set.contains(bangKeys(), "y!")
+
+def mapSetEqOk(): Bool =
+  bangKeys() == Set.add(Set.add(Set.empty(), "x!"), "y!")
+
+def mapSetCollapseOk(): Bool =
+  Set.size(Set.map(List.toSet(["aa", "ab"]), s => Str.take(s, 1))) == 1
+
+def dupInts(): List[Int] =
+  [2, 1, 2]
+
+def toSetFacts(s: Set): Bool =
+  Set.size(s) == 2 && Set.contains(s, 1) && Set.contains(s, 2) && s == List.toSet([1, 2])
+
+def toSetFromVarOk(): Bool =
+  toSetFacts(List.toSet(dupInts()))
+
+def mapGetEmptyOk(): Bool =
+  mapGetEmptyAt(Map.set(Map.empty(), "e", []: List[String]))
+
+def mapGetEmptyAt(m: Map): Bool =
+  Map.contains(m, "e") && Map.get(m, "e") == Option.Some([]: List[String]) && Map.get(m, "z") == (Option.None: Option[List[String]])
+
 def mapSetProof(): IO[Unit] =
   for {
     mp = Map.set(Map.set(Map.empty(), "a", "1"), "b", "2")
@@ -310,8 +340,12 @@ def mapSetProof(): IO[Unit] =
     _ <- IO.println(s"sempty:${if (Set.isEmpty(Set.empty())) "y" else "n"}")
     _ <- IO.println(s"mne:${if (Map.nonEmpty(mp)) "y" else "n"}")
     _ <- IO.println(s"sne:${if (Set.nonEmpty(st)) "y" else "n"}")
-    _ <- IO.println(s"mget:${List.join(Map.get(mp, "a"), ",")}")
-    _ <- IO.println(s"mmiss:${List.join(Map.get(mp, "z"), ",")}")
+    _ <- IO.println(s"mget:${optStr(Map.get(mp, "a"))}")
+    _ <- IO.println(s"mmiss:${optStr(Map.get(mp, "z"))}")
+    empty = Map.set(Map.empty(), "e", []: List[String])
+    _ <- IO.println(s"ehas:${if (Map.contains(empty, "e")) "y" else "n"}")
+    _ <- IO.println(s"eget:${if (Map.get(empty, "e") == Option.Some([]: List[String])) "Some([])" else "?"}")
+    _ <- IO.println(s"emiss:${if (Map.get(empty, "z") == (Option.None: Option[List[String]])) "None" else "?"}")
     _ <- IO.println(s"union:${List.join(Set.toList(Set.union(st, Set.add(Set.empty(), "z"))), ",")}")
     _ <- IO.println(s"isect:${List.join(Set.toList(Set.intersect(st, Set.add(Set.add(Set.empty(), "y"), "z"))), ",")}")
     _ <- IO.println(s"sdiff:${List.join(Set.toList(Set.diff(st, Set.add(Set.add(Set.empty(), "y"), "z"))), ",")}")
@@ -327,6 +361,11 @@ def mapSetProof(): IO[Unit] =
     _ <- IO.println(s"mfa:${if (Map.forall(mp, v => v != "z")) "y" else "n"}")
     _ <- IO.println(s"sfil:${List.join(Set.toList(Set.filter(st, x => x != "y")), ",")}")
     _ <- IO.println(s"smap:${List.join(Set.toList(Set.map(st, x => Str.concat(x, "!"))), ",")}")
+    mapped = Set.map(st, x => Str.concat(x, "!"))
+    _ <- IO.println(s"smapN:${Set.size(mapped)}")
+    _ <- IO.println(s"smapHas:${if (Set.contains(mapped, "x!") && Set.contains(mapped, "y!")) "y" else "n"}")
+    _ <- IO.println(s"smapEq:${if (mapped == Set.add(Set.add(Set.empty(), "x!"), "y!")) "y" else "n"}")
+    _ <- IO.println(s"scollapse:${Set.size(Set.map(List.toSet(["aa", "ab"]), s => Str.take(s, 1)))}")
     _ <- IO.println(s"sex:${if (Set.exists(st, x => x == "x")) "y" else "n"}")
     _ <- IO.println(s"sfa:${if (Set.forall(st, x => x != "z")) "y" else "n"}")
     _ <- IO.println(s"tolist:${List.join(List.map(Map.toList(mp), (k, v) => s"$k:$v"), "|")}")
@@ -471,6 +510,11 @@ def listProof(): IO[Unit] =
     _ <- IO.println(s"tomap0:${Map.size(List.toMap([]: List[(String, Int)]))}")
     _ <- IO.println(s"toset:${List.join(Set.toList(List.toSet(["b", "a", "b"])), ",")}")
     _ <- IO.println(s"tosetN:${List.join(List.map(Set.toList(List.toSet([2, 1, 2])), Str.fromInt(_)), ",")}")
+    nums = [2, 1, 2]
+    numSet = List.toSet(nums)
+    _ <- IO.println(s"tosetVar:${Set.size(numSet)}")
+    _ <- IO.println(s"tosetHas:${if (Set.contains(numSet, 1) && Set.contains(numSet, 2)) "y" else "n"}")
+    _ <- IO.println(s"tosetEq:${if (numSet == List.toSet([1, 2])) "y" else "n"}")
     _ <- IO.println(s"ldiff:${List.join(List.diff(xs, ["a", "z"]), ",")}")
     _ <- IO.println(s"lisect:${List.join(List.intersect(xs, ["a", "z"]), ",")}")
     _ <- IO.println(s"nhas:${if (List.contains(List.range(1, 4), 2)) "y" else "n"}")
@@ -480,7 +524,10 @@ def listProof(): IO[Unit] =
     _ <- IO.println(s"defat:${if (List.isDefinedAt(xs, 1)) "y" else "n"}")
     _ <- IO.println(s"lcmp:${Str.fromInt(List.lengthCompare(xs, 3))}")
     _ <- IO.println(s"sort:${List.join(List.sort(["c", "a", "b"]), ",")}")
+    nsort = [3, 1, 2]
     _ <- IO.println(s"sortn:${List.join(List.map(List.sort([3, 1, 2]), n => Str.fromInt(n)), ",")}")
+    _ <- IO.println(s"sortb:${List.join(List.map(List.sort(nsort), n => Str.fromInt(n)), ",")}")
+    _ <- IO.println(s"sortr:${List.join(List.map(List.sort(List.range(1, 4)), n => Str.fromInt(n)), ",")}")
     _ <- IO.println(s"sortBy:${List.join(List.sortBy(["bb", "a", "ccc"], x => Str.len(x)), ",")}")
     _ <- IO.println(s"max:${List.max(["a", "c", "b"])}")
     _ <- IO.println(s"min:${List.min(["a", "c", "b"])}")
@@ -608,7 +655,7 @@ def choose(ok: Bool): IO[Int] =
 def positive(n: Int): IO[Int] =
   for {
     x <- IO.pure(n)
-    __guard = x > 0
+    if x > 0
   } yield x
 
 def failProof(): IO[Unit] =
@@ -656,6 +703,9 @@ def tupleProof(): IO[Unit] =
     _ <- IO.println(s"tri:${if (tok) "y" else "n"}")
     _ <- IO.println(s"rot:${r3._1}")
     _ <- IO.println(s"rot:${Str.fromInt(r3._3)}")
+    _ <- IO.println(Str.concat("t5:", Str.fromInt((1, 2, 3, 4, 5)._5)))
+    _ <- IO.println(Str.concat("t8:", Str.fromInt((1, 2, 3, 4, 5, 6, 7, 8)._8)))
+    _ <- IO.println(Str.concat("tcall:", rot3((1, "x", true))._1))
   } yield ()
 
 def eqProof(): IO[Unit] =
@@ -691,7 +741,7 @@ def get(): T =
   self.x
 
 def utf8Check(): Int =
-  if (Str.len("aéz日") == 4 && Str.byteLen("aéz日") == 7 && Str.charAt("aéz日", 1) == 233 && Str.charAt("aéz日", 3) == 26085 && Str.eq(Str.slice("aéz日", 2, 3), "z") && Str.eq(Str.reverse("aéz日"), "日zéa") && Str.eq(Str.take("aéz日", 2), "aé") && Str.eq(Str.drop("aéz日", 3), "日") && Str.eq(Str.takeRight("aéz日", 2), "z日") && Str.eq(Str.dropRight("aéz日", 2), "aé") && Str.indexOf("aéz日", "z") == 2 && Str.lastIndexOf("aéz日", "日") == 3) 1 else 0
+  if (Str.len("aéz日") == 4 && Str.byteLen("aéz日") == 7 && Str.charAt("aéz日", 1) == 233 && Str.charAt("aéz日", 3) == 26085 && Str.eq(Str.slice("aéz日", 2, 3), "z") && Str.eq(Str.reverse("aéz日"), "日zéa") && Str.eq(Str.take("aéz日", 2), "aé") && Str.eq(Str.drop("aéz日", 3), "日") && Str.eq(Str.takeRight("aéz日", 2), "z日") && Str.eq(Str.dropRight("aéz日", 2), "aé") && Str.indexOf("aéz日", "z") == 2 && Str.lastIndexOf("aéz日", "日") == 3 && Str.len(Str.byteSlice("é", 1, 2)) == 1 && Str.charAt(Str.byteSlice("é", 1, 2), 0) == 169 && Str.eq(Str.padLeft("é", 3, "x"), "xxé") && Str.eq(Str.fromBool(true), "true") && Str.eq(Str.fromBool(false), "false")) 1 else 0
 
 def utf8Proof(): IO[Unit] =
   IO.println(s"utf8:${Str.fromInt(utf8Check())}")
@@ -821,8 +871,10 @@ b"""
     _ <- IO.println(s"defarg:${addDefault(3)}")
     _ <- IO.println(s"defargN:${addDefault(n = 3)}")
     _ <- IO.println(s"defarg2:${addDefault(3, 4)}")
+    _ <- IO.println(s"defargM:${addDefault(3, m = 4)}")
     _ <- IO.println(s"greet:${greet("hi")}")
     _ <- IO.println(s"greetQ:${greet("hi", "?")}")
+    _ <- IO.println(s"greetP:${greet("hi", punct = "?")}")
     _ <- IO.println(s"copy:${sum(Point(3, 5).copy(y = 9))}")
     _ <- IO.println(s"copyPos:${sum(Point(3, 5).copy(1))}")
     _ <- IO.println(s"copyBox:${Str.fromInt(Box(4).copy(x = 5).get())}")
diff --git a/examples/studio/items.scuzz_verify b/examples/studio/items.scuzz_verify
index 563b8bce..7239a058 100644
--- a/examples/studio/items.scuzz_verify
+++ b/examples/studio/items.scuzz_verify
@@ -44,8 +44,8 @@ def renameRenames(t: Timeline): Verdict =
   Verdict.every(t, i => i == 0 || !Timeline.lastHitHas(t, i, "button:Rename") || Timeline.lastHitHas(t, i - 1, "button:Rename") || Timeline.signalListLen(t, i - 1, "items") == 0 || Timeline.a11yHas(t, i, "listtile:oat"))
 
 def addNeedsDraft(t: Timeline): Verdict =
-  Verdict.every(t, i => i == 0 || !Timeline.lastHitHas(t, i, "button:Add") || Timeline.lastHitHas(t, i - 1, "button:Add") || !Timeline.signalStrHas(t, i - 1, "draft", "= \"\"") || Timeline.signalListLen(t, i, "items") == Timeline.signalListLen(t, i - 1, "items"))
+  Verdict.every(t, i => i == 0 || !Timeline.lastHitHas(t, i, "button:Add") || Timeline.lastHitHas(t, i - 1, "button:Add") || !Timeline.signalStrHas(t, i - 1, "draft", "") || Timeline.signalListLen(t, i, "items") == Timeline.signalListLen(t, i - 1, "items"))
 
 def addGrowsWithDraft(t: Timeline): Verdict =
-  Verdict.every(t, i => i == 0 || !Timeline.lastHitHas(t, i, "button:Add") || Timeline.lastHitHas(t, i - 1, "button:Add") || Timeline.signalStrHas(t, i - 1, "draft", "= \"\"") || Timeline.signalListLen(t, i, "items") == Timeline.signalListLen(t, i - 1, "items") + 1)
+  Verdict.every(t, i => i == 0 || !Timeline.lastHitHas(t, i, "button:Add") || Timeline.lastHitHas(t, i - 1, "button:Add") || Timeline.signalStrHas(t, i - 1, "draft", "") || Timeline.signalListLen(t, i, "items") == Timeline.signalListLen(t, i - 1, "items") + 1)
 
diff --git a/examples/syntax/src/Lexer.scuzz b/examples/syntax/src/Lexer.scuzz
index 4a9c4a7d..3eb59ded 100644
--- a/examples/syntax/src/Lexer.scuzz
+++ b/examples/syntax/src/Lexer.scuzz
@@ -59,6 +59,7 @@ enum Tok:
   case Int(n: Int)
   case Float(s: String)
   case Interp(s: String)
+  case Bad
 
 record SpTok(tok: Tok, off: Int, stem: String)
 
@@ -127,6 +128,7 @@ def kind(t: Tok): Int =
     case Tok.Int(_) => 57
     case Tok.Float(_) => 58
     case Tok.Interp(_) => 59
+    case Tok.Bad => 60
   }
 
 def _ch(src: String, i: Int): Int =
@@ -173,9 +175,6 @@ def _skipIdent(src: String, i: Int): Int =
 def _skipDigits(src: String, i: Int): Int =
   if (_isDigit(_ch(src, i))) _skipDigits(src, i + 1) else i
 
-def _lineEnd(src: String, i: Int): Int =
-  if (i >= Str.len(src) || _ch(src, i) == 10) i else _lineEnd(src, i + 1)
-
 def _escStr(src: String, i: Int): String =
   _ch(src, i) match {
     case 110 => """
@@ -229,7 +228,7 @@ def _punct(c: Int): Tok =
     case 94 => Tok.Caret
     case 126 => Tok.Tilde
     case 95 => Tok.Underscore
-    case _ => Tok.Eof
+    case _ => Tok.Bad
   }
 
 def _two(src: String, i: Int, a: Int, b: Int): Bool =
@@ -242,25 +241,25 @@ def _hexVal(c: Int): Int =
   if (_isDigit(c)) c - 48 else if (c >= 97) c - 87 else c - 55
 
 def _lexInt(src: String, i: Int, stem: String, acc: List[SpTok]): List[SpTok] =
-  if (i + 1 < Str.len(src) && _ch(src, i) == 48 && _ch(src, i + 1) == 120 || _ch(src, i + 1) == 88) _lexHex(src, i + 2, 0, i, stem, acc) else if (i + 1 < Str.len(src) && _ch(src, i) == 48 && _ch(src, i + 1) == 98 || _ch(src, i + 1) == 66) _lexBin(src, i + 2, 0, i, stem, acc) else _lexDec(src, i, i, 0, stem, acc)
+  if (i + 1 < Str.len(src) && _ch(src, i) == 48 && (_ch(src, i + 1) == 120 || _ch(src, i + 1) == 88)) _lexHex(src, i + 2, 0, i, stem, acc) else if (i + 1 < Str.len(src) && _ch(src, i) == 48 && (_ch(src, i + 1) == 98 || _ch(src, i + 1) == 66)) _lexBin(src, i + 2, 0, i, stem, acc) else _lexDec(src, i, i, 0, stem, acc)
 
 def _lexHex(src: String, i: Int, n: Int, start: Int, stem: String, acc: List[SpTok]): List[SpTok] =
   if (i < Str.len(src) && _isHex(_ch(src, i))) _lexHex(src, i + 1, n * 16 + _hexVal(_ch(src, i)), start, stem, acc) else if (i < Str.len(src) && _ch(src, i) == 95 && i + 1 < Str.len(src) && _isHex(_ch(src, i + 1))) _lexHex(src, i + 1, n, start, stem, acc) else lexAt(src, i, stem, _put(Tok.Int(n), start, stem, acc))
 
 def _lexBin(src: String, i: Int, n: Int, start: Int, stem: String, acc: List[SpTok]): List[SpTok] =
-  if (i < Str.len(src) && _ch(src, i) == 48 || _ch(src, i) == 49) _lexBin(src, i + 1, n * 2 + _ch(src, i) - 48, start, stem, acc) else if (i < Str.len(src) && _ch(src, i) == 95 && i + 1 < Str.len(src) && _ch(src, i + 1) == 48 || _ch(src, i + 1) == 49) _lexBin(src, i + 1, n, start, stem, acc) else lexAt(src, i, stem, _put(Tok.Int(n), start, stem, acc))
+  if (i < Str.len(src) && (_ch(src, i) == 48 || _ch(src, i) == 49)) _lexBin(src, i + 1, n * 2 + _ch(src, i) - 48, start, stem, acc) else if (i < Str.len(src) && _ch(src, i) == 95 && i + 1 < Str.len(src) && (_ch(src, i + 1) == 48 || _ch(src, i + 1) == 49)) _lexBin(src, i + 1, n, start, stem, acc) else lexAt(src, i, stem, _put(Tok.Int(n), start, stem, acc))
 
 def _lexDec(src: String, start: Int, i: Int, n: Int, stem: String, acc: List[SpTok]): List[SpTok] =
   if (i < Str.len(src) && _isDigit(_ch(src, i))) _lexDec(src, start, i + 1, n * 10 + _ch(src, i) - 48, stem, acc) else if (i < Str.len(src) && _ch(src, i) == 95 && i + 1 < Str.len(src) && _isDigit(_ch(src, i + 1))) _lexDec(src, start, i + 1, n, stem, acc) else _lexNumFracVal(src, start, i, n, stem, acc)
 
 def _lexNumFracVal(src: String, start: Int, j: Int, n: Int, stem: String, acc: List[SpTok]): List[SpTok] =
-  if (j < Str.len(src) && _ch(src, j) == 46 && j + 1 < Str.len(src) && _isDigit(_ch(src, j + 1))) _lexNumExp(src, start, _skipDigits(src, j + 1), true, stem, acc) else if (j < Str.len(src) && _ch(src, j) == 101 || _ch(src, j) == 69) _lexNumExp2(src, start, j, stem, acc) else lexAt(src, j, stem, _put(Tok.Int(n), start, stem, acc))
+  if (j < Str.len(src) && _ch(src, j) == 46 && j + 1 < Str.len(src) && _isDigit(_ch(src, j + 1))) _lexNumExp(src, start, _skipDigits(src, j + 1), true, stem, acc) else if (j < Str.len(src) && (_ch(src, j) == 101 || _ch(src, j) == 69)) _lexNumExp2(src, start, j, stem, acc) else lexAt(src, j, stem, _put(Tok.Int(n), start, stem, acc))
 
 def _lexNumExp(src: String, start: Int, j: Int, isF: Bool, stem: String, acc: List[SpTok]): List[SpTok] =
-  if (j < Str.len(src) && _ch(src, j) == 101 || _ch(src, j) == 69) _lexNumExp2(src, start, j, stem, acc) else if (isF) lexAt(src, j, stem, _put(Tok.Float(Str.slice(src, start, j)), start, stem, acc)) else lexAt(src, j, stem, _put(Tok.Int(Str.toInt(Str.slice(src, start, j), 0)), start, stem, acc))
+  if (j < Str.len(src) && (_ch(src, j) == 101 || _ch(src, j) == 69)) _lexNumExp2(src, start, j, stem, acc) else if (isF) lexAt(src, j, stem, _put(Tok.Float(Str.slice(src, start, j)), start, stem, acc)) else lexAt(src, j, stem, _put(Tok.Int(Str.toInt(Str.slice(src, start, j), 0)), start, stem, acc))
 
 def _lexNumExp2(src: String, start: Int, j: Int, stem: String, acc: List[SpTok]): List[SpTok] =
-  _lexNumExp3(src, start, j, if (j + 1 < Str.len(src) && _ch(src, j + 1) == 43 || _ch(src, j + 1) == 45) j + 2 else j + 1, stem, acc)
+  _lexNumExp3(src, start, j, if (j + 1 < Str.len(src) && (_ch(src, j + 1) == 43 || _ch(src, j + 1) == 45)) j + 2 else j + 1, stem, acc)
 
 def _lexNumExp3(src: String, start: Int, e: Int, k: Int, stem: String, acc: List[SpTok]): List[SpTok] =
   if (k < Str.len(src) && _isDigit(_ch(src, k))) lexAt(src, _skipDigits(src, k), stem, _put(Tok.Float(Str.slice(src, start, _skipDigits(src, k))), start, stem, acc)) else if (e > start) lexAt(src, e, stem, _put(Tok.Int(Str.toInt(Str.slice(src, start, e), 0)), start, stem, acc)) else lexAt(src, e, stem, _put(Tok.Int(Str.toInt(Str.slice(src, start, e), 0)), start, stem, acc))
@@ -302,7 +301,7 @@ def _lexUnder(src: String, i: Int, stem: String, acc: List[SpTok]): List[SpTok]
   lexAt(src, _skipIdent(src, i), stem, _put(Tok.Ident(Str.slice(src, i, _skipIdent(src, i))), i, stem, acc))
 
 def lexAt(src: String, i: Int, stem: String, acc: List[SpTok]): List[SpTok] =
-  if (i >= Str.len(src)) acc else if (_isSpace(_ch(src, i))) lexAt(src, i + 1, stem, acc) else if (_two(src, i, 47, 47)) lexAt(src, _lineEnd(src, i + 2), stem, acc) else if (_ch(src, i) == 64) if (_atMain(src, i)) lexAt(src, i + 5, stem, _put(Tok.AtMain, i, stem, acc)) else lexAt(src, i + 1, stem, _put(Tok.At, i, stem, acc)) else if (_ch(src, i) == 34) _lexStr(src, i, stem, acc) else if (_two(src, i, 58, 58)) lexAt(src, i + 2, stem, _put(Tok.ColonColon, i, stem, acc)) else if (_two(src, i, 61, 62)) lexAt(src, i + 2, stem, _put(Tok.Arrow, i, stem, acc)) else if (_two(src, i, 61, 61)) lexAt(src, i + 2, stem, _put(Tok.EqEq, i, stem, acc)) else if (_two(src, i, 33, 61)) lexAt(src, i + 2, stem, _put(Tok.BangEq, i, stem, acc)) else if (_two(src, i, 60, 45)) lexAt(src, i + 2, stem, _put(Tok.LeftArrow, i, stem, acc)) else if (_two(src, i, 60, 61)) lexAt(src, i + 2, stem, _put(Tok.LtEq, i, stem, acc)) else if (_two(src, i, 60, 60)) lexAt(src, i + 2, stem, _put(Tok.Shl, i, stem, acc)) else if (_two(src, i, 62, 61)) lexAt(src, i + 2, stem, _put(Tok.GtEq, i, stem, acc)) else if (_two(src, i, 62, 62)) lexAt(src, i + 2, stem, _put(Tok.Shr, i, stem, acc)) else if (_two(src, i, 38, 38)) lexAt(src, i + 2, stem, _put(Tok.AmpAmp, i, stem, acc)) else if (_two(src, i, 124, 124)) lexAt(src, i + 2, stem, _put(Tok.PipePipe, i, stem, acc)) else if (_isDigit(_ch(src, i))) _lexInt(src, i, stem, acc) else if (_ch(src, i) == 95 && _isAlnum(_ch(src, i + 1))) _lexUnder(src, i, stem, acc) else if (_isAlpha(_ch(src, i))) _lexName(src, i, stem, acc) else lexAt(src, i + 1, stem, _put(_punct(_ch(src, i)), i, stem, acc))
+  if (i >= Str.len(src)) acc else if (_isSpace(_ch(src, i))) lexAt(src, i + 1, stem, acc) else if (_ch(src, i) == 64) if (_atMain(src, i)) lexAt(src, i + 5, stem, _put(Tok.AtMain, i, stem, acc)) else lexAt(src, i + 1, stem, _put(Tok.At, i, stem, acc)) else if (_ch(src, i) == 34) _lexStr(src, i, stem, acc) else if (_two(src, i, 58, 58)) lexAt(src, i + 2, stem, _put(Tok.ColonColon, i, stem, acc)) else if (_two(src, i, 61, 62)) lexAt(src, i + 2, stem, _put(Tok.Arrow, i, stem, acc)) else if (_two(src, i, 61, 61)) lexAt(src, i + 2, stem, _put(Tok.EqEq, i, stem, acc)) else if (_two(src, i, 33, 61)) lexAt(src, i + 2, stem, _put(Tok.BangEq, i, stem, acc)) else if (_two(src, i, 60, 45)) lexAt(src, i + 2, stem, _put(Tok.LeftArrow, i, stem, acc)) else if (_two(src, i, 60, 61)) lexAt(src, i + 2, stem, _put(Tok.LtEq, i, stem, acc)) else if (_two(src, i, 60, 60)) lexAt(src, i + 2, stem, _put(Tok.Shl, i, stem, acc)) else if (_two(src, i, 62, 61)) lexAt(src, i + 2, stem, _put(Tok.GtEq, i, stem, acc)) else if (_two(src, i, 62, 62)) lexAt(src, i + 2, stem, _put(Tok.Shr, i, stem, acc)) else if (_two(src, i, 38, 38)) lexAt(src, i + 2, stem, _put(Tok.AmpAmp, i, stem, acc)) else if (_two(src, i, 124, 124)) lexAt(src, i + 2, stem, _put(Tok.PipePipe, i, stem, acc)) else if (_isDigit(_ch(src, i))) _lexInt(src, i, stem, acc) else if (_ch(src, i) == 95 && _isAlnum(_ch(src, i + 1))) _lexUnder(src, i, stem, acc) else if (_isAlpha(_ch(src, i))) _lexName(src, i, stem, acc) else lexAt(src, i + 1, stem, _put(_punct(_ch(src, i)), i, stem, acc))
 
 def lex(src: String): List[SpTok] =
   lexStem(src, "")
diff --git a/examples/syntax/src/Parse.scuzz b/examples/syntax/src/Parse.scuzz
index f5ac05c6..5ab41afb 100644
--- a/examples/syntax/src/Parse.scuzz
+++ b/examples/syntax/src/Parse.scuzz
@@ -11,7 +11,7 @@ enum Expr:
   case EField(recv: Expr, name: String, off: Int)
   case EBin(op: String, l: Expr, r: Expr, off: Int)
   case EUn(op: String, e: Expr, off: Int)
-  case ELam(p: String, body: Expr)
+  case ELam(p: String, ty: String, body: Expr)
   case EIf(c: Expr, t: Expr, e: Expr, off: Int)
   case EMatch(s: Expr, arms: List[Arm], off: Int)
   case EFor(bs: List[Bind], body: Expr, off: Int)
@@ -20,6 +20,7 @@ enum Expr:
   case EList(xs: List[Expr])
   case ETuple(xs: List[Expr])
   case ENamed(name: String, e: Expr)
+  case EAscribe(e: Expr, ty: String, off: Int)
 
 record Param(name: String, ty: String, w: String, d: String)
 
@@ -88,6 +89,7 @@ def spanOf(e: Expr): (String, Int) =
     case Expr.EIf(_, _, _, off) => ("", off)
     case Expr.EMatch(_, _, off) => ("", off)
     case Expr.EFor(_, _, off) => ("", off)
+    case Expr.EAscribe(_, _, off) => ("", off)
     case _ => ("", 0 - 1)
   }
 
@@ -165,12 +167,12 @@ def parseExprList(toks: List[SpTok], i: Int): (Expr, Int) =
 
 def parseAscribe(p: (Expr, Int), toks: Toks): (Expr, Int) =
   p match {
-    case (e, j) => if (_is(toks, j, Tok.Colon)) parseAscribeKeep(e, parseType(toks, j + 1)) else (e, j)
+    case (e, j) => if (_is(toks, j, Tok.Colon)) parseAscribeKeep(e, parseType(toks, j + 1), _off(toks, j)) else (e, j)
   }
 
-def parseAscribeKeep(e: Expr, p: (String, Int)): (Expr, Int) =
+def parseAscribeKeep(e: Expr, p: (String, Int), off: Int): (Expr, Int) =
   p match {
-    case (_, k) => (e, k)
+    case (ty, k) => (Expr.EAscribe(e, ty, spanOff(e, off)), k)
   }
 
 def parseOr(toks: Toks, i: Int): (Expr, Int) =
@@ -286,7 +288,7 @@ def parseMatchLam(toks: Toks, i: Int): (Expr, Int) =
 
 def parseMatchLam2(p: (Expr, Int)): (Expr, Int) =
   p match {
-    case (e, j) => (Expr.ELam("__p", e), j)
+    case (e, j) => (Expr.ELam("__p", "", e), j)
   }
 
 def parseIf(toks: Toks, i: Int): (Expr, Int) =
@@ -363,7 +365,7 @@ def parseLamBody(toks: Toks, i: Int, p: String): (Expr, Int) =
 
 def parseLamBody2(p: String, q: (Expr, Int)): (Expr, Int) =
   q match {
-    case (b, j) => (Expr.ELam(p, b), j)
+    case (b, j) => (Expr.ELam(p, "", b), j)
   }
 
 def parseParen(toks: Toks, i: Int): (Expr, Int) =
@@ -375,13 +377,24 @@ def parseParen2(p: (Expr, Int), toks: Toks): (Expr, Int) =
   }
 
 def parseOneLam(e: Expr, toks: Toks, j: Int): (Expr, Int) =
-  if (_is(toks, j, Tok.Colon)) parseOneLam(e, toks, skipAscript(toks, j)) else if (_is(toks, j, Tok.RParen) && _is(toks, j + 1, Tok.Arrow)) parseLamFrom(e, parseExpr(toks, j + 2)) else if (_is(toks, j, Tok.RParen)) (e, j + 1) else (e, j)
+  if (_is(toks, j, Tok.Colon)) parseOneLamTy(e, parseType(toks, j + 1), toks) else if (_is(toks, j, Tok.RParen) && _is(toks, j + 1, Tok.Arrow)) parseLamFromAsc(e, parseExpr(toks, j + 2)) else if (_is(toks, j, Tok.RParen)) (e, j + 1) else (e, j)
 
-def parseLamFrom(e: Expr, q: (Expr, Int)): (Expr, Int) =
+def parseLamFromAsc(e: Expr, q: (Expr, Int)): (Expr, Int) =
+  e match {
+    case Expr.EAscribe(inner, ty, _) => parseLamFrom(inner, ty, q)
+    case _ => parseLamFrom(e, "", q)
+  }
+
+def parseOneLamTy(e: Expr, p: (String, Int), toks: Toks): (Expr, Int) =
+  p match {
+    case (ty, j) => if (_is(toks, j, Tok.RParen) && _is(toks, j + 1, Tok.Arrow)) parseLamFrom(e, ty, parseExpr(toks, j + 2)) else parseOneLam(e, toks, j)
+  }
+
+def parseLamFrom(e: Expr, ty: String, q: (Expr, Int)): (Expr, Int) =
   q match {
     case (b, k) => e match {
-  case Expr.EVar(s, _) => (Expr.ELam(s, b), k)
-  case _ => (Expr.ELam("__p", Expr.EMatch(Expr.EVar("__p", 0), Arm(pretty0(e), "", b) :: [], 0)), k)
+  case Expr.EVar(s, _) => (Expr.ELam(s, ty, b), k)
+  case _ => (Expr.ELam("__p", ty, Expr.EMatch(Expr.EVar("__p", 0), Arm(pretty0(e), "", b) :: [], 0)), k)
 }
   }
 
@@ -398,7 +411,7 @@ def parseTupleLam(p: (Expr, Int), toks: Toks): (Expr, Int) =
 
 def parseTupLamBody(patE: Expr, q: (Expr, Int)): (Expr, Int) =
   q match {
-    case (b, k) => (Expr.ELam("__tup", Expr.EMatch(Expr.EVar("__tup", 0), Arm(tupPat(patE), "", b) :: [], 0)), k)
+    case (b, k) => (Expr.ELam("__tup", "", Expr.EMatch(Expr.EVar("__tup", 0), Arm(tupPat(patE), "", b) :: [], 0)), k)
   }
 
 def tupPat(e: Expr): String =
@@ -443,7 +456,7 @@ def parseIoArgs(toks: Toks, i: Int, m: String, off: Int): (Expr, Int) =
 
 def parseIoArgs2(m: String, p: (List[Expr], Int), off: Int): (Expr, Int) =
   p match {
-    case (args, j) => if (m == "println") (Expr.EPrint(List.at(args, 0), off), j) else (Expr.ECall(Str.concat("IO.", m), args, off), j)
+    case (args, j) => if (m == "println" && List.len(args) == 1) (Expr.EPrint(List.at(args, 0), off), j) else (Expr.ECall(Str.concat("IO.", m), args, off), j)
   }
 
 def parseKit(toks: Toks, i: Int, kit: String, off: Int): (Expr, Int) =
@@ -480,7 +493,7 @@ def parseArgListNext(p: (Expr, Int), toks: Toks, acc: List[Expr]): (List[Expr],
   }
 
 def parseArgListSep(e: Expr, j: Int, toks: Toks, acc: List[Expr]): (List[Expr], Int) =
-  if (_is(toks, j, Tok.LParen) || _is(toks, j, Tok.Dot) || _is(toks, j, Tok.Match)) parseArgListSep2(parsePost(toks, (e, j)), toks, acc) else if (_is(toks, j, Tok.Comma)) parseArgList(toks, j + 1, e :: acc) else (List.reverse(e :: acc), j + 1)
+  if (_is(toks, j, Tok.LParen) || _is(toks, j, Tok.Dot) || _is(toks, j, Tok.Match)) parseArgListSep2(parsePost(toks, (e, j)), toks, acc) else if (_is(toks, j, Tok.Comma)) parseArgList(toks, j + 1, e :: acc) else if (_is(toks, j, Tok.RParen)) (List.reverse(e :: acc), j + 1) else (List.reverse(e :: acc), j)
 
 def parseArgListSep2(p: (Expr, Int), toks: Toks, acc: List[Expr]): (List[Expr], Int) =
   p match {
@@ -555,7 +568,7 @@ def parsePatCons2(left: String, p: (String, Int)): (String, Int) =
 
 def parsePatOr(p: (String, Int), toks: Toks): (String, Int) =
   p match {
-    case (s, j) => if (_is(toks, j, Tok.Pipe)) parsePatOr2(s, parsePatPrimary(toks, j + 1), toks) else (s, j)
+    case (s, j) => if (_is(toks, j, Tok.Pipe)) parsePatOr2(s, parsePat(toks, j + 1), toks) else (s, j)
   }
 
 def parsePatOr2(left: String, p: (String, Int), toks: Toks): (String, Int) =
@@ -858,7 +871,10 @@ def parseImplMethsNext(p: (Fun, Int), tn: String, args: List[String], forTy: Str
   }
 
 def parseItems(toks: Toks, i: Int, enums: List[En], aliases: List[Alias], traits: List[Tr], impls: List[Im], imps: List[Imp], defs: List[Fun], main: String, body: Expr): Prog =
-  if (_is(toks, i, Tok.Eof)) Prog("", List.reverse(enums), List.reverse(aliases), List.reverse(traits), List.reverse(impls), List.reverse(imps), List.reverse(defs), main, body) else if (_is(toks, i, Tok.Enum)) parseItemsEn(toks, parseEnum(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Record)) parseItemsEn(toks, parseRec(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.TypeKw)) parseItemsAl(toks, parseAlias(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Trait)) parseItemsTr(toks, parseTrait(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Impl)) parseItemsIm(toks, parseImpl(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Import)) parseItemsImp(toks, parseImport(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Private)) parseItemsDef(toks, parseDef(toks, i + 2, true), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Def)) parseItemsDef(toks, parseDef(toks, i + 1, false), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.AtMain)) parseItemsMain(toks, parseMain(toks, i + 2), enums, aliases, traits, impls, imps, defs) else if (_is(toks, i, Tok.Colon)) parseItems(toks, i + 1, enums, aliases, traits, impls, imps, defs, main, body) else Prog("", List.reverse(enums), List.reverse(aliases), List.reverse(traits), List.reverse(impls), List.reverse(imps), List.reverse(defs), main, body)
+  if (_is(toks, i, Tok.Eof)) Prog("", List.reverse(enums), List.reverse(aliases), List.reverse(traits), List.reverse(impls), List.reverse(imps), List.reverse(defs), main, body) else if (_is(toks, i, Tok.Enum)) parseItemsEn(toks, parseEnum(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Record)) parseItemsEn(toks, parseRec(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.TypeKw)) parseItemsAl(toks, parseAlias(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Trait)) parseItemsTr(toks, parseTrait(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Impl)) parseItemsIm(toks, parseImpl(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Import)) parseItemsImp(toks, parseImport(toks, i + 1), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Private)) parseItemsDef(toks, parseDef(toks, i + 2, true), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.Def)) parseItemsDef(toks, parseDef(toks, i + 1, false), enums, aliases, traits, impls, imps, defs, main, body) else if (_is(toks, i, Tok.AtMain)) parseItemsMain(toks, parseMain(toks, i + 2), enums, aliases, traits, impls, imps, defs) else parseItemsFail(toks, i, enums, aliases, traits, impls, imps, defs, main, body)
+
+def parseItemsFail(toks: Toks, i: Int, enums: List[En], aliases: List[Alias], traits: List[Tr], impls: List[Im], imps: List[Imp], defs: List[Fun], main: String, body: Expr): Prog =
+  Prog("", List.reverse(enums), List.reverse(aliases), List.reverse(traits), List.reverse(impls), List.reverse(imps), Fun(false, "#parse", [], [], "Unit", Expr.EUnit, "", _off(toks, i)) :: List.reverse(defs), main, body)
 
 def parseItemsEn(toks: Toks, p: (En, Int), enums: List[En], aliases: List[Alias], traits: List[Tr], impls: List[Im], imps: List[Imp], defs: List[Fun], main: String, body: Expr): Prog =
   p match {
@@ -946,11 +962,11 @@ def prettyExpr(e: Expr, n: Int): String =
     case Expr.EUnit => Str.concat(_pad(n), "()")
     case Expr.EPrint(inner, _) => Str.concat(_pad(n), Str.concat("IO.println(", Str.concat(pretty0(inner), ")")))
     case Expr.ECall(f, args, _) => Str.concat(_pad(n), Str.concat(f, Str.concat("(", Str.concat(_commaExprs(args), ")"))))
-    case Expr.EMethod(recv, name, args, _) => Str.concat(_pad(n), Str.concat(_prettyRecv(recv), Str.concat(".", Str.concat(name, Str.concat("(", Str.concat(_commaExprs(args), ")"))))))
+    case Expr.EMethod(recv, name, args, _) => Str.concat(_pad(n), prettyMethod(recv, name, args))
     case Expr.EField(recv, name, _) => Str.concat(_pad(n), Str.concat(_prettyRecv(recv), Str.concat(".", name)))
     case Expr.EBin(op, l, r, _) => Str.concat(_pad(n), prettyBin(op, l, r))
     case Expr.EUn(op, inner, _) => Str.concat(_pad(n), Str.concat(op, _prettyUn(inner)))
-    case Expr.ELam(p, body) => Str.concat(_pad(n), Str.concat(p, Str.concat(" => ", pretty0(body))))
+    case Expr.ELam(p, ty, body) => Str.concat(_pad(n), prettyLam(p, ty, body))
     case Expr.EIf(c, t, el, _) => Str.concat(_pad(n), Str.concat("if (", Str.concat(pretty0(c), Str.concat(") ", Str.concat(pretty0(t), Str.concat(" else ", pretty0(el)))))))
     case Expr.EMatch(s, arms, _) => Str.concat(_pad(n), Str.concat(_prettyRecv(s), Str.concat(""" match {
 """, Str.concat(prettyArms(arms, n + 1), Str.concat(_pad(n), "}")))))
@@ -961,13 +977,29 @@ def prettyExpr(e: Expr, n: Int): String =
     case Expr.EList(xs) => Str.concat(_pad(n), Str.concat("[", Str.concat(_commaExprs(xs), "]")))
     case Expr.ETuple(xs) => Str.concat(_pad(n), Str.concat("(", Str.concat(_commaExprs(xs), ")")))
     case Expr.ENamed(name, e) => Str.concat(_pad(n), Str.concat(name, Str.concat(" = ", pretty0(e))))
+    case Expr.EAscribe(inner, ty, _) => Str.concat(_pad(n), Str.concat(prettyAsc(inner), Str.concat(": ", ty)))
+  }
+
+def prettyMethod(recv: Expr, name: String, args: List[Expr]): String =
+  if (name == "apply") Str.concat(_prettyRecv(recv), Str.concat("(", Str.concat(_commaExprs(args), ")"))) else Str.concat(_prettyRecv(recv), Str.concat(".", Str.concat(name, Str.concat("(", Str.concat(_commaExprs(args), ")")))))
+
+def prettyLam(p: String, ty: String, body: Expr): String =
+  if (ty == "") Str.concat(p, Str.concat(" => ", pretty0(body))) else Str.concat("(", Str.concat(p, Str.concat(": ", Str.concat(ty, Str.concat(") => ", pretty0(body))))))
+
+def prettyAsc(e: Expr): String =
+  e match {
+    case Expr.EBin(_, _, _, _) => _parenPretty(e)
+    case Expr.EIf(_, _, _, _) => _parenPretty(e)
+    case Expr.ELam(_, _, _) => _parenPretty(e)
+    case Expr.EAscribe(_, _, _) => _parenPretty(e)
+    case _ => pretty0(e)
   }
 
 def prettyBin(op: String, l: Expr, r: Expr): String =
-  if (op == "::") Str.concat(_prettyConsL(l), Str.concat(" :: ", _prettyConsR(r))) else Str.concat(_prettyBinL(op, l), Str.concat(" ", Str.concat(op, Str.concat(" ", _prettyBinR(op, r)))))
+  if (op == "::") Str.concat(_prettyBinR(op, l), Str.concat(" :: ", _prettyBinL(op, r))) else Str.concat(_prettyBinL(op, l), Str.concat(" ", Str.concat(op, Str.concat(" ", _prettyBinR(op, r)))))
 
 def binPrec(op: String): Int =
-  if (op == "||") 1 else if (op == "&&") 2 else if (op == "|") 3 else if (op == "^") 4 else if (op == "&") 5 else if (op == "<<" || op == ">>") 7 else if (op == "+" || op == "-") 8 else if (op == "*" || op == "/" || op == "%") 9 else if (op == "::") 10 else 6
+  if (op == "||") 1 else if (op == "&&") 2 else if (op == "|") 3 else if (op == "^") 4 else if (op == "&") 5 else if (op == "::") 7 else if (op == "<<" || op == ">>") 8 else if (op == "+" || op == "-") 9 else if (op == "*" || op == "/" || op == "%") 10 else 6
 
 def _prettyUn(e: Expr): String =
   e match {
@@ -975,6 +1007,7 @@ def _prettyUn(e: Expr): String =
     case Expr.EIf(_, _, _, _) => Str.concat("(", Str.concat(pretty0(e), ")"))
     case Expr.EMatch(_, _, _) => Str.concat("(", Str.concat(pretty0(e), ")"))
     case Expr.EFor(_, _, _) => Str.concat("(", Str.concat(pretty0(e), ")"))
+    case Expr.EAscribe(_, _, _) => Str.concat("(", Str.concat(pretty0(e), ")"))
     case _ => pretty0(e)
   }
 
@@ -986,7 +1019,8 @@ def _prettyBinL(op: String, e: Expr): String =
     case Expr.EBin(o2, _, _, _) => if (binPrec(o2) < binPrec(op)) _parenPretty(e) else pretty0(e)
     case Expr.EIf(_, _, _, _) => _parenPretty(e)
     case Expr.EFor(_, _, _) => _parenPretty(e)
-    case Expr.ELam(_, _) => _parenPretty(e)
+    case Expr.ELam(_, _, _) => _parenPretty(e)
+    case Expr.EAscribe(_, _, _) => _parenPretty(e)
     case _ => pretty0(e)
   }
 
@@ -995,26 +1029,8 @@ def _prettyBinR(op: String, e: Expr): String =
     case Expr.EBin(o2, _, _, _) => if (binPrec(o2) <= binPrec(op)) _parenPretty(e) else pretty0(e)
     case Expr.EIf(_, _, _, _) => _parenPretty(e)
     case Expr.EFor(_, _, _) => _parenPretty(e)
-    case Expr.ELam(_, _) => _parenPretty(e)
-    case _ => pretty0(e)
-  }
-
-def _prettyConsL(e: Expr): String =
-  e match {
-    case Expr.EBin(op, _, _, _) => if (op == "::" || op == "+" || op == "-" || op == "*" || op == "/" || op == "%") pretty0(e) else _parenPretty(e)
-    case Expr.EIf(_, _, _, _) => _parenPretty(e)
-    case Expr.EMatch(_, _, _) => _parenPretty(e)
-    case Expr.EFor(_, _, _) => _parenPretty(e)
-    case Expr.ELam(_, _) => _parenPretty(e)
-    case _ => pretty0(e)
-  }
-
-def _prettyConsR(e: Expr): String =
-  e match {
-    case Expr.EIf(_, _, _, _) => _parenPretty(e)
-    case Expr.EMatch(_, _, _) => _parenPretty(e)
-    case Expr.EFor(_, _, _) => _parenPretty(e)
-    case Expr.ELam(_, _) => _parenPretty(e)
+    case Expr.ELam(_, _, _) => _parenPretty(e)
+    case Expr.EAscribe(_, _, _) => _parenPretty(e)
     case _ => pretty0(e)
   }
 
@@ -1024,7 +1040,8 @@ def _prettyRecv(e: Expr): String =
     case Expr.EUn(_, _, _) => _parenPretty(e)
     case Expr.EIf(_, _, _, _) => _parenPretty(e)
     case Expr.EFor(_, _, _) => _parenPretty(e)
-    case Expr.ELam(_, _) => _parenPretty(e)
+    case Expr.ELam(_, _, _) => _parenPretty(e)
+    case Expr.EAscribe(_, _, _) => _parenPretty(e)
     case _ => pretty0(e)
   }
 
@@ -1036,7 +1053,8 @@ def prettyArms(xs: List[Arm], n: Int): String =
 """, prettyArms(List.tail(xs), n)))
 
 def prettyBind(b: Bind, n: Int): String =
-  Str.concat(_pad(n), Str.concat(b.name, Str.concat(if (b.draw) " <- " else " = ", Str.concat(pretty0(b.value), """
+  if (b.name == "__guard") Str.concat(_pad(n), Str.concat("if ", Str.concat(pretty0(b.value), """
+"""))) else Str.concat(_pad(n), Str.concat(b.name, Str.concat(if (b.draw) " <- " else " = ", Str.concat(pretty0(b.value), """
 """))))
 
 def prettyBinds(xs: List[Bind], n: Int): String =
diff --git a/examples/tyck/src/Main.scuzz b/examples/tyck/src/Main.scuzz
index f82398a9..f64e6a23 100644
--- a/examples/tyck/src/Main.scuzz
+++ b/examples/tyck/src/Main.scuzz
@@ -46,7 +46,7 @@ def srcPrint(): String =
 """
 
 def wantPrint(): String =
-  "[{\"severity\":\"error\",\"message\":\"type error: expected String, got Int\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":3,\"end_line\":2,\"end_column\":13}]"
+  "[{\"severity\":\"error\",\"message\":\"type error: expected String, got Int\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":14,\"end_line\":2,\"end_column\":15}]"
 
 def srcUnk(): String =
   """@main def main: IO[Unit] =
@@ -74,7 +74,7 @@ def srcArg(): String =
   "def add(n: Int, m: Int): Int =\n  n + m\n\n@main def main: IO[Unit] =\n  IO.println(Str.fromInt(add(1, \"x\")))\n"
 
 def wantArg(): String =
-  "[{\"severity\":\"error\",\"message\":\"type error: add arg type mismatch: expected Int, got String\",\"file\":\"Main.scuzz\",\"line\":5,\"column\":26,\"end_line\":5,\"end_column\":29}]"
+  "[{\"severity\":\"error\",\"message\":\"type error: add arg type mismatch: expected Int, got String\",\"file\":\"Main.scuzz\",\"line\":5,\"column\":33,\"end_line\":5,\"end_column\":36}]"
 
 def srcWatch(): String =
   """@main def main: IO[Unit] =
@@ -109,9 +109,6 @@ def wantIfMis(): String =
 def tyckDiff(src: String, want: String): Bool =
   Check.check(src) == want
 
-def tyckIdem(src: String): Bool =
-  Check.check(src) == Check.check(src)
-
 def srcDup(): String =
   "def f(): String =\n  \"nope\"\n\n@main def main: IO[Unit] =\n  IO.println(nope)\n"
 
@@ -128,7 +125,7 @@ def srcFailMis(): String =
   "enum Err:\n  case Boom\ndef boom(): IO[Err, Int] =\n  IO.fail(\"nope\")\n@main def main: IO[Unit] =\n  IO.println(\"ok\")\n"
 
 def wantFailMis(): String =
-  "[{\"severity\":\"error\",\"message\":\"type error: def boom body IO[Any] does not match declared IO[Err, Int]\",\"file\":\"Main.scuzz\",\"line\":4,\"column\":3,\"end_line\":4,\"end_column\":10}]"
+  "[{\"severity\":\"error\",\"message\":\"type error: def boom body IO[String, Any] does not match declared IO[Err, Int]\",\"file\":\"Main.scuzz\",\"line\":4,\"column\":3,\"end_line\":4,\"end_column\":10}]"
 
 def srcMapHandle(): String =
   "def load(path: String, fallback: String): IO[String] =\n  Fs.read(path).map(s => Str.concat(s, \"!\")).handleErrorWith(_ => IO.pure(fallback))\n\n@main def main: IO[Unit] =\n  IO.println(\"ok\")\n"
@@ -145,11 +142,167 @@ def srcMainOk(): String =
 def wantUtil(): String =
   "[{\"severity\":\"error\",\"message\":\"type error: in bad: arithmetic needs Int or Float, got Int and String\",\"file\":\"Util.scuzz\",\"line\":2,\"column\":3,\"end_line\":2,\"end_column\":4}]"
 
+def srcJoinMis(): String =
+  "@main def main: IO[Unit] =\n  IO.println(List.join([1, 2], \",\"))\n"
+
+def wantJoinMis(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: List.join arg type mismatch: expected List[String], got List[Int]\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":14,\"end_line\":2,\"end_column\":23}]"
+
+def srcResArity(): String =
+  "@main def main: IO[Unit] =\n  for {\n    r = Resource.make(IO.pure(1))\n    _ <- IO.println(\"x\")\n  } yield ()\n"
+
+def wantResArity(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: Resource.make expects 2 args, got 1\",\"file\":\"Main.scuzz\",\"line\":3,\"column\":9,\"end_line\":3,\"end_column\":22}]"
+
+def srcResDraw(): String =
+  """@main def main: IO[Unit] =
+  for {
+    _ <- Resource.make(IO.pure(1), r => IO.pure(r))
+  } yield ()
+"""
+
+def wantResDraw(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: <- needs IO, got Resource[Int]\",\"file\":\"Main.scuzz\",\"line\":3,\"column\":10,\"end_line\":3,\"end_column\":23}]"
+
+def srcResLam(): String =
+  "@main def main: IO[Unit] =\n  for {\n    r = Resource.make(IO.pure(1), n => n + 1)\n    _ <- IO.println(\"x\")\n  } yield ()\n"
+
+def wantResLam(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: Resource.make needs IO, got IO[Any, Int] and Int\",\"file\":\"Main.scuzz\",\"line\":3,\"column\":9,\"end_line\":3,\"end_column\":22}]"
+
+def srcResUnk(): String =
+  """@main def main: IO[Unit] =
+  Resource.foo(1)
+"""
+
+def wantResUnk(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: unknown function Resource.foo\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":3,\"end_line\":2,\"end_column\":15}]"
+
+def srcDefUnk(): String =
+  """@main def main: IO[Unit] =
+  Deferred.foo(1)
+"""
+
+def wantDefUnk(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: unknown function Deferred.foo\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":3,\"end_line\":2,\"end_column\":15}]"
+
+def srcDefMis(): String =
+  "@main def main: IO[Unit] =\n  Deferred.complete(\"nope\", 1)\n"
+
+def wantDefMis(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: Deferred.complete arg type mismatch: expected Deferred, got String\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":21,\"end_line\":2,\"end_column\":27}]"
+
+def srcJsonUnk(): String =
+  """@main def main: IO[Unit] =
+  Json.notAKit(1, 2, 3)
+"""
+
+def wantJsonUnk(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: unknown function Json.notAKit\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":3,\"end_line\":2,\"end_column\":15}]"
+
+def srcStrUnk(): String =
+  "@main def main: IO[Unit] =\n  Str.nope(\"x\")\n"
+
+def wantStrUnk(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: unknown function Str.nope\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":3,\"end_line\":2,\"end_column\":11}]"
+
+def srcSysExit(): String =
+  "@main def main: IO[Unit] =\n  Sys.exit(\"x\")\n"
+
+def wantSysExit(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: unknown function Sys.exit\",\"file\":\"Main.scuzz\",\"line\":2,\"column\":3,\"end_line\":2,\"end_column\":11}]"
+
+def srcStrConcatTy(): String =
+  "def n: Int = Str.concat(\"a\", \"b\")\n"
+
+def wantStrConcatTy(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: def n body String does not match declared Int\",\"file\":\"Main.scuzz\",\"line\":1,\"column\":14,\"end_line\":1,\"end_column\":24}]"
+
 def tyckFiles(): Bool =
   Check.checkFiles(("Main", srcMainOk()) :: ("Util", srcUtil()) :: []) == wantUtil()
 
+def srcLeftover(): String =
+  """def a: Int = 1; def b: Int = 2
+"""
+
+def wantLeftover(): String =
+  "[{\"severity\":\"error\",\"message\":\"unexpected token\",\"file\":\"Main.scuzz\",\"line\":1,\"column\":15,\"end_line\":1,\"end_column\":16}]"
+
+def srcBinBad(): String =
+  """def n(): Int = 0b21
+"""
+
+def wantBinBad(): String =
+  "[{\"severity\":\"error\",\"message\":\"unexpected token\",\"file\":\"Main.scuzz\",\"line\":1,\"column\":18,\"end_line\":1,\"end_column\":20}]"
+
+def srcHexX(): String =
+  """def n(): Int = 5X
+"""
+
+def wantHexX(): String =
+  "[{\"severity\":\"error\",\"message\":\"unexpected token\",\"file\":\"Main.scuzz\",\"line\":1,\"column\":17,\"end_line\":1,\"end_column\":18}]"
+
+def srcAscOk(): String =
+  """def n(): Int = 1: Int
+"""
+
+def wantAscOk(): String =
+  "[]"
+
+def srcAscMis(): String =
+  """def n(): Int = 1: String
+"""
+
+def wantAscMis(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: in n: type mismatch: expected String, got Int\",\"file\":\"Main.scuzz\",\"line\":1,\"column\":16,\"end_line\":1,\"end_column\":17}]"
+
+def srcLamAnn(): String =
+  """def n(): Int = ((x: Int) => x + 1)(3)
+"""
+
+def wantLamAnn(): String =
+  "[]"
+
+def srcLamMis(): String =
+  """def n(): Int = ((x: String) => x)(3)
+"""
+
+def wantLamMis(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: in n: apply arg type mismatch: expected String, got Int\",\"file\":\"Main.scuzz\",\"line\":1,\"column\":35,\"end_line\":1,\"end_column\":36}]"
+
+def srcLamArg(): String =
+  "def n(): Int = ((x: Int) => x + 1)(\"nope\")\n"
+
+def wantLamArg(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: in n: apply arg type mismatch: expected Int, got String\",\"file\":\"Main.scuzz\",\"line\":1,\"column\":36,\"end_line\":1,\"end_column\":42}]"
+
+def srcFunBody(): String =
+  """def f(): Int => Int = 1
+"""
+
+def wantFunBody(): String =
+  "[{\"severity\":\"error\",\"message\":\"type error: def f body Int does not match declared Int => Int\",\"file\":\"Main.scuzz\",\"line\":1,\"column\":23,\"end_line\":1,\"end_column\":24}]"
+
+def tyckCore(): Bool =
+  tyckDiff(srcOk(), wantOk()) && tyckDiff(srcUnbound(), wantUnbound()) && tyckDiff(srcArith(), wantArith()) && tyckDiff(srcArity(), wantArity()) && tyckDiff(srcRet(), wantRet()) && tyckDiff(srcPrint(), wantPrint()) && tyckDiff(srcUnk(), wantUnk()) && tyckDiff(srcCmp(), wantCmp()) && tyckDiff(srcMainTy(), wantMainTy()) && tyckDiff(srcArg(), wantArg()) && tyckDiff(srcWatch(), wantWatch()) && tyckDiff(srcDup(), wantDup()) && tyckFiles()
+
+def tyckFlow(): Bool =
+  tyckDiff(srcUnBool(), wantUnBool()) && tyckDiff(srcIfMis(), wantIfMis()) && tyckDiff(srcMapHandle(), wantMapHandle()) && tyckDiff(srcJoinMis(), wantJoinMis()) && tyckDiff(srcNope(), wantNope()) && tyckDiff(srcStrUnk(), wantStrUnk()) && tyckDiff(srcStrConcatTy(), wantStrConcatTy()) && tyckDiff(srcSysExit(), wantSysExit())
+
+def tyckRes(): Bool =
+  tyckDiff(srcResArity(), wantResArity()) && tyckDiff(srcResDraw(), wantResDraw()) && tyckDiff(srcResLam(), wantResLam()) && tyckDiff(srcResUnk(), wantResUnk()) && tyckDiff(srcJsonUnk(), wantJsonUnk()) && tyckDiff(srcDefUnk(), wantDefUnk()) && tyckDiff(srcDefMis(), wantDefMis())
+
+def tyckFail(): Bool =
+  tyckDiff(srcFailOk(), wantFailOk()) && tyckDiff(srcFailMis(), wantFailMis())
+
+def tyckParse(): Bool =
+  tyckDiff(srcLeftover(), wantLeftover()) && tyckDiff(srcBinBad(), wantBinBad()) && tyckDiff(srcHexX(), wantHexX()) && tyckDiff(srcAscOk(), wantAscOk()) && tyckDiff(srcAscMis(), wantAscMis())
+
+def tyckLam(): Bool =
+  tyckDiff(srcLamAnn(), wantLamAnn()) && tyckDiff(srcLamMis(), wantLamMis()) && tyckDiff(srcLamArg(), wantLamArg()) && tyckDiff(srcFunBody(), wantFunBody()) && wantLamMis() != "[]" && wantLamArg() != "[]" && wantFunBody() != "[]"
+
 def allOk(): Bool =
-  tyckDiff(srcOk(), wantOk()) && tyckIdem(srcOk()) && tyckDiff(srcUnbound(), wantUnbound()) && tyckIdem(srcUnbound()) && tyckDiff(srcArith(), wantArith()) && tyckIdem(srcArith()) && tyckDiff(srcArity(), wantArity()) && tyckIdem(srcArity()) && tyckDiff(srcRet(), wantRet()) && tyckIdem(srcRet()) && tyckDiff(srcPrint(), wantPrint()) && tyckIdem(srcPrint()) && tyckDiff(srcUnk(), wantUnk()) && tyckIdem(srcUnk()) && tyckDiff(srcCmp(), wantCmp()) && tyckIdem(srcCmp()) && tyckDiff(srcMainTy(), wantMainTy()) && tyckIdem(srcMainTy()) && tyckDiff(srcArg(), wantArg()) && tyckIdem(srcArg()) && tyckDiff(srcWatch(), wantWatch()) && tyckIdem(srcWatch()) && tyckDiff(srcNope(), wantNope()) && tyckIdem(srcNope()) && tyckDiff(srcDup(), wantDup()) && tyckDiff(srcUnBool(), wantUnBool()) && tyckDiff(srcIfMis(), wantIfMis()) && tyckDiff(srcFailOk(), wantFailOk()) && tyckDiff(srcFailMis(), wantFailMis()) && tyckDiff(srcMapHandle(), wantMapHandle()) && tyckFiles()
+  tyckCore() && tyckFlow() && tyckRes() && tyckFail() && tyckParse() && tyckLam()
 
 @main def main: IO[Unit] =
   IO.println(if (allOk()) "tyck-ok" else "tyck-bad")
diff --git a/examples/tyck/tyck.scuzz_verify b/examples/tyck/tyck.scuzz_verify
index 07a4e20c..8165b9cf 100644
--- a/examples/tyck/tyck.scuzz_verify
+++ b/examples/tyck/tyck.scuzz_verify
@@ -1,54 +1,18 @@
-def tyckOk(): Bool =
-  Main.tyckDiff(Main.srcOk(), Main.wantOk())
+def tyckCore(): Bool =
+  Main.tyckCore()
 
-def tyckUnbound(): Bool =
-  Main.tyckDiff(Main.srcUnbound(), Main.wantUnbound())
+def tyckFlow(): Bool =
+  Main.tyckFlow()
 
-def tyckArith(): Bool =
-  Main.tyckDiff(Main.srcArith(), Main.wantArith())
+def tyckRes(): Bool =
+  Main.tyckRes()
 
-def tyckArity(): Bool =
-  Main.tyckDiff(Main.srcArity(), Main.wantArity())
+def tyckFail(): Bool =
+  Main.tyckFail()
 
-def tyckRet(): Bool =
-  Main.tyckDiff(Main.srcRet(), Main.wantRet())
+def tyckParse(): Bool =
+  Main.tyckParse()
 
-def tyckPrint(): Bool =
-  Main.tyckDiff(Main.srcPrint(), Main.wantPrint())
-
-def tyckUnk(): Bool =
-  Main.tyckDiff(Main.srcUnk(), Main.wantUnk())
-
-def tyckCmp(): Bool =
-  Main.tyckDiff(Main.srcCmp(), Main.wantCmp())
-
-def tyckMainTy(): Bool =
-  Main.tyckDiff(Main.srcMainTy(), Main.wantMainTy())
-
-def tyckArg(): Bool =
-  Main.tyckDiff(Main.srcArg(), Main.wantArg())
-
-def tyckWatch(): Bool =
-  Main.tyckDiff(Main.srcWatch(), Main.wantWatch())
-
-def tyckIdemOk(): Bool =
-  Main.tyckIdem(Main.srcOk())
-
-def tyckIdemUnbound(): Bool =
-  Main.tyckIdem(Main.srcUnbound())
-
-def tyckDup(): Bool =
-  Main.tyckDiff(Main.srcDup(), Main.wantDup())
-
-def tyckFiles(): Bool =
-  Main.tyckFiles()
-
-def tyckUnBool(): Bool =
-  Main.tyckDiff(Main.srcUnBool(), Main.wantUnBool())
-
-def tyckIfMis(): Bool =
-  Main.tyckDiff(Main.srcIfMis(), Main.wantIfMis())
-
-def tyckMapHandle(): Bool =
-  Main.tyckDiff(Main.srcMapHandle(), Main.wantMapHandle())
+def tyckLam(): Bool =
+  Main.tyckLam()
 
diff --git a/third_party/skia/README.md b/third_party/skia/README.md
index 594059ac..2f4e8138 100644
--- a/third_party/skia/README.md
+++ b/third_party/skia/README.md
@@ -16,13 +16,14 @@ satisfied. Opt out with `SCUZZ_SKIA=sk_sw` for the in-tree software backend.
 `{triple}` is replaced with the host triple (for example `x86_64-unknown-linux-gnu`,
 `aarch64-apple-darwin`). Layout after fetch:
 `third_party/skia/prebuilt/<triple>/libsk_capi.a`.
-`crates/ffi-skia/Makefile` copies that archive into
-`crates/ffi-skia/build/` (marker `build/sk_capi_backend` = `skia`).
+`crates/ffi-skia/Makefile` copies that archive into `crates/ffi-skia/build/`
+and replaces the shim (marker `build/sk_capi_backend` = `skia`).
 
-**Tarball contract:** a static library exporting every symbol in
-`crates/ffi-skia/include/sk_capi.h` (including measure / text-size APIs). Callers
-need no Skia headers — only `sk_capi.h`. One fat `libsk_capi.a` (shim + Skia
-objects + embedded font). Linking needs `-lstdc++`/`-lc++` `-lm -lz -lbz2`
+**Tarball contract:** a static library that supplies Skia objects and the
+embedded font. `crates/ffi-skia` `make lib` replaces the shim objects so the
+archive exports every symbol in `sk_capi.h` (save/clip/restore, RGBA peek,
+measure / text-size). Callers need no Skia headers — only `sk_capi.h`. One fat
+`libsk_capi.a`. Linking needs `-lstdc++`/`-lc++` `-lm -lz -lbz2`
 (`scuzz` adds these when `build/sk_capi_backend` is `skia`). On Darwin also link
 CoreFoundation / CoreGraphics / CoreText / Foundation / Carbon. The packer turns
 WOFF2 off and fails if the fat archive has undefined Brotli symbols. On Linux