diff --git a/README.md b/README.md
index 5d92e9e3..8219df95 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ If you like projectMM, give it a ⭐️, fork it, or open an issue or pull reque
 
 🎨 **Plug in, open a browser, see lights**: a live 3D preview of every effect, modifier, and layout, controllable from the same tab. The interface renders any module from its declared controls, so adding a module needs zero UI code.
 
-🌗 **MoonBase, the second boot image (4 MB boards)**: instead of spending half a small flash on a second firmware copy, a ~750 KB maintenance image sits in the factory slot and installs updates into one large app slot, one click in the UI covers the whole reboot-install-reboot cycle, and a power cut mid-update lands back in MoonBase, never in a half-written app. See [architecture.md § MoonBase](docs/architecture.md#moonbase-the-second-boot-image-4-mb-boards).
+🌗 **MoonBase, the second boot image**: instead of spending half the flash on a second firmware copy, a ~750 KB maintenance image sits in the factory slot and installs updates into one large app slot, one click in the UI covers the whole reboot-install-reboot cycle, and a power cut mid-update lands back in MoonBase, never in a half-written app. Forced on a 4 MB board, which has room for one application and not two, and chosen on the larger ones, where the freed slot goes to the filesystem instead. See [architecture.md § MoonBase](docs/architecture.md#moonbase-the-second-boot-image).
 
 ⚡ **Flash from your browser in seconds**: the web installer picks your device, flashes the matching firmware, and hands WiFi credentials to the device over USB via Improv. No serial monitor, no recompile.
 
@@ -179,7 +179,7 @@ Specific people whose work directly shaped parts of projectMM. We study their th
 - **The [Improv Wi-Fi](https://github.com/improv-wifi) project**: the open Improv serial provisioning standard ([sdk-cpp](https://github.com/improv-wifi/sdk-cpp) / [sdk-js](https://github.com/improv-wifi/sdk-js)) that the projectMM web installer uses to provision a freshly-flashed device over USB.
 - **[FastLED](https://github.com/FastLED/FastLED)**: the canonical LED-effects library whose conventions the LED-effect world shares. projectMM links no part of FastLED, but it carries forward FastLED's recognisable *names and models* for the color/animation primitives (`scale8`, `sin8`, the gradient-palette model (`CRGBPalette16` / `colorFromPalette`), the `beatsin8` / `inoise8` / `qadd8` family), so a contributor recognises them on sight. The implementations are projectMM's own, integer-only and hot-path-tuned for our render loop; FastLED is the prior art behind the convention, credited here and in each primitive's notes.
 - **[FPP](https://github.com/FalconChristmas/fpp) (Falcon Player)**: the show player that drives LED panel receiver cards from a Raspberry Pi. Seeing an FPP rig feed a wall of HUB75 panels is what prompted [PanelCardDriver](docs/moonmodules/light/drivers.md#panelcard): if a Linux host can send those frames, so can a board that is already rendering them, which removes the host from the installation entirely. FPP is the inspiration, and the reference point for what good looks like here: it sustains 50 fps.
-- **[Tasmota](https://github.com/arendst/Tasmota) and Mathieu Carbou's [MycilaSafeBoot](https://github.com/mathieucarbou/MycilaSafeBoot)**: the safeboot pattern behind [MoonBase](docs/architecture.md#moonbase-the-second-boot-image-4-mb-boards): replacing a small board's second OTA slot with a minimal boot image that installs into one large app slot. Tasmota proved the scheme at scale; MycilaSafeBoot distilled it to a standalone image and set the size bar. MoonBase is our from-scratch minimal take, written directly against ESP-IDF.
+- **[Tasmota](https://github.com/arendst/Tasmota) and Mathieu Carbou's [MycilaSafeBoot](https://github.com/mathieucarbou/MycilaSafeBoot)**: the safeboot pattern behind [MoonBase](docs/architecture.md#moonbase-the-second-boot-image): replacing a small board's second OTA slot with a minimal boot image that installs into one large app slot. Tasmota proved the scheme at scale; MycilaSafeBoot distilled it to a standalone image and set the size bar. MoonBase is our from-scratch minimal take, written directly against ESP-IDF.
 - **Damian Schneider ([dedehai](https://github.com/DedeHai))**: author of the WLED Particle System, whose emitters, forces and walls over one shared pool are the shape our [particle kernel](docs/moonmodules/light/power-functions.md#particles) and the scripted `pool` / `emit` / `step` builtins follow, in our own fixed-point implementation.
 - **wladi ([myhome-control](https://shop.myhome-control.de))**: designer of the [MHC-WLED ESP32-P4 shield](https://shop.myhome-control.de/en/ABC-WLED-ESP32-P4-shield/HW10027), and the source of the hardware and the pinout details that got its **line-in audio** working in [AudioService](docs/moonmodules/core/moxygen/AudioService.md): the onboard PCM1808 I2S ADC (WS 26 / SD 33 / SCK 32 / MCLK 36), the PCM1808's stereo wiring, and its `FMT` format-select jumper (open = I2S/Philips, our default; tie to 3V3 for left-justified), which is what confirmed the standard-I2S path the ADC needs.
 
diff --git a/docs/MIGRATING.md b/docs/MIGRATING.md
index 7c540a95..d870cb64 100644
--- a/docs/MIGRATING.md
+++ b/docs/MIGRATING.md
@@ -73,6 +73,24 @@ calling it sound, so it is renamed rather than left as the odd one out.
 A restored config maps the old name to the new one and carries its value. On a device upgraded in
 place the control returns to its default (off); switch it back on where you had it.
 
+### AudioVolume is gone
+
+**Action: pick another effect.** Affects any device with an AudioVolume effect on a layer.
+
+It drew one bar from the audio level, which every audio-reactive effect does as a side effect of
+what it actually draws. There is no successor to map it onto, so a restored config carrying an
+`AudioVolumeEffect` node finds no such type and the layer comes up without it. `GEQ` is the nearest
+thing if a literal meter is what you want.
+
+### The Firmware card describes one image at a time
+
+**Action: none.** Affects nothing a user has set: every control involved is read-only.
+
+`firmwarePartition` is now `partition`, and `update_pct` is gone (an install's progress belongs in
+the overlay the UI raises while it runs, not in a row that sits at zero for the life of a device
+that is not mid-install). Where a device carries two images, a new `image` control selects whether
+those rows describe the running app or MoonBase in the factory slot.
+
 ### Noise2D is gone; Noise renders it
 
 **Action: re-set one control.** Affects any device with a Noise2D effect on a layer.
diff --git a/docs/architecture.md b/docs/architecture.md
index fd08747e..3d16a23a 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -291,6 +291,28 @@ network, a stronger power-fail story than dual-OTA's. A failed install deliberat
 MoonBase, visibly, rather than silently reverting to the old app; the way back is its explicit
 "Boot the app" action, which only boots an image that validates.
 
+**Updating MoonBase itself** runs the same cycle backwards: the app writes the factory slot while
+running from `ota_0`, exactly as MoonBase writes the app slot while running from factory. Neither
+image can rewrite the partition it executes from, so each installs the other and the app is the
+only thing that can repair a broken recovery image. Without it a bad MoonBase means a cable, which
+is the failure MoonBase exists to prevent.
+
+Two things make that safe enough to offer. `esp_ota_*` refuses a factory partition, so this is a
+raw `esp_partition_erase_range` + `esp_partition_write`, which also forfeits the validation
+`esp_ota_end` performs: `esp_image_verify` replaces it after the write. And because a 4 MB board
+has nowhere to stage 743 KB before erasing, the image streams straight in, so everything that can
+reject it is decided from its FIRST CHUNK, before a byte is erased: the image magic, the chip id
+(one MoonBase per chip, one paste apart, and a checksum does not catch a swap), and the descriptor
+naming `projectMM-moonbase` rather than the app. Those rules live in `src/core/FirmwareImage.h` so
+a host test can drive them. What remains is a window, during the write, in which the device holds
+no recovery image; the app keeps running throughout, so the answer to a failure is to retry.
+
+Each image reports its version from the app descriptor IDF puts in every binary, `PROJECT_VER`
+being set to the same computed version for both, so the app can read the factory partition's
+version without booting it and say when the two were built apart. A device that cannot name its
+own recovery image cannot be diagnosed: two boards that looked identical, one of which could not
+install firmware, took a bisect of the git log to tell apart.
+
 MoonBase is a standalone ESP-IDF project (`moonbase/`, ~750 KB against an 896 KB slot) sharing
 no sources with the app, the deliberate trade for an image that must stay small and, once
 working, hardly change. `moondeck/build/build_esp32.py` builds it alongside every variant that opts in
@@ -324,7 +346,7 @@ The defining line is the **data relationship, not the connector**: *does the mod
 
 Services are **user-add/deletable children of the `Services` container** — the core-domain twin of the light pipeline's `Effects`/`Drivers`: a top-level container holding user-added children of one role. The firmware is identical whether or not the hardware is wired, so the user adds the module when they solder a gyro on and removes it later, reusing the generic child add/replace/delete + persistence machinery (`Services` declares `acceptsChildRoles("service")`). Fixed device infrastructure (identity, network, the inspection tools Tasks/I2cScan) lives under **System** instead, wired by code, not user-added — that is the System/Services split. Direction is per-module, not a role: a service may read (gyro), write (relay), or both, so one `Service` role spans the category. Each is a header-only or `.h`+`.cpp` core module under `src/core/`, reaches hardware only through a domain-neutral platform primitive (`platform::i2c*`, `platform::audioMic*`, …), and gets a spec in `docs/moonmodules/core/services.md` (enforced by `check_specs.py`). Most poll in `tick20ms`/`tick1s`; the exception is a service whose data an effect consumes *every frame*: [AudioService](moonmodules/core/moxygen/AudioService.md) reads + analyses its I²S microphone in `tick()` because the audio effects react per render tick, and its per-tick cost (one FFT) is part of the render budget. Automatic bus-probe detection is out of scope; the manual path is the foundation.
 
-**An effect reads a service's data** via the shared-struct pull pattern from [§ Data exchange](#data-exchange-between-modules), no new mechanism: the service owns a small POD struct overwritten in place each poll/tick, and the consuming effect holds a `const` pointer to it. The first concrete case is audio: AudioService produces an `AudioFrame` (level + 16-band spectrum + peak) that [AudioVolumeEffect](moonmodules/light/effects.md) and [AudioSpectrumEffect](moonmodules/light/effects.md) consume. It reaches the frame through a static `AudioService::latestFrame()` rather than a boot-time setter, a small variation on the pattern, because an audio effect can be added through the UI *after* boot and must still find the one live mic (a setter only wired the boot instance). The active mic registers itself in `setup()` and clears the pointer in `release()`, so add/remove in any order returns either the live frame or a static silent one, never null. A service that only *displays* its readings (the gyro today) skips the consumer side entirely.
+**An effect reads a service's data** via the shared-struct pull pattern from [§ Data exchange](#data-exchange-between-modules), no new mechanism: the service owns a small POD struct overwritten in place each poll/tick, and the consuming effect holds a `const` pointer to it. The first concrete case is audio: AudioService produces an `AudioFrame` (level + 16-band spectrum + peak) that [AudioSpectrumEffect](moonmodules/light/effects.md) and the other audio effects consume. It reaches the frame through a static `AudioService::latestFrame()` rather than a boot-time setter, a small variation on the pattern, because an audio effect can be added through the UI *after* boot and must still find the one live mic (a setter only wired the boot instance). The active mic registers itself in `setup()` and clears the pointer in `release()`, so add/remove in any order returns either the live frame or a static silent one, never null. A service that only *displays* its readings (the gyro today) skips the consumer side entirely.
 
 ## Multi-device runtime
 
diff --git a/docs/assets/light/effects/AudioVolumeEffect.gif b/docs/assets/light/effects/AudioVolumeEffect.gif
deleted file mode 100644
index fdc93033..00000000
Binary files a/docs/assets/light/effects/AudioVolumeEffect.gif and /dev/null differ
diff --git a/docs/assets/light/effects/AudioVolumeEffect.png b/docs/assets/light/effects/AudioVolumeEffect.png
deleted file mode 100644
index 00889855..00000000
Binary files a/docs/assets/light/effects/AudioVolumeEffect.png and /dev/null differ
diff --git a/docs/backlog/backlog-core.md b/docs/backlog/backlog-core.md
index 882da853..d7356d09 100644
--- a/docs/backlog/backlog-core.md
+++ b/docs/backlog/backlog-core.md
@@ -128,7 +128,7 @@ declared rather than for a buffer to fill, and to time out on stall rather than
   RISC-V coprocessor-context save on INTERRUPT ENTRY. That is a symptom of something faulting inside
   an ISR context rather than a bug in the kernel itself, and the P4 is the only RISC-V target with a
   coprocessor, which is why no other board shows it. The prior art at
-  [Plan-20260718](../history/plans/archive/Plan-20260718%20-%20MoonI80%20lapping-v2%20clock-oracle%20ring%20(shipped).md)
+  `Plan-20260718 - MoonI80 lapping-v2 clock-oracle ring` (in the plans archive)
   is a DIFFERENT cause with the same panic name (an ISR reading PSRAM while a flash write disabled
   the cache, fixed with a `spi_flash_cache_enabled()` defer guard) and is worth re-reading first:
   the same shape on another ISR would present exactly like this.
@@ -153,7 +153,7 @@ DevicesModule discovers via **passive UDP presence** (UDP 65506) feeding a [`Dev
 - **Live peer state** — a discovered peer's brightness / on-off shown in our list, refreshed by polling its REST `/json` after discovery gives the IP (discovery = UDP/mDNS, state = REST). The read-side complement to the command half.
 - **Non-IP transports (board-gated, far future)** — Tasmota-MQTT / zigbee2mqtt need an MQTT client; **direct Zigbee/Thread** (S31/C6/H2 802.15.4 radio) makes projectMM the *hub itself*, driving bulbs over the mesh with no gateway — the standout differentiator, the biggest lift. Same plugin philosophy, a transport addition + board gate.
 
-Full design + the reasoned transport split: [Plan-20260629 — UDP device discovery + mDNS advertise-only (shipped)](../history/plans/archive/Plan-20260629%20-%20UDP%20device%20discovery%20%2B%20mDNS%20advertise-only%20%28shipped%29.md).
+Full design + the reasoned transport split: `Plan-20260629 - UDP device discovery + mDNS advertise-only` (in the plans archive).
 
 ## MoonBase follow-ups
 
@@ -1073,14 +1073,20 @@ They are **not** CI failures (CI is Debug) and each one inspected so far is a fa
 Not done with the multi-destination/tab-UI merge because 17 warnings across four core files is its own change, not a tail on someone else's.
 
 
-## MoonLive core/platform layering + JIT sdkconfig scoping (CodeRabbit #29, 4 findings)
+## MoonLive core/platform layering + JIT sdkconfig scoping (CodeRabbit #29, 3 findings left)
 
-Four 🟠 Major boundary findings from the PR #29 review are real but each is its own scoped change, not a tail on the ring branch. The Critical sibling (a `cpl<3` overflow guard in the MoonLive effect's `tick`) landed with the branch it was found on; these four are backlogged:
+Four 🟠 Major boundary findings from the PR #29 review are real but each is its own scoped change, not a tail on the ring branch. The Critical sibling (a `cpl<3` overflow guard in the MoonLive effect's `tick`) landed with the branch it was found on.
+
+**One of the four is CLOSED (2026-09-07):** the scenario now uses `PreviewDriver`, the in-process
+sink, instead of `NetworkSendDriver`. Its `tick_us` half was reviewed and DISMISSED rather than
+fixed: a `measure` step asserts nothing, it records, and that recording is what feeds repo-health's
+per-commit performance trend. A reviewer reading the file could not see that; deleting the
+baselines would have blinded the trend to fix nothing. Recorded here so it is not re-raised.
+
+The three that remain:
 
 - **Core includes platform, compiled core in `mm_core`.** `src/core/moonlive/MoonLive.cpp` `#include`s `platform/platform.h` and calls the exec-memory API directly, and the root `CMakeLists.txt` compiles `MoonLive.cpp`/`MoonLiveCompiler.cpp` into `mm_core` and links `mm_core → mm_platform` — violating the header-only-core / no-platform-includes contract both files declare. The runtime exec-memory placement layer wants a core-neutral injected interface (or to move out of `src/core`), so the compiled/platform-dependent surface sits behind `mm_platform` and `mm_core` stays INTERFACE-only. These two are one change (same boundary).
 - **W^X disabled in the board default.** `esp32/sdkconfig.defaults.esp32s3-n16r8` turns off `CONFIG_ESP_SYSTEM_MEMPROT_FEATURE` and enables `CONFIG_HEAP_HAS_EXEC_HEAP` for *every* build on that board, even with no MoonLive effect installed. The JIT genuinely needs a writable-then-executable heap, but that belongs in a dedicated MoonLive/JIT opt-in overlay or an explicit build profile, not the board default — so a stock build keeps memory protection on.
-- **A scenario rides timing + network.** `test/scenarios/light/scenario_modifier_chain.json` carries `tick_us` baselines (host-performance dependent) and routes a modifier-chain-composition test through `NetworkSendDriver` (pulls network-path behavior into a test that is not about the network). It wants an in-process sink and structural assertions so it stays hermetic, per the `test/**` "no timing or network dependence" rule.
-
 ## MoonI80 prime-only ring: no stall backstop (sibling-path gap)
 
 **Found:** 👾 Reviewer, pre-commit on the whole-frame stall fix (2026-07-22).
@@ -1342,7 +1348,7 @@ Lower risk than the RGMII case (six pins rather than twelve, and nothing of ours
 
 ## Input transports: foot pedals, USB game controllers, and MoonLive at the pins (2026-09-01)
 
-`ButtonService` shipped with the [GPIO seam](../history/plans/Plan-20260901%20-%20Input%20services%20and%20the%20GPIO%20seam.md)
+`ButtonService` shipped with the [GPIO seam](../history/plans/Plan-20260901%20-%20Input%20mapping%20and%20scripted%20sensors.md)
 (`gpioInputBegin` / `gpioRead` / `gpioWrite`). It names a target as `Module.control` and writes it
 through `Scheduler::setControl`, so a press and an OSC message are indistinguishable downstream.
 Three follow-ups build on that seam rather than beside it.
diff --git a/docs/backlog/backlog-light.md b/docs/backlog/backlog-light.md
index f096df52..1da07234 100644
--- a/docs/backlog/backlog-light.md
+++ b/docs/backlog/backlog-light.md
@@ -368,7 +368,7 @@ So the fix is scoped to the preview, and the open question is where travel is de
   fixture someone plugged in. The leanest thing that stops the lie.
 - **The light preset** — correct once two different heads run at once, but a preset is a
   *channel-role* layout today, and carrying physical travel widens what a preset means. Belongs
-  with the [fixture model](#fixture-model--moving-heads-beams-long-term), not before it.
+  with the [fixture model](#fixture-model-moving-heads-beams-long-term), not before it.
 
 **Positioning is 8-bit while the fixture offers 16.** The bench head has a fine channel for each
 axis ([light fixtures reference](../reference/light-fixtures.md)); both sit unused, so pan resolves
@@ -450,7 +450,7 @@ writes are sequential: for each output row, walk its source row once and emit `s
 each light's colour, then `memcpy` that finished row to the remaining `scale - 1` rows of the
 block. Same output, one pass through the destination in address order.
 
-### Sprite follow-ups (draw::sprite + FlyingToasters shipped; [spec + plan](../history/plans/Plan-20260827%20-%20Sprites%20and%20flying%20toasters.md))
+### Sprite follow-ups (draw::sprite + FlyingToasters shipped; spec + plan in the plans archive)
 
 Deliberately deferred when sprites landed: P4 PPA acceleration behind the same `draw::sprite`
 signature (the 2D-DMA blitter the WLED-MM-P4 world uses via LovyanGFX; ours would sit in the
@@ -826,3 +826,44 @@ The LED-driver increments **shipped**: increment 1 (RMT/WS2812B single-strand on
   I2S0 first.
 
 (The shared lane-driver scaffolding extraction — when a 3rd parallel backend lands — is tracked separately under [§ Extract shared lane-driver scaffolding](#extract-shared-lane-driver-scaffolding-when-the-3rd-parallel-backend-lands-deferred) above.)
+
+## FixedPoint fades outside the Layer's aggregation (2026-09-07)
+
+`FixedPointEffect` calls `draw::fade` directly where every other fading effect calls
+`layer()->fadeToBlackBy`, so it skips what the Layer adds: the per-frame aggregation (N effects on
+one layer cost one buffer pass, gentlest rate wins), the framerate scaling, the sub-unit carry, and
+the buffer-generation bump. Invisible until a second effect shares the layer.
+
+The swap is one line and was tried: it makes the effect **3.1x brighter at high framerate than at
+low**, against the 1.35x band `unit_Effects_framerate` enforces. The two calls mean different
+things. `draw::fade(cv, n)` applies n every frame; `fadeToBlackBy(n)` is a RATE per reference frame
+that Layer scales by elapsed time. The `fade` control (default 70, range 0..255) was tuned against
+the first meaning, so moving it needs the default re-tuned and the trail looked at on a device, not
+a silent swap.
+
+Worth doing, as its own change: it is the last effect outside the shared fade path, and while it
+stays outside, "every fade goes through the Layer" is not true.
+
+## Downloading a scripted palette can repoint the active one (2026-09-06)
+
+Found while testing the palette-download fixes. A `.mlp` that sorts BEFORE an already-installed one
+silently changes what the current selection points at: with `fire.mlp` active at index 60,
+downloading `beat-flash.mlp` re-sorts the scripted tail and index 60 becomes `beat-flash.mlp`. The
+stored value never moved; what it means did.
+
+[Palette.h](../../src/light/Palette.h) already reasons about exactly this and solves half of it. A
+palette selection is an index: it persists, it rides `seg[0].pal` over the WLED API, and Home
+Assistant renders `paletteNames` positionally, so scripted palettes sort AFTER the built-ins and the
+sixty built-in indices are fixed forever. What is not solved is the scripted tail among itself, and
+that tail now grows at runtime, which is what the download path made reachable.
+
+Nobody has reported it, and the blast radius is small: a rig with one scripted palette cannot hit it,
+and the value re-reads correctly the moment the user picks again. It matters most where a preset or
+an MQTT/HA automation stores the index and replays it later, which is the case where nobody is
+watching the LEDs when it changes.
+
+**What it would take:** persist the scripted palette by NAME alongside the index and re-resolve the
+index on load, so a stored selection survives a re-sort. `paletteScript` already holds the resolved
+file name for the editor, so the value exists; what is missing is using it as the authority when the
+list changes. The alternative, appending new scripts rather than sorting them, keeps indices stable
+but makes the picker unreadable as the list grows, which is the trade the sort was chosen over.
diff --git a/docs/backlog/generative-fields-analysis-bottom-up.md b/docs/backlog/generative-fields-analysis-bottom-up.md
index 777ebdc2..c8296656 100644
--- a/docs/backlog/generative-fields-analysis-bottom-up.md
+++ b/docs/backlog/generative-fields-analysis-bottom-up.md
@@ -156,7 +156,7 @@ Against Part 1's blocks, measured on this tree:
 | Particles | pool, gravity, drag, bounce, collide, splat render | ✅ |
 | Stored-field simulation | none | ⬜ (out of scope unless the top-down wants fluid) |
 
-The persistence contract advection needs already exists: the Layer does not clear between frames, and "a read-prior effect reads last frame's pixels via `draw::get` / `draw::blur`; the persistence *is* its state" ([architecture.md § Buffer persistence](../architecture.md#buffer-persistence--the-layer-does-not-clear-each-frame)). What is missing is the resampler and the bit depth.
+The persistence contract advection needs already exists: the Layer does not clear between frames, and "a read-prior effect reads last frame's pixels via `draw::get` / `draw::blur`; the persistence *is* its state" ([architecture.md § Buffer persistence](../architecture.md#buffer-persistence-the-layer-does-not-clear-each-frame)). What is missing is the resampler and the bit depth.
 
 `PolarNoiseEffect` is the Part 1 shader already: polar addressing, `warp8` in polar space (the angle warped by noise), `kaleido`, a palette, with `octaves` and `warp` exposed as the cost knobs and the header stating the cost ("~4 samples/pixel at octaves=2 … on a large wall drop `octaves` to 1").
 
@@ -194,7 +194,7 @@ What each shipped target brings, from the IDF SoC capability headers and our own
 | desktop | GHz class | double and single | NEON / SSE / AVX | unbounded | 20-40× an S3 per core, plus SIMD ([performance.md](../performance.md), the `collide` measurement) |
 | Teensy 4.x (Cortex-M7), a future target | 1 × 600 MHz | single and double | none (DSP instructions) | 1 MB internal, no PSRAM | not measured; listed in [architecture.md § Scaling to available memory](../architecture.md#scaling-to-available-memory) as a supported class |
 
-**Can the FPU help?** Every target has one, so a float kernel is legal everywhere, and the repo already has the precedent: `raymarch.h` is compiled only where the SoC declares an FPU, as "the one bounded exception to the integer-only render path", while `shader.h` stays fixed point and runs everywhere ([power-functions.md § Raymarching](../moonmodules/light/power-functions.md#raymarching--one-technique-inside-a-shader)). The honest expectation: on these cores a float multiply costs about what an integer multiply costs, so an FPU does not make a noise sample cheaper; it makes square roots, arctangents and trig cheap enough to skip the tables, and it lets a float reference algorithm run unconverted where an exact fixed-point port is not worth writing yet. The portable contract stays fixed point; the FPU is a per-target acceleration behind it, per the standing decision.
+**Can the FPU help?** Every target has one, so a float kernel is legal everywhere, and the repo already has the precedent: `raymarch.h` is compiled only where the SoC declares an FPU, as "the one bounded exception to the integer-only render path", while `shader.h` stays fixed point and runs everywhere ([power-functions.md § Raymarching](../moonmodules/light/power-functions.md#raymarching-one-technique-inside-a-shader)). The honest expectation: on these cores a float multiply costs about what an integer multiply costs, so an FPU does not make a noise sample cheaper; it makes square roots, arctangents and trig cheap enough to skip the tables, and it lets a float reference algorithm run unconverted where an exact fixed-point port is not worth writing yet. The portable contract stays fixed point; the FPU is a per-target acceleration behind it, per the standing decision.
 
 **Where the family shines on an MCU.** The S3 is the baseline this document measures against because it is the bench board with numbers, not because it is the target. The P4 is the natural home of the shader half: the highest clock, four-lane SIMD, hardware loops and 32 MB of PSRAM put a 64² composition and a 128² single-layer field inside its budget, and the S31 sits next to it on every axis. The classic is the portable floor, the target that keeps the contract honest. The top-down should size the showcases for the P4 and S31, keep them running on the S3, and let the classic degrade by the cost knobs.
 
diff --git a/docs/coding-standards.md b/docs/coding-standards.md
index 94966a51..1e5aa9bb 100644
--- a/docs/coding-standards.md
+++ b/docs/coding-standards.md
@@ -20,7 +20,17 @@ Decided once; not re-derived per file.
 - **Consider extending before creating.** When adding a feature, check whether an existing module extends cleanly; a new file is fine if genuinely cleaner, but justify it.
 - **Do not remove comments** unless they are outdated or factually wrong. Comments document intent and context; removing them silently loses knowledge.
 - **Reference, don't copy.** Prior art (friend repos, datasheets, our own prototype branches) holds proven approaches: study it, take the ideas, write our own code, never copy or trace the structure. Credits live in the [friend-repo digests](friend-repos/README.md) and per-module prior-art sections.
-- **Minimal comments in MoonLive scripts.** A `.mle`/`.mll`/`.mlm` is a user-facing artifact shown in an editor on the device's own card, not a C++ source file: the reader is looking at the effect, and a comment block longer than the code buries it. One or two lines at the top saying what the effect IS, and a short note only where a line would otherwise read as a mistake. Everything else, the reasoning behind a formulation, the measured numbers, the language limits it works around, belongs in the commit message or the roadmap. This is the one place the "do not remove comments" rule above yields: on these files, trim.
+- **Minimal comments in MoonLive scripts, in exactly three places.** A `.mle`/`.mll`/`.mlm`/`.mls`/`.mlp` is a user-facing artifact shown in an editor on the device's own card, not a C++ source file: the reader is looking at the effect, and a comment block longer than the code buries it. So the budget is fixed, and it is one line each:
+
+    | where | what it says |
+    |---|---|
+    | **one line at the top** | what the script IS, in a phrase a user would recognize |
+    | **one line after each `addControl`** | what that knob does, from the user's side |
+    | **one line before each function the script defines itself** | what that helper does, so a reader need not decode it |
+
+    The third is the one to get right as scripts grow helpers: a named function is a promise about what it does, and the line is where that promise is written. Lifecycle functions (`tick`, `defineControls`, `placeLights`, `modifyLogical`, …) need no line: their names are the contract and the reader already knows them.
+
+    Everything else, the reasoning behind a formulation, the measured numbers, the language limits it works around, belongs in the commit message or the roadmap. This is the one place the "do not remove comments" rule above yields: on these files, trim.
 - **Present-tense litmus.** "There is no MCLK pin" states a property (keep); "no X anymore" narrates a removal (cut it; describe the path that exists).
 
 ## Prefer integers, store values in their native shape
@@ -198,7 +208,7 @@ Two corollaries. **Reference a module generically** in prose outside its own hom
    - `light/{effects,modifiers,layouts,drivers,supporting}.md` — the light-catalog + light-supporting pages (a type may later split by library into `effects_wled.md` / `effects_moonmodules.md`, still flat).
    - `core/{services,supporting,ui}.md` — the core-services (user-facing modules), core-supporting, and web-UI summary pages.
 
-   **The Links column** is assembled by the hook in a fixed order — **🧪 Tests · 📄 Technical · attribution · ⌄ details** — each with a Material icon (`:material-…:`, rendered as inline SVG by `pymdownx.emoji`, the same mechanism as the tag emoji in the Name column) so a link's *type* is scannable. A card carries these lines: a `[Tests](../../../tests/unit-tests.md#<anchor>)` line (omitted when the module has no unit test — a missing Tests link truthfully means "untested"), a **`Detail: [technical](../moxygen/<Stem>.md)`** line pointing at the generated technical page, and an `Origin:` attribution line. `check_specs` matches each block to its `.h` via that `moxygen/<Stem>.md` link, so keep the link's target on it.
+   **The Links column** is assembled by the hook in a fixed order (**🧪 Tests · 📄 Technical · attribution · ⌄ details**), each with a Material icon (`:material-…:`, rendered as inline SVG by `pymdownx.emoji`, the same mechanism as the tag emoji in the Name column) so a link's *type* is scannable. A card carries these lines: a `[Tests](../../tests/unit-tests.md#<anchor>)` line (omitted when the module has no unit test, so a missing Tests link truthfully means "untested"), a **`Detail: [technical](../moxygen/<Stem>.md)`** line pointing at the generated technical page, and an `Origin:` attribution line. `check_specs` matches each block to its `.h` via that `moxygen/<Stem>.md` link, so keep the link's target on it.
 
    Cross-file design rationale that no single `.h` owns (module interactions, buffer-lifecycle coupling) is a prose section beneath a summary page's table — a `## <Name> — details` section the hook links from the row as `⌄ details`. That's the only home for it, so a module needs no page of its own.
 
diff --git a/docs/gettingstarted.md b/docs/gettingstarted.md
index 8adcdf3d..5d23369c 100644
--- a/docs/gettingstarted.md
+++ b/docs/gettingstarted.md
@@ -85,7 +85,7 @@ Leave **Release** and **Firmware** at their suggested values (the newest stable
 build, and the firmware that matches your device). Tick **Erase chip first** only
 if you're starting clean, switching firmware, or updating a 4 MB classic board
 (esp32 / wrover / eth) from a release before v4.0. That last update must erase:
-its partition layout changed ([MIGRATING](../MIGRATING.md)), and if the device already holds
+its partition layout changed ([MIGRATING](MIGRATING.md)), and if the device already holds
 config you care about, back it up first ("Back up a device's config first" on the
 installer page): erasing wipes WiFi credentials and all settings, and the backup
 brings them back after the flash (its report lists anything it could not carry).
@@ -304,6 +304,43 @@ keep going.
 
 ---
 
+### If your device shows MoonBase
+
+**MoonBase** is a small recovery image built into your device. If a firmware update
+is interrupted, or an installed firmware does not start, your device boots MoonBase
+instead of going dark, and its page offers you three ways out:
+
+- **Boot the app** puts you straight back if the firmware is still fine. Try this
+  first: it changes nothing on the device.
+- **From a file** installs a firmware you have already downloaded. Get the
+  `firmware-...bin` matching your device from the
+  [releases page](https://github.com/MoonModules/projectMM/releases).
+- **From a URL** downloads and installs in one step. The releases page gives you a
+  link to each file; paste it here and your device fetches it directly.
+
+Installing takes a few minutes, and the page reports its progress as it downloads.
+Your device reboots into the new firmware on its own when it finishes.
+
+Two things worth knowing. A failed install **stays** in MoonBase rather than
+pretending to have worked, so you can simply try again. And you cannot break a
+device this way: MoonBase is never overwritten by an update, so it is still there
+for the next attempt, including after a power cut in the middle of one.
+
+If your device is not on your network at all, MoonBase opens its own WiFi access
+point and is reachable at **4.3.2.1** once you join it.
+
+MoonBase shows its own version on its page, and your device's Firmware card shows
+which MoonBase it carries. If that version is marked outdated, the same card installs
+a newer one over the network, so keeping the recovery image current needs no cable.
+
+That update runs from the app, because only the running app can write the partition
+MoonBase lives in. So it is a way to keep MoonBase fresh, not a way back from a
+device that will not start: if the app cannot run, or MoonBase itself will not boot,
+that still takes a cable. Your device checks the image first, refusing anything whose
+magic bytes, chip or description say it is not a MoonBase image for this chip.
+
+---
+
 ### Where to go next
 
 - **Understand the pipeline** — how layouts, layers, effects, modifiers and
diff --git a/docs/history/plans/OPEN-WORK.md b/docs/history/plans/OPEN-WORK.md
new file mode 100644
index 00000000..c39920f3
--- /dev/null
+++ b/docs/history/plans/OPEN-WORK.md
@@ -0,0 +1,39 @@
+# Open work in the unarchived plans
+
+What is left in each plan still sitting in this folder, audited against the tree on 2026-09-07. One
+line per item, pointing rather than restating: the plan itself is the description, this is the
+worklist. A plan leaves this file and moves to `archive/` when its last line here is struck.
+
+Everything not listed here shipped and was archived.
+
+## Small, and closable in a sitting
+
+| plan | what is left |
+|---|---|
+| **MoonLive palettes** | The promised scenario: a scripted palette driving a real effect end to end. Everything else landed. |
+| **OSC control ingest** | `unit_OscModule` and an OSC scenario, both promised. Only `unit_OscPacket` exists. |
+| **Two-way control surfaces** | `unit_ControlSurface` + `unit_OscModule`, a scenario, and the seam section in `docs/reference/control-surfaces.md`. The code is complete. |
+| **Config backup and restore** | One sentence: the installer's erase-confirm should point at backing up config first (`mooninstaller/install.js`). |
+
+## Bench-gated: needs hardware, not keyboard time
+
+| plan | what is left |
+|---|---|
+| **Input mapping and scripted sensors** | Steps 2 and 3 are host-verified but NOT bench-verified. Also open: the `.mls` picker confirmation and the `services.md` MoonLiveService card. |
+
+## Larger, and its own effort
+
+| plan | what is left |
+|---|---|
+| **Input mapping and scripted sensors** | Steps 4 / 4b / 5 / 6 not started: I2C sensors (MPU6050), VL53L8CX zone grid, pulse timing + `EncoderService`, PIR level events. |
+| **MoonLight migration (multi-stage)** | Stage 5's transport (wired DMX-512 in/out) is the one Must-class item for the rename. Also 3 installation-specific layouts, ~31 effects (mostly few-line ports), and LightsControl. Its own Status section has the detail. |
+
+## Worth knowing
+
+**Desktop audio capture is shipped** and archived: its text still says "remaining before shipped",
+but the fleet test it names was later marked verified, leaving only a post-merge run by a Windows
+tester, which is not a deliverable.
+
+**Four of the six partials are missing only tests or a doc line.** That is the pattern worth acting
+on: the features landed and the pinning did not, which is exactly the gap that goes unnoticed until
+something breaks. Closing all four is a sitting's work and would archive three more plans.
diff --git a/docs/history/plans/Plan-20260630 - MoonLight migration (multi-stage).md b/docs/history/plans/Plan-20260630 - MoonLight migration (multi-stage).md
index 515984ba..a5dd53bf 100644
--- a/docs/history/plans/Plan-20260630 - MoonLight migration (multi-stage).md	
+++ b/docs/history/plans/Plan-20260630 - MoonLight migration (multi-stage).md	
@@ -33,19 +33,91 @@ Two cross-cutting rules govern every stage, from [CLAUDE.md](../../../CLAUDE.md)
 
 No other hidden hard dependencies: our `EffectBase` + extrude (now 1D-along-Y, matching MoonLight) + `Buffer` already provide the render context.
 
-## Status — verified 2026-08-24
+## Status — verified 2026-09-07
 
-Measured against the tree, not inferred from the stages below.
+Measured against both trees on 2026-09-07 (96 commits after the previous status), by counting
+MoonLight's `name()` declarations against our registered modules and script library. Counts are
+what the trees say, not what the stages below predicted.
+
+| | MoonLight | projectMM | Gap |
+|---|---|---|---|
+| Effects | 88 | 66 compiled + 32 scripted | see below |
+| Modifiers | 9 (+1 template) | 11 | **none: complete, plus 2 of our own** |
+| Layouts | 16 (+1 template) | 17 | **3 absent, all installation-specific** |
+| Drivers | 11 (+1 template) | 17 | **3 absent: DMX in/out, HUB75, IMU** |
 
 | Stage | State |
 |---|---|
-| 1 — Foundations | **shipped.** `src/light/Palette.h` (16-entry CRGBPalette16 model, gradient stops from MoonLight's palettes.h), `src/light/draw.h`, the FastLED-named primitives, GoL re-port. |
-| 2 — Doc model | **not started.** `docs/moonmodules/` is still `core/` + `light/`; no `effects_<library>.md` pages, `check_specs.py` still on the per-module contract. |
-| 3+ — Effect batches | **partial.** 52 effects, 12 modifiers, 18 layouts registered (baseline was ~21 / 5 / 3). 44 MoonLive scripts, a delivery route this plan did not anticipate. |
-| 4 — Modifiers + layouts | **partial**, counted above. |
-| 5 — Moving heads / DMX | **not started**, and the largest remaining gap. No DMX-512 output driver exists; RS-485 is backlog-only ([backlog-light](../../backlog/backlog-light.md#rs-485-dmx-512-wired-output-future-the-physical-dmx-driver)) and the fixture model is marked long-term and **undesigned** ([backlog-light](../../backlog/backlog-light.md#fixture-model-moving-heads-beams-long-term)). Design precedes the driver here. |
-
-**Release positioning (product owner, 2026-08-24):** v4.0.0 ships as the scripting-and-desktop release and does **not** take the MoonLight name. Replacing MoonLight moves to v5.0.0, gated on four things beyond effect breadth: DMX light bars and moving heads (tested on hardware), the LightsControl module reaching maturity, MoonLive palettes, and a documentation pass.
+| 1 — Foundations | **shipped.** Palette, draw primitives, the FastLED-named set, GoL re-port. |
+| 2 — Doc model | **shipped, differently.** The per-library `effects_<library>.md` split was NOT built; the catalog is one page per TYPE (`effects.md`, `layouts.md`, `modifiers.md`, `drivers.md`) with a table row per module. That solves the same problem the stage existed for (no per-module explosion) with fewer pages, and `check_specs.py` enforces it. **The stage as written is obsolete: what shipped is better and the ADR's premise (library as a doc split) went unused.** |
+| 3 — Effect batches | **substantially done.** 66 compiled effects and 32 scripted, against a ~21 baseline. |
+| 4 — Modifiers + layouts | **done for modifiers** (all 9 ported). **Layouts: 14 of 16**, the three absent ones being specific installations rather than shapes. |
+| 5 — Moving heads / DMX | **partial, and now the largest gap.** The EFFECT side shipped (`MovingHeadEffect` plus 5 `mh-*.mle` scripts, with pan/tilt/zoom/rotate/gobo reachable from both C++ and script). The TRANSPORT did not: there is still no DMX-512 output driver, and no DMX input. |
+
+### What is genuinely missing (2026-09-07)
+
+**Drivers, the real gap.** Three of MoonLight's have no counterpart here:
+
+- **DMX Out** (and **DMX In**). The fixture model, the channel roles and the moving-head effects all
+  landed, so a head can be driven over Art-Net today; what is missing is WIRED DMX-512 over RS-485.
+  Tracked in [backlog-light § RS-485](../../backlog/backlog-light.md), where the analysis notes the
+  channel-mapping half is already solved and what remains is the transport (a UART in RS-485 mode,
+  break/mark timing) plus a physical transceiver. **This is the one Must-class gap for the rename.**
+- ~~**HUB75.**~~ **Out of scope, decided 2026-09-07.** MoonLight drives these panels; projectMM
+  will not. No longer a gap: a choice.
+- **IMU.** Sensor input beyond the microphone. The rename doc already files this as a Could.
+
+**Layouts (3):** `16 Rings`, `SE16`, `LightCrafter16`. Each is one installation's wiring rather than
+a reusable shape. **The product owner owns all three (2026-09-07)**, so they are real parity items
+and each is bench-verifiable once written: a layout is a coordinate iterator, so these are small,
+and the hardware to check them against is on hand.
+
+**Effects: 57 of MoonLight's 88 do not match ours by NAME, but a behavior-by-behavior read of both
+trees puts the real gap at 31.** The other 26 exist here under a different name or in a reduced form:
+
+- **15 covered.** Fixed-Point Canvas Demo is our `FixedPointEffect`, Scrolling Text is `TextEffect`,
+  Noise 2D and Noise Move are two `motion` settings of one `NoiseEffect`, Waterfall and Freq Wave
+  are both `FreqMatrixEffect`, Julia is `fractal.mle`, the Troy / Wowi / Ambient heads are the
+  `mh-*.mle` scripts, and our `VuMetersEffect` is richer than the original.
+- **11 partial**, where something related exists but is meaningfully less: Audio Rings vs
+  `RadialSpectrum` (no per-band ring history), Meteor vs `comet-trail.mle` (no randomized per-pixel
+  trail decay), Drip vs `rain.mle` (no bounce physics), Popcorn vs `Ballpit` (no per-kernel pop),
+  Puddles vs `Blurz`, Noise Fire vs `Fire`, and the Troy / Freq Colors audio-band-to-gobo mapping.
+- **31 absent**, and the shape of that list is the useful finding:
+
+| Theme | Count | Effort |
+|---|---|---|
+| Audio-reactive (Grav*, DJ Light, Freq Map/Pixels, Rocktaves, Ripple Peak, Waverly, Funky Plank) | 11 | A few lines each. Our `AudioFrame` is a SUPERSET of MoonLight's `sharedData`, so these are mechanical. The `Grav*` trio wants one shared ~15-line gravity/peak helper. |
+| Geometric / oscillator (Blackhole, DNA, Frizzles, Oscillate, Radar, Pixel Map, Blink Rainbow) | 7 | A few lines each on `BeatPhase` + `draw::line` + `blur`. Radar wants a ~25-line perimeter walk. |
+| Noise (Phased Noise, Plasmoid) | 2 | A few lines: 1D phase accumulators. |
+| 1D strip (Flow, Police) | 2 | A few lines each. |
+| Fire / volumetric (Spiral Fire) | 1 | Moderate, ~50 lines: a real 3D cone-surface test on the existing `PolarLut`. |
+| Particle agents (Ants) | 1 | Substantial, ~150 lines: a food-gathering agent model with no analogue here. |
+| Content-bound (Mario Test, Moon Man) | 2 | Mario is a few lines on the existing sprite path. **Moon Man is not portable**: it needs M5GFX PNG decoding and an embedded blob. |
+| Other (Heartbeat, FLAudio, and the partials above) | 5 | Heartbeat is a few lines. **FLAudio is not an effect gap but an AUDIO-PIPELINE one**: it visualizes `fl_kick`/`fl_snare`/`fl_bpm`/`fl_vocalConfidence`, fields our analyzer does not produce. |
+
+**So the effect work is mostly small and unblocked.** About 25 of the 31 are few-line ports against
+primitives that already exist; two are genuinely not portable as-is (Moon Man's PNG dependency,
+FLAudio's missing audio fields), and two are real work (Ants, Spiral Fire). Nothing structural
+blocks any of it: the palette, primitives, audio pipeline and draw set all exist.
+
+### The v5.0.0 gates, re-checked
+
+The previous status recorded four gates beyond effect breadth. Two have since shipped:
+
+- **MoonLive palettes — SHIPPED.** The research below is now history rather than a design note: the
+  `setPalEntry`/`setPalEntryHSV` builtins exist, `.mlp` is the palette script kind, and 5 factory
+  palettes ship. The open design questions it lists were answered by the implementation (a palette
+  script is a module ticked by its binding, and the picker lists `.mlp` files from both the user and
+  factory directories). **Keep the section for its record of where the design came from; do not
+  read it as outstanding work.**
+- **DMX light bars and moving heads — HALF.** Effects and the fixture/channel model shipped and are
+  bench-verified over Art-Net; wired DMX output has not. See the driver gap above.
+- **LightsControl maturity — NOT STARTED.** No such module exists. `LightPresetsModule` is the
+  fixture-preset library, a different thing. Still backlogged
+  ([backlog-mixed](../../backlog/backlog-mixed.md)).
+- **Documentation pass — OPEN**, and cheaper than it was: the catalog pages exist and
+  `check_specs.py` keeps them honest, so what remains is a read-through rather than a build-out.
 
 ### MoonLive palettes — how MoonLight does it (research, 2026-08-24)
 
@@ -86,6 +158,55 @@ void loop() {
 
 Checkout note: the MoonLight tree read for this research was at `65869217` (2026-05-26) and may lag upstream; re-fetch before implementing.
 
+## What is left to replace MoonLight (the product owner's decision list)
+
+The question this plan now answers is not "how do we migrate" but "what is still missing before
+projectMM can take the name". Grouped by whether it BLOCKS the rename, on the evidence above.
+
+**Blocking, in the sense that a predecessor user would notice it missing:**
+
+1. **Wired DMX-512 output.** The only Must-class gap. Everything above the wire exists (fixture
+   model, channel roles, moving-head effects, bench-verified over Art-Net); what is missing is the
+   RS-485 transport and a board that carries a transceiver. This is also the item with a hardware
+   dependency, so it has the longest lead time: worth starting before the smaller work.
+2. ~~A decision on HUB75.~~ **DECIDED 2026-09-07: OUT OF SCOPE.** MoonLight drives HUB75 panels and
+   projectMM will not. Recorded here so it stays a decision rather than resurfacing as an unknown.
+
+**Not blocking, and mostly small:**
+
+3. **The 31 absent effects**, of which roughly 25 are few-line ports on primitives that already
+   exist. This is the "does the library feel thin" gate, and at 66 compiled plus 32 scripted against
+   MoonLight's 88 it is arguably already met on count. Worth picking the ones that close CATEGORY
+   gaps a user would feel (the audio-reactive eleven) rather than working the list top to bottom.
+4. **The 11 partials**, each a refinement of something that already works.
+5. **Three layouts** (`16 Rings`, `SE16`, `LightCrafter16`), each one installation's wiring.
+   **The product owner owns this hardware (2026-09-07), so all three are real parity items** rather
+   than speculative ports, and each can be verified on the bench once written.
+6. **LightsControl**, the one v5 gate that has not started. Still a backlog design question.
+7. **DMX In and IMU**, both filed as Could in the rename doc and unchanged by this review.
+
+**Moon Man is NOT portable as-is**: it needs M5GFX PNG decoding plus an embedded image blob.
+
+**FLAudio is an audio-pipeline question, not an effect one**, and it splits cleanly. It draws nine
+columns; four are already expressible with what we have, five are not:
+
+- **Already ours.** Bass / mid / treble levels are aggregates of our `bands[]`. Its beat flag and
+  beat confidence are our `onset` and `flux`, where `onset` is arguably better: it fires on the one
+  block a hit is detected rather than staying latched.
+- **Per-instrument onsets** (`kick`, `snare`, `tom`, `hihat`): spectral flux computed PER FREQUENCY
+  REGION rather than across the whole spectrum, plus a per-drum debounce. Textbook, and the per-band
+  data it needs already exists. **Worth building on its own merit**: per-band onset is a capability
+  many effects would use, not just this one.
+- **BPM**: tempo estimation from inter-onset intervals (autocorrelation over several seconds of
+  history). Real DSP with a memory budget. Useful for anything that locks to tempo; a bigger job.
+- **Vocal detection** (`vocalsActive`, `vocalConfidence`): formant-band energy against the total, a
+  spectral-shape classifier. Highest cost, least reliable, and one effect consumes it.
+  **Recommended: skip**, and let FLAudio ship without those two columns if it ships at all.
+
+**What is already done and no longer needs tracking:** modifiers (all of them, plus two of ours),
+14 of 16 layouts, the palette and primitive foundation, MoonLive palettes, the moving-head effect
+and fixture model, and the doc model (in a better shape than this plan proposed).
+
 ## Stages
 
 ### Stage 1 — Foundations (palette + primitives + GoL re-port)
@@ -106,7 +227,15 @@ The proving-ground stage: build the shared tools, prove them on one hard effect.
 
 Stage-1 exit: palette + primitives compile (-Werror), are unit-tested (each primitive pinned: `beatsin8` range, `inoise8` determinism, `qadd8` saturation, `drawLine` endpoints in 1D/2D/3D), GoL re-port renders correctly + has a scenario, tags legend documented. **No doc explosion yet** (GoL keeps its existing single `.md`; the doc-model change is Stage 2).
 
-### Stage 2 — Doc model: per-library pages  ← next
+### Stage 2 — Doc model: per-library pages  ← SUPERSEDED (see Status)
+
+**What shipped instead is one page per TYPE**, not per library: `effects.md`, `layouts.md`,
+`modifiers.md`, `drivers.md`, each a table of module rows. It solves the doc-explosion problem
+this stage existed for, with four pages rather than a dozen, and `check_specs.py` enforces a
+row per registered module. The plan below is kept as the record of what was considered; the
+per-library page names and the `registerType` remapping it describes were not built and are not
+wanted. [ADR-0015](../../adr/0015-library-is-a-tag-not-a-folder.md)'s conclusion still holds for
+`src`/`assets`/`tests` (library is a tag, not a folder); only its doc-page half went unused.
 
 Before migrating dozens of effects (which would create dozens of `.md`s), switch the doc model. The naming + structure is fixed by the [folder-structure decision](../../adr/0015-library-is-a-tag-not-a-folder.md): **`src`/`assets`/`tests` are `domain/type` folders, flat — library is NOT a folder there**, only a `tags()` emoji; **docs** are the one place library splits, as a **page name** (type-first, underscore-joined, matching how you'd read the folder path): `effects_moonlight.md`, `effects_wled.md`, `effects_projectmm.md`, … (and `modifiers_<lib>.md` etc. only where a library has that type — most libraries are effects-only).
 
@@ -129,11 +258,22 @@ With foundations + doc model in place, migrate MoonLight effects in **themed bat
 
 The batch order below is by dependency/complexity (refine per batch), and **cuts ACROSS the source files** (an audio-reactive batch pulls GEQ3D+PaintBrush from E_MoonModules and the GEQ/Blurz family from E_WLED together) rather than migrating one file at a time — themed batches keep each commit coherent:
 
-- **3a — simple 2D/3D non-audio** (the `E_MoonLight` / `E_WLED` geometric ones: lines, scrolling, lissajous, distortion, starfield…).
-- **3b — palette-heavy** (now that palettes exist: the gradient/noise/plasma family not yet ported).
-- **3c — particle/physics** (bouncing balls, popcorn, blackhole — build on the draw primitives + PRNG).
-- **3d — audio-reactive (♫)** (GEQ, Blurz, Waverly, FreqMatrix… — depend on `AudioModule::latestFrame()`; a shared audio-read helper may be its own small sub-stage).
-- **3e — text/scrolling** (scrolling text needs a font + glyph blitter — its own primitive).
+**Superseded by the 2026-09-07 status: 3a, 3b, 3c and 3e are substantially done.** What remains,
+re-derived from the two trees rather than from the original guess at themes:
+
+- **3d — audio-reactive**, and it is now the LARGEST and CHEAPEST remaining batch: eleven effects
+  (`Grav Center`, `Grav Centric`, `Grav Freq`, `DJ Light`, `Freq Map`, `Freq Pixels`, `Rocktaves`,
+  `Ripple Peak`, `Waverly`, `Funky Plank`, and the `Puddles`/`Puddle Peak` partials). Our
+  `AudioFrame` already exposes more than MoonLight's `sharedData`, so these are mechanical ports on
+  an existing pipeline. The three `Grav*` share one small gravity/peak helper, which is the only new
+  primitive the batch needs. **Recommended next batch if effect breadth is the goal.**
+- **3f — geometric leftovers**: `Blackhole`, `DNA`, `Frizzles`, `Oscillate`, `Radar`, `Pixel Map`,
+  `Blink Rainbow`, `Phased Noise`, `Plasmoid`, `Flow`, `Police`, `Heartbeat`. A few lines each.
+- **3g — the genuinely substantial two**: `Ants` (an agent model with food-gathering rules, no
+  analogue here) and `Spiral Fire` (a 3D cone-surface test on the existing `PolarLut`). Worth their
+  own commit rather than being buried in a batch.
+- **Not portable, do not batch**: `Moon Man` (M5GFX PNG dependency) and `FLAudio` (needs audio
+  fields our analyzer does not produce). See the status section.
 
 ### Stage 4 — Modifiers + layouts migration
 
@@ -141,7 +281,20 @@ The MoonLight modifiers (mirror/tile/kaleidoscope/pinwheel/transpose…) and lay
 
 ### Stage 5 — Moving heads / DMX fixtures (last)
 
-`E_MovingHeads` + fixture layouts + Art-Net moving-head control. Most specialised, fewest dependencies on the rest; deferred to last.
+**Split in two by what actually happened, and only half is left.**
+
+**Done (2026-09):** the fixture model (`FixtureChannels`, the `ChannelRole` vocabulary),
+`MovingHeadEffect` with formations and audio reactivity, the five role setters reachable from
+both C++ and MoonLive scripts (pan, tilt, zoom, rotate, gobo), and five `mh-*.mle` scripts
+carrying MoonLight's Troy / Wowi / Ambient looks. A head is drivable today over Art-Net.
+
+**Left:** the WIRED transport. A DMX-512 output driver over RS-485 (UART, break/mark-after-break
+timing, a transceiver on the board) and, if wanted, DMX input. The channel-mapping half is
+already solved by the per-light channel model, so this is a transport and a hardware question
+rather than a domain one: [backlog-light § RS-485](../../backlog/backlog-light.md) has the
+analysis. **This is the one remaining Must-class item for the rename**, and since 2026-09-07 it is this
+plan's alone: the Release 4 scope plan also listed it, shipped without it, and closed pointing here.
+One home for it now.
 
 ## Riskiest parts
 
diff --git a/docs/history/plans/Plan-20260722 - Release 4 scope - effect breadth + rename runway.md b/docs/history/plans/Plan-20260722 - Release 4 scope - effect breadth + rename runway.md
deleted file mode 100644
index 9bd21226..00000000
--- a/docs/history/plans/Plan-20260722 - Release 4 scope - effect breadth + rename runway.md	
+++ /dev/null
@@ -1,44 +0,0 @@
-# Plan — Release 4 scope: effect breadth + the rename runway
-
-## Context
-
-Release 3 is being cut now. This plan captures the **Release 4** candidates — the next strategic thread after R3 — so the direction is recorded before the work starts. The product owner's steer: the items below are R4, not R3.
-
-The backlog has one dominant strategic thread that most other items orbit: the **projectMM → MoonLight rename** ([backlog rename plan](../../backlog/rename-to-moonlight.md)). Its gate is *"the effect library must not feel thin next to the predecessor's 60+ effects."* Two in-flight plans feed that gate, and R4 is where they land. The shape of R4 is therefore **"the effects release + the rename runway"**: grow visible feature breadth while moving the single most important strategic gate (rename readiness), and leave the hardware-verification-bound driver work to its own dedicated push.
-
-This is a roadmap/scope plan, not a single-feature `/plan`. Each item below gets its own `/plan` + commit when reached; this document is the *map* and the *why*.
-
-## The spine — effect-breadth parity (headline)
-
-**MoonLight migration, Stage 1 + the next effect batch.** ([Plan-20260630 - MoonLight migration (multi-stage)](Plan-20260630%20-%20MoonLight%20migration%20(multi-stage).md).)
-
-This is the biggest lever and the explicit *"execution vehicle for the effect-breadth parity gate."* ~21 of the predecessor's 60+ effects are ported. Stage 1's prerequisites are the highest-value core work available, because every future effect leans on them:
-
-- **Shared palette** — hard prerequisite; many effects color via `ColorFromPalette`. Generalize the pattern `PlasmaPaletteEffect` hard-codes today.
-- **The shared primitive library** — FastLED-named, our own implementation, hot-path-tuned integer-only: `beatsin8`, `inoise8`, `qadd8`, `nscale8`, `random8`/`random16`, `ColorFromPalette`, and the dimension-agnostic draw set. Extends the existing `color.h` (`scale8`, `sin8`).
-- **Tag/emoji legend** — settle before batch-migrating so every module is consistent from batch one.
-- **Per-library doc model** — `effects_<library>.md` compact table rows (per [ADR 0015](../../adr/0015-library-is-a-tag-not-a-folder.md)); changes the `check_specs.py` contract.
-
-Then the next migration batch on top. This is the R4 headline: it unblocks the rename *and* is pure user-visible feature growth.
-
-## Two quick wins — scoped and ready
-
-- **Active-instance election primitive.** ([Plan-20260710 - Active-instance election primitive](Plan-20260710%20-%20Active-instance%20election%20primitive.md).) A core `ActiveInstance<T>` that removes duplicated singleton-election bookkeeping from `AudioService` + `DevicesModule` (both had real dangling-static bugs). Textbook *Complexity-lives-in-core* subtraction; small; in flight.
-- **CodeRabbit #29 boundary findings (4).** ([backlog-core § MoonLive core/platform layering](../../backlog/backlog-core.md#moonlive-coreplatform-layering-jit-sdkconfig-scoping-coderabbit-29-4-findings).) MoonLive core-includes-platform + compiled-into-`mm_core`, W^X disabled in the board default, a scenario riding timing + network. Real, already scoped; good hygiene to close before a named release.
-
-## The RS-485 / DMX-512 opportunity (candidate, larger)
-
-The [P4-shield RS-485/DMX hardware is now well documented](../../reference/mhc-wled-esp32-p4-shield.md) (the builder's schematics landed 2026-07-16). The **RS-485 / DMX-512 wired-output driver** + its **`platform::` UART-RS485 seam** ([backlog-light](../../backlog/backlog-light.md#rs-485-dmx-512-wired-output-future-the-physical-dmx-driver)) is demand-driven and self-contained. It is a meaty new capability — a flagship candidate if R4 wants a headline new-hardware feature alongside the effects work, but it is larger than the two quick wins and should be its own `/plan`.
-
-## High-light-count driver work (in R4 — hardware-verified)
-
-The streaming-ring / lane-driver work is **in R4**. It is hardware-verification-heavy — each item needs the expander wall (and the relevant board) to prove, so these land with bench sign-off, not blind:
-
-- **Classic-ESP32 shift-register ring on raw I2S** ([backlog-light "WANTED"](../../backlog/backlog-light.md#drivers)) — the high-light-count classic driver.
-- **P4 Parlio streaming ring** ([backlog-light "WANTED"](../../backlog/backlog-light.md#drivers)) — lift the P4 Parlio ceiling past ~21K to light-count-independent.
-- **Shared lane-driver scaffolding** — extract when the 3rd parallel backend lands (deferred until then, but that 3rd backend is one of the two above).
-- **MoonI80 prime-only ring stall backstop** ([backlog-core](../../backlog/backlog-core.md#mooni80-prime-only-ring-no-stall-backstop-sibling-path-gap)) + the whole-frame late-EOF serialization hardening — the sibling-path recovery gaps; verify on the expander wall.
-
-## Success shape
-
-R4 ships when: the migration Stage-1 primitives + the next effect batch have landed (moving the rename's breadth gate forward), the `ActiveInstance` primitive and the CodeRabbit #29 boundary fixes are in, the RS-485/DMX driver reaches a verified first output, and the high-light-count driver work above is bench-verified. The rename itself is a *separate* cutover (its own plan); R4 is the runway that makes the name not a downgrade, not the switch.
diff --git a/docs/history/plans/archive/Plan-20260522 - UI rewrite to ui-spec.md baseline (item 12) (shipped).md b/docs/history/plans/archive/Plan-20260522 - UI rewrite to ui-spec.md baseline (item 12) (shipped).md
index bd2283bf..82cc974c 100644
--- a/docs/history/plans/archive/Plan-20260522 - UI rewrite to ui-spec.md baseline (item 12) (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260522 - UI rewrite to ui-spec.md baseline (item 12) (shipped).md	
@@ -193,10 +193,10 @@ Three small additions in `test/`:
 - [test/CMakeLists.txt](test/CMakeLists.txt) — register
 
 **Docs:**
-- [docs/moonmodules/core/SystemModule.md](docs/moonmodules/core/SystemModule.md)
-- [docs/moonmodules/core/HttpServerModule.md](docs/moonmodules/core/HttpServerModule.md)
-- [docs/moonmodules/core/MoonModule.md](docs/moonmodules/core/MoonModule.md)
-- [docs/testing.md](docs/testing.md)
+- [docs/moonmodules/core/SystemModule.md](../../../moonmodules/core/moxygen/SystemModule.md)
+- [docs/moonmodules/core/HttpServerModule.md](../../../moonmodules/core/moxygen/HttpServerModule.md)
+- [docs/moonmodules/core/MoonModule.md](../../../moonmodules/core/moxygen/MoonModule.md)
+- [docs/testing.md](../../../testing.md)
 - `git mv docs/moonmodules_draft/core/ui-spec.md docs/moonmodules/core/ui-spec.md`
 - [docs/plan.md](docs/plan.md) — remove step 12
 - [docs/history/plan-11.md](docs/history/plan-11.md) — new
diff --git a/docs/history/plans/archive/Plan-20260523 - Top-level shape change to `Layouts`, `Layers`, `Drivers` (shipped).md b/docs/history/plans/archive/Plan-20260523 - Top-level shape change to `Layouts`, `Layers`, `Drivers` (shipped).md
index dd243bcb..60e7ae80 100644
--- a/docs/history/plans/archive/Plan-20260523 - Top-level shape change to `Layouts`, `Layers`, `Drivers` (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260523 - Top-level shape change to `Layouts`, `Layers`, `Drivers` (shipped).md	
@@ -184,12 +184,12 @@ Wait — that adds noise. Let me reconsider:
 
 ### Spec updates
 
-- **[docs/moonmodules/light/Layer.md](docs/moonmodules/light/Layer.md)** — update intro to "renders into a buffer sized by either the full Layouts extent or a carved region (start/end controls)." Document the new `setLayouts` method.
-- **[docs/moonmodules/light/Layouts.md](docs/moonmodules/light/Layouts.md)** — rename from `LayoutGroup.md`; class is `Layouts`. Body mostly unchanged (still describes the index-stitching).
-- **[docs/moonmodules/light/Layers.md](docs/moonmodules/light/Layers.md)** — NEW. Describes the container: holds N Layers, runs each in order in `loop()`, future home of the composed-buffer logic. Single-line forward-reference to the composition follow-up.
-- **[docs/moonmodules/light/drivers/Drivers.md](docs/moonmodules/light/drivers/Drivers.md)** — rename from `DriverGroup.md`; class is `Drivers`.
+- **[docs/moonmodules/light/Layer.md](../../../moonmodules/light/moxygen/Layer.md)** — update intro to "renders into a buffer sized by either the full Layouts extent or a carved region (start/end controls)." Document the new `setLayouts` method.
+- **[docs/moonmodules/light/Layouts.md](../../../moonmodules/light/moxygen/Layouts.md)** — rename from `LayoutGroup.md`; class is `Layouts`. Body mostly unchanged (still describes the index-stitching).
+- **[docs/moonmodules/light/Layers.md](../../../moonmodules/light/moxygen/Layers.md)** — NEW. Describes the container: holds N Layers, runs each in order in `loop()`, future home of the composed-buffer logic. Single-line forward-reference to the composition follow-up.
+- **[docs/moonmodules/light/drivers/Drivers.md](../../../moonmodules/light/moxygen/Drivers.md)** — rename from `DriverGroup.md`; class is `Drivers`.
 - **[docs/architecture-light.md](docs/architecture-light.md)** — update the pipeline diagram and any prose that names `LayoutGroup`/`DriverGroup`/singular `Layer`. The "UI integration (light domain)" tree shape gets `Layouts → Layers → Drivers` at the top level.
-- **[docs/moonmodules/light/EffectBase.md](docs/moonmodules/light/EffectBase.md)** — passing reference: parent is still `Layer`, no change.
+- **[docs/moonmodules/light/EffectBase.md](../../../moonmodules/light/moxygen/EffectBase.md)** — passing reference: parent is still `Layer`, no change.
 - **[docs/plan.md](docs/plan.md)** — add a `Multi-Layer composition (pending)` entry covering (a) compose, (b) per-Layer start/end carving activation.
 - **[README.md](README.md)** — scan for module type names; update if any examples use `LayoutGroup`/`DriverGroup`.
 
@@ -218,7 +218,7 @@ Wait — that adds noise. Let me reconsider:
 4. **Add `class Layers`** in [src/light/Layers.h](src/light/Layers.h). Add `setLayouts()` to `Layer`. main.cpp creates `Layers` containing one `Layer`. Run all tests; live-verify with a desktop run that the pipeline still produces frames.
 5. **Add `start/end` controls to `Layer`** — uint16 (or int16 if available) with sensible bounds. Default = whole layout. `rebuildLUT()` honours them when not at default. Update `test_layer*.cpp` and add a test asserting "Layer with default start/end matches old Layer behaviour byte-for-byte."
 6. **UI emoji pick** for `ModuleRole::Layer` — ask the product owner. Add to `ROLE_EMOJI` map in [src/ui/app.js](src/ui/app.js).
-7. **Update specs** ([Layer.md](docs/moonmodules/light/Layer.md), new [Layouts.md](docs/moonmodules/light/Layouts.md), new [Layers.md](docs/moonmodules/light/Layers.md), new [Drivers.md](docs/moonmodules/light/drivers/Drivers.md), [architecture-light.md](docs/architecture-light.md), [plan.md](docs/plan.md), [README.md](README.md) if needed). Run [check_specs.py](moondeck/check/check_specs.py).
+7. **Update specs** ([Layer.md](../../../moonmodules/light/moxygen/Layer.md), new [Layouts.md](../../../moonmodules/light/moxygen/Layouts.md), new [Layers.md](../../../moonmodules/light/moxygen/Layers.md), new [Drivers.md](../../../moonmodules/light/moxygen/Drivers.md), [architecture-light.md](docs/architecture-light.md), [plan.md](docs/plan.md), [README.md](README.md) if needed). Run [check_specs.py](moondeck/check/check_specs.py).
 8. **Migration**: FilesystemModule deletes `.config/LayoutGroup.json` and `.config/DriverGroup.json` if present, logs a warning.
 9. **All pre-commit gates 1–6** (build, ctest, scenarios, platform boundary, specs, ESP32). Reviewer agent (gate 7) after.
 
diff --git a/docs/history/plans/archive/Plan-20260525 - Release-channel picker + first-boot WiFi provisioning (shipped).md b/docs/history/plans/archive/Plan-20260525 - Release-channel picker + first-boot WiFi provisioning (shipped).md
index e32ed1cc..bf5a8f51 100644
--- a/docs/history/plans/archive/Plan-20260525 - Release-channel picker + first-boot WiFi provisioning (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260525 - Release-channel picker + first-boot WiFi provisioning (shipped).md	
@@ -418,7 +418,7 @@ Track 3 total: **3.0 h**. Sequential within the track. Hardware verification (st
 - [src/core/FirmwareUpdateModule.h](src/core/FirmwareUpdateModule.h) — on-device OTA MoonModule (header-only).
 - [src/core/ImprovProvisioningModule.h](src/core/ImprovProvisioningModule.h) — Improv listener MoonModule (header-only). **Track 3.**
 - [moondeck/build/improv_provision.py](moondeck/build/improv_provision.py) — pyserial CLI for headless / rack provisioning. **Track 3.**
-- [docs/moonmodules/core/ImprovProvisioningModule.md](docs/moonmodules/core/ImprovProvisioningModule.md) — spec page. **Track 3.**
+- [docs/moonmodules/core/ImprovProvisioningModule.md](../../../moonmodules/core/moxygen/ImprovProvisioningModule.md) — spec page. **Track 3.**
 - [docs/history/plan-18.md](docs/history/plan-18.md) — this plan's archive.
 
 **Edited:**
diff --git a/docs/history/plans/archive/Plan-20260626 - MoonLive Stage 0 (native codegen spike) (shipped).md b/docs/history/plans/archive/Plan-20260626 - MoonLive Stage 0 (native codegen spike) (shipped).md
index 538adf24..da93babe 100644
--- a/docs/history/plans/archive/Plan-20260626 - MoonLive Stage 0 (native codegen spike) (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260626 - MoonLive Stage 0 (native codegen spike) (shipped).md	
@@ -1,6 +1,6 @@
 # Plan — MoonLive Stage 0: native-codegen load-bearing spike
 
-> Approved plan record (CLAUDE.md *Plan before implementing*). Implements the first, smallest step of [livescripts-analysis-top-down.md](../../backlog/livescripts-analysis-top-down.md) — its Stage 0 "load-bearing spike", split one notch finer so the single novel hardware risk is isolated and proven before any compiler front-end is written. S3-only, bare-minimum assembler, near-zero language.
+> Approved plan record (CLAUDE.md *Plan before implementing*). Implements the first, smallest step of [livescripts-analysis-top-down.md](../../../backlog/livescripts-analysis-top-down.md) — its Stage 0 "load-bearing spike", split one notch finer so the single novel hardware risk is isolated and proven before any compiler front-end is written. S3-only, bare-minimum assembler, near-zero language.
 
 ## Goal
 
@@ -30,7 +30,7 @@ This is "small in depth AND broad": depth = one statement; broad = the whole ver
 
 ## Architecture placement (respecting the boundaries)
 
-Per [§3.9](../../backlog/livescripts-analysis-top-down.md) (domain-neutral engine core, thin binding) and the **platform boundary** hard rule (ISA codegen lives only in `src/platform/<target>/`):
+Per [§3.9](../../../backlog/livescripts-analysis-top-down.md) (domain-neutral engine core, thin binding) and the **platform boundary** hard rule (ISA codegen lives only in `src/platform/<target>/`):
 
 ```
 src/platform/platform.h                     ← + allocExec/freeExec seam (declaration only)
diff --git a/docs/history/plans/archive/Plan-20260627 - MoonLive Stage 3 (IR seam + assembler, second statement) (shipped).md b/docs/history/plans/archive/Plan-20260627 - MoonLive Stage 3 (IR seam + assembler, second statement) (shipped).md
index 2d1822ed..55590693 100644
--- a/docs/history/plans/archive/Plan-20260627 - MoonLive Stage 3 (IR seam + assembler, second statement) (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260627 - MoonLive Stage 3 (IR seam + assembler, second statement) (shipped).md	
@@ -1,6 +1,6 @@
 # Plan — MoonLive Stage 3: the IR seam + a tiny assembler (second statement)
 
-> Approved plan record (CLAUDE.md *Plan before implementing*). The next rung of MoonLive after the shipped 1a→1b→2 + P4 spike: add the **second statement kind** to the language, which forces the **typed IR** and a **per-ISA assembler** to earn their place (the current AST→emitFill shortcut only works for one fixed routine). Builds on [livescripts-analysis-top-down.md](../../backlog/livescripts-analysis-top-down.md) §3.2 (IR seam), §4 (bounds-check at the IR), §3.4 (host built-ins).
+> Approved plan record (CLAUDE.md *Plan before implementing*). The next rung of MoonLive after the shipped 1a→1b→2 + P4 spike: add the **second statement kind** to the language, which forces the **typed IR** and a **per-ISA assembler** to earn their place (the current AST→emitFill shortcut only works for one fixed routine). Builds on [livescripts-analysis-top-down.md](../../../backlog/livescripts-analysis-top-down.md) §3.2 (IR seam), §4 (bounds-check at the IR), §3.4 (host built-ins).
 
 ## Goal
 
diff --git a/docs/history/plans/archive/Plan-20260630 - Stage 1 palette (shipped).md b/docs/history/plans/archive/Plan-20260630 - Stage 1 palette (shipped).md
index fd852a6c..6e533a0a 100644
--- a/docs/history/plans/archive/Plan-20260630 - Stage 1 palette (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260630 - Stage 1 palette (shipped).md	
@@ -1,6 +1,6 @@
 # Plan — Stage 1 (palette) of the MoonLight migration
 
-The first executable slice of the [migration plan](Plan-20260630%20-%20MoonLight%20migration%20(multi-stage).md): the palette foundation. Design already decided in moonlight-palettes-data.md; this plan is the file split + the implementation specifics. The shared **primitive library** (beat/noise/blend/draw) and the **GoL re-port** are *separate* slices of Stage 1, planned + committed after this — palette is the load-bearing one, done first and alone so it's reviewable.
+The first executable slice of the [migration plan](../Plan-20260630%20-%20MoonLight%20migration%20%28multi-stage%29.md): the palette foundation. Design already decided in moonlight-palettes-data.md; this plan is the file split + the implementation specifics. The shared **primitive library** (beat/noise/blend/draw) and the **GoL re-port** are *separate* slices of Stage 1, planned + committed after this — palette is the load-bearing one, done first and alone so it's reviewable.
 
 ## What ships
 
diff --git a/docs/history/plans/archive/Plan-20260630 - Stage 1 primitive library (math8 + noise + draw + blend) (shipped).md b/docs/history/plans/archive/Plan-20260630 - Stage 1 primitive library (math8 + noise + draw + blend) (shipped).md
index c1918033..b3c0e469 100644
--- a/docs/history/plans/archive/Plan-20260630 - Stage 1 primitive library (math8 + noise + draw + blend) (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260630 - Stage 1 primitive library (math8 + noise + draw + blend) (shipped).md	
@@ -1,6 +1,6 @@
 # Plan — Stage 1 primitive library (math8 + noise + draw + blend)
 
-The remaining foundation of [MoonLight migration Stage 1](./Plan-20260630%20-%20MoonLight%20migration%20(multi-stage).md) (palette + tags-legend already shipped in `d00559c`). Builds the shared, hot-path-tuned integer primitives every migrated effect (Stage 3+) will call, so each effect stays short by leaning on one recognisable set instead of re-rolling beat/noise/blend/draw per effect.
+The remaining foundation of [MoonLight migration Stage 1](../Plan-20260630%20-%20MoonLight%20migration%20%28multi-stage%29.md) (palette + tags-legend already shipped in `d00559c`). Builds the shared, hot-path-tuned integer primitives every migrated effect (Stage 3+) will call, so each effect stays short by leaning on one recognisable set instead of re-rolling beat/noise/blend/draw per effect.
 
 **Prior art:** FastLED — the canonical 8-bit-fixed-point LED library. We carry its *ideas and recognisable names* (`beatsin8`, `inoise8`, `qadd8`, `nscale8`, `random8`, `fadeToBlackBy`, `blend`) and write our own implementation against our architecture, crediting FastLED at each file's header. FastLED's own split is the model: `lib8tion` (math+timing+random), `noise` (inoise), `colorutils` (blend/fade), `hsv2rgb` (color) — draw/Bresenham lives in its 2D/matrix add-ons, not core.
 
diff --git a/docs/history/plans/archive/Plan-20260630 - Stage 3 E_MoonModules batch (GameOfLife + GEQ3D + PaintBrush) (shipped).md b/docs/history/plans/archive/Plan-20260630 - Stage 3 E_MoonModules batch (GameOfLife + GEQ3D + PaintBrush) (shipped).md
index b0c950b9..ea03e0d4 100644
--- a/docs/history/plans/archive/Plan-20260630 - Stage 3 E_MoonModules batch (GameOfLife + GEQ3D + PaintBrush) (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260630 - Stage 3 E_MoonModules batch (GameOfLife + GEQ3D + PaintBrush) (shipped).md	
@@ -1,6 +1,6 @@
 # Plan — Stage 3 E_MoonModules batch (GameOfLife + GEQ3D + PaintBrush)
 
-The first effect-migration batch of [MoonLight migration Stage 3](./Plan-20260630%20-%20MoonLight%20migration%20(multi-stage).md): port all three effects in MoonLight's `Nodes/Effects/E_MoonModules.h` (MoonModules-authored set), built fresh on the Stage-1 primitives (palette, `math8`, `noise`, `draw`). One commit (PO decision). Each effect: study behaviour → reimplement against EffectBase → unit + scenario test → `effects.md` row.
+The first effect-migration batch of [MoonLight migration Stage 3](../Plan-20260630%20-%20MoonLight%20migration%20%28multi-stage%29.md): port all three effects in MoonLight's `Nodes/Effects/E_MoonModules.h` (MoonModules-authored set), built fresh on the Stage-1 primitives (palette, `math8`, `noise`, `draw`). One commit (PO decision). Each effect: study behaviour → reimplement against EffectBase → unit + scenario test → `effects.md` row.
 
 **Method (CLAUDE.md):** study the MoonLight source for *behaviour* (controls, algorithm, state), then write our own code on our architecture — never trace/copy. FastLED/MoonLight credited as prior art in each `tags()` + the effect's header + the `effects.md` row.
 
diff --git a/docs/history/plans/archive/Plan-20260702 - Docs system overhaul (Phase 0 through Docs v2) (shipped).md b/docs/history/plans/archive/Plan-20260702 - Docs system overhaul (Phase 0 through Docs v2) (shipped).md
index 7a904abc..14774c64 100644
--- a/docs/history/plans/archive/Plan-20260702 - Docs system overhaul (Phase 0 through Docs v2) (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260702 - Docs system overhaul (Phase 0 through Docs v2) (shipped).md	
@@ -34,7 +34,7 @@ but excluded from the published nav. ~104 `docs/install/`→`web-installer/` ref
 projectMM-native), one table row per module. `check_specs.py` moved from file-scoped to **page-scoped**
 control-name validation. Drivers stayed per-file at the time (later folded into `drivers.md` +
 per-driver moxygen pages by Docs v2). Library stays a *tag* + a *doc split*, never a folder axis (the
-[folder-structure decision](../../adr/0015-library-is-a-tag-not-a-folder.md)).
+[folder-structure decision](../../../adr/0015-library-is-a-tag-not-a-folder.md)).
 
 ### Phase 1+2 — nav fold + generated tests in the build
 Phase 1 (audience-split nav) was mostly delivered by Phase 0. Phase 2: the test-inventory pages
@@ -104,5 +104,5 @@ built fresh) from its `.h` `///` comments; each catalog summary row links to it.
 - **Doxide** — abandoned (above); moxygen delivered the goal.
 - **Per-library page splits** (`effects_wled.md`) — future growth, a lift-not-rewrite when a library
   section outgrows its page; the flat filenames + sections are already in place for it.
-- **assets/ and test/ type-splits** — the [folder-structure decision](../../adr/0015-library-is-a-tag-not-a-folder.md)'s
+- **assets/ and test/ type-splits** — the [folder-structure decision](../../../adr/0015-library-is-a-tag-not-a-folder.md)'s
   remaining "mirror src's domain/type shape" work; independent of the doc-content overhaul.
diff --git a/docs/history/plans/archive/Plan-20260704 - IrModule brightness (shipped).md b/docs/history/plans/archive/Plan-20260704 - IrModule brightness (shipped).md
index a011ef28..d294833d 100644
--- a/docs/history/plans/archive/Plan-20260704 - IrModule brightness (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260704 - IrModule brightness (shipped).md	
@@ -15,7 +15,7 @@ Confirmed with the product owner:
   per board via `deviceModels.json`; NOT a hardcoded child of System.
 - **Start minimal, grow later** — brightness up/down now; richer remote mapping is a follow-up.
 
-Backlog alignment ([backlog-mixed.md](../../backlog/backlog-mixed.md)): IR is named as an input
+Backlog alignment ([backlog-mixed.md](../../../backlog/backlog-mixed.md)): IR is named as an input
 for the eventual **LightsControl** hub. This module is the thin IR *input* peripheral; when
 LightsControl is built it consumes IR via the same static seam (the `AudioModule::latestFrame()`
 pattern). This does not build LightsControl — it builds the IR input and one concrete action.
diff --git a/docs/history/plans/archive/Plan-20260706 - Home Assistant MQTT Discovery (shipped).md b/docs/history/plans/archive/Plan-20260706 - Home Assistant MQTT Discovery (shipped).md
index 3ba1a25f..dfb7c986 100644
--- a/docs/history/plans/archive/Plan-20260706 - Home Assistant MQTT Discovery (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260706 - Home Assistant MQTT Discovery (shipped).md	
@@ -23,7 +23,7 @@ Feature branch `ha-mqtt-discovery` (already created; carries the earlier backlog
 ## Decisions locked (PO)
 
 - **JSON schema** discovery, not default schema.
-- **`unique_id` = `<last6-MAC>`** (the stable id per [ADR-0010](../../adr/0010-integration-identity-stable-hardware-id.md)), `name` = `SystemModule::deviceName()`. Never the editable name as identity.
+- **`unique_id` = `<last6-MAC>`** (the stable id per [ADR-0010](../../../adr/0010-integration-identity-stable-hardware-id.md)), `name` = `SystemModule::deviceName()`. Never the editable name as identity.
 - Gated on a new **`haDiscovery`** bool control (default on where MQTT ships); toggling re-announces / retracts.
 - Existing mqttthing topics unchanged; Discovery is additive.
 
diff --git a/docs/history/plans/archive/Plan-20260708 - TasksModule (nested task view) (shipped).md b/docs/history/plans/archive/Plan-20260708 - TasksModule (nested task view) (shipped).md
index 6cc82be8..dde2183f 100644
--- a/docs/history/plans/archive/Plan-20260708 - TasksModule (nested task view) (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260708 - TasksModule (nested task view) (shipped).md	
@@ -2,9 +2,9 @@
 
 ## Context
 
-projectMM's architecture already commits (🚧, not yet built) to per-module core affinity: "each MoonModule can declare a core affinity; the scheduler respects this when pinning tasks" ([architecture.md § Parallelism](../../architecture.md#parallelism)), and the backlog holds *Task core-pinning* and a *core-1 driver task*. None of the *optimization* exists yet — and you can't optimize what you can't see. This module is the **observability foundation**: show every FreeRTOS task and the projectMM modules that run inside each, with cost. Inspired by MoonLight's [`ModuleTasks`](https://github.com/MoonModules/MoonLight/blob/main/src/MoonBase/Modules/ModuleTasks.h) (a flat task table); projectMM's version nests modules under their task and leans on projectMM's *already-free* per-module self-report.
+projectMM's architecture already commits (🚧, not yet built) to per-module core affinity: "each MoonModule can declare a core affinity; the scheduler respects this when pinning tasks" ([architecture.md § Parallelism](../../../architecture.md#parallelism)), and the backlog holds *Task core-pinning* and a *core-1 driver task*. None of the *optimization* exists yet — and you can't optimize what you can't see. This module is the **observability foundation**: show every FreeRTOS task and the projectMM modules that run inside each, with cost. Inspired by MoonLight's [`ModuleTasks`](https://github.com/MoonModules/MoonLight/blob/main/src/MoonBase/Modules/ModuleTasks.h) (a flat task table); projectMM's version nests modules under their task and leans on projectMM's *already-free* per-module self-report.
 
-Critical framing + the System-Modules taxonomy this fits into: [docs/backlog/system-modules.md](../../backlog/system-modules.md). (The original pre-implementation spec draft was deleted once the module shipped — its final spec is [core/system.md § Tasks](../../moonmodules/core/system.md#tasks) + the `TasksModule.h` `///`.)
+Critical framing + the System-Modules taxonomy this fits into: [docs/backlog/system-modules.md](../../../backlog/system-modules.md). (The original pre-implementation spec draft was deleted once the module shipped — its final spec is [core/system.md § Tasks](../../../moonmodules/core/system.md#tasks) + the `TasksModule.h` `///`.)
 
 ## Decisions locked (PO)
 
diff --git a/docs/history/plans/archive/Plan-20260709 - PinsModule (ownership map, strap-conflict flags, live-state; 4 increments) (shipped).md b/docs/history/plans/archive/Plan-20260709 - PinsModule (ownership map, strap-conflict flags, live-state; 4 increments) (shipped).md
index 735c2e10..5bfce326 100644
--- a/docs/history/plans/archive/Plan-20260709 - PinsModule (ownership map, strap-conflict flags, live-state; 4 increments) (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260709 - PinsModule (ownership map, strap-conflict flags, live-state; 4 increments) (shipped).md	
@@ -1,6 +1,6 @@
 # Plan — PinsModule: the GPIO pin map, four increments (shipped)
 
-Consolidated record of the four-increment Pins effort (per CLAUDE.md *Plan before implementing* — a multi-phase effort's per-phase plans may be merged into one `(shipped)` record once the whole effort lands, preserving each phase's design-intent arc). All four shipped 2026-07-09. The forward-looking source is the [top-down study](../../backlog/pins-analysis-top-down.md), §8 of which defines the increments.
+Consolidated record of the four-increment Pins effort (per CLAUDE.md *Plan before implementing* — a multi-phase effort's per-phase plans may be merged into one `(shipped)` record once the whole effort lands, preserving each phase's design-intent arc). All four shipped 2026-07-09. The forward-looking source is the [top-down study](../../../backlog/pins-analysis-top-down.md), §8 of which defines the increments.
 
 ## Why (the problem the whole effort solves)
 
@@ -26,4 +26,4 @@ Adds the **second axis** — *what is GPIO N doing right now.* Per §6 this is *
 
 ## The through-line (why these four cohere)
 
-Each increment is read-only and additive on the last, and the recurring discipline is the **UI-sidestep rule**: every richer-UI need was met by a *generic* list affordance (the `severity`→color convention in #2, reused unchanged by #3; the scalar-fields path needing nothing in #4), never a pins-specific control. The map surfaces ownership (#1), safety (#2), conflicts (#3), and live electrical state (#4) — and at no point becomes an allocation subsystem or a policy engine, exactly the scope guard the top-down study draws. Later phases (reject-on-add on the installer path, the `pinConflicts()` validator authority, output-suppression, the board-diagram view, ADC/continuity live-state) remain in the [top-down study](../../backlog/pins-analysis-top-down.md) as the forward scope.
+Each increment is read-only and additive on the last, and the recurring discipline is the **UI-sidestep rule**: every richer-UI need was met by a *generic* list affordance (the `severity`→color convention in #2, reused unchanged by #3; the scalar-fields path needing nothing in #4), never a pins-specific control. The map surfaces ownership (#1), safety (#2), conflicts (#3), and live electrical state (#4) — and at no point becomes an allocation subsystem or a policy engine, exactly the scope guard the top-down study draws. Later phases (reject-on-add on the installer path, the `pinConflicts()` validator authority, output-suppression, the board-diagram view, ADC/continuity live-state) remain in the [top-down study](../../../backlog/pins-analysis-top-down.md) as the forward scope.
diff --git a/docs/history/plans/archive/Plan-20260709 - Split System into System + Services (shipped).md b/docs/history/plans/archive/Plan-20260709 - Split System into System + Services (shipped).md
index 24e81161..589efc3d 100644
--- a/docs/history/plans/archive/Plan-20260709 - Split System into System + Services (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260709 - Split System into System + Services (shipped).md	
@@ -2,7 +2,7 @@
 
 ## Context
 
-Today `ModuleRole::Peripheral` conflates two categories that both parent under **System**: the genuinely **user-added capability bridges** (Audio, IR — optional, add/delete), and **fixed things that borrow the role only to render a delete button** (TasksModule was given `Peripheral`+delete for exactly that; I2cScan and FileManager carry it while being always-there). Network's own children (MQTT, Devices) are a third, separate thing — always-there infra, wired-by-code, never user-added. The design note [docs/backlog/system-modules.md](../../backlog/system-modules.md) settles the split:
+Today `ModuleRole::Peripheral` conflates two categories that both parent under **System**: the genuinely **user-added capability bridges** (Audio, IR — optional, add/delete), and **fixed things that borrow the role only to render a delete button** (TasksModule was given `Peripheral`+delete for exactly that; I2cScan and FileManager carry it while being always-there). Network's own children (MQTT, Devices) are a third, separate thing — always-there infra, wired-by-code, never user-added. The design note [docs/backlog/system-modules.md](../../../backlog/system-modules.md) settles the split:
 
 - **System Modules** — fixed, wired-by-code, no add/delete: System's vitals + the fixed inspection modules (Tasks, I2cScan; later Memory, Pins) + always-there infra (Network, Firmware, Improv).
 - **Service Modules** (a new top-level **Services** container) — user-added, add/delete/replace, `ModuleRole::Service`: Audio, IR. (I2cScan → a fixed System Module — it inspects this-device hardware; MQTT/Improv/Devices stay code-wired — see §3.)
diff --git a/docs/history/plans/archive/Plan-20260709 - Unify lifecycle - onBuildState is the sole enabled-gate (shipped).md b/docs/history/plans/archive/Plan-20260709 - Unify lifecycle - onBuildState is the sole enabled-gate (shipped).md
index 888d1111..7b3dc9de 100644
--- a/docs/history/plans/archive/Plan-20260709 - Unify lifecycle - onBuildState is the sole enabled-gate (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260709 - Unify lifecycle - onBuildState is the sole enabled-gate (shipped).md	
@@ -1,10 +1,10 @@
 # Plan — Unify the module lifecycle: `onBuildState` is the sole enabled-gate
 
-> **As implemented (3e37987) — the design evolved during build.** This plan proposed "Option B": `onBuildState()` stays the single hook and *builds the empty state* (releases everything) when `!effectivelyEnabled()`, with `buildState()` always calling it on every node (decisions #1 and #3 below). During implementation that was sharpened one step further into a cleaner central router: **`MoonModule::applyState()`** is the sole orchestration point — it calls `onBuildState()` (a pure *build*, no `enabled()` check) on an effectively-enabled node and **`teardown()`** (release) on a disabled one, recursing the tree. So `onBuildState()` is NOT the "sole gate" the title says and does NOT build-empty-when-disabled; the *release* lives in `teardown()`, and `applyState()` — not the caller — decides which runs. The Scheduler's boot Phase-4 sweep and `buildState()` call `applyState()` (not `onBuildState()` directly). Everything else below (effective-enabled cascade #2, CLASS-1 vs CLASS-2, the goal of zero per-module `enabled()` gates) shipped as written. Kept as the intent record; read the code + [lessons.md](../lessons.md) for the final shape.
+> **As implemented (3e37987) — the design evolved during build.** This plan proposed "Option B": `onBuildState()` stays the single hook and *builds the empty state* (releases everything) when `!effectivelyEnabled()`, with `buildState()` always calling it on every node (decisions #1 and #3 below). During implementation that was sharpened one step further into a cleaner central router: **`MoonModule::applyState()`** is the sole orchestration point — it calls `onBuildState()` (a pure *build*, no `enabled()` check) on an effectively-enabled node and **`teardown()`** (release) on a disabled one, recursing the tree. So `onBuildState()` is NOT the "sole gate" the title says and does NOT build-empty-when-disabled; the *release* lives in `teardown()`, and `applyState()` — not the caller — decides which runs. The Scheduler's boot Phase-4 sweep and `buildState()` call `applyState()` (not `onBuildState()` directly). Everything else below (effective-enabled cascade #2, CLASS-1 vs CLASS-2, the goal of zero per-module `enabled()` gates) shipped as written. Kept as the intent record; read the code + [lessons.md](../../lessons.md) for the final shape.
 
 ## Context
 
-The [disable-releases-resources commit](Plan-20260709%20-%20Disabling%20releases%20resources%20(onEnabled%20per%20module)%20(shipped,%20superseded).md) left the same idea — "a disabled module holds no resources" — expressed in **two mechanisms** across ~7 modules, plus ~24 self-`enabled()` gates scattered through `setup()`/`onBuildState()`/`onCorrectionChanged()`/setters. The product owner's read (correct, verified in code): this is **sharpening, not a rewrite** — the orchestration already exists and runs; 10+ effects already release-on-disable through `onBuildState`; the delete cascade is already correct. (The full design study that fed this plan, `docs/backlog/lifecycle-unification-analysis.md`, was retired once the work shipped — its analysis is folded into this plan and [lessons.md](../lessons.md).)
+The [disable-releases-resources commit](Plan-20260709%20-%20Disabling%20releases%20resources%20(onEnabled%20per%20module)%20(shipped,%20superseded).md) left the same idea — "a disabled module holds no resources" — expressed in **two mechanisms** across ~7 modules, plus ~24 self-`enabled()` gates scattered through `setup()`/`onBuildState()`/`onCorrectionChanged()`/setters. The product owner's read (correct, verified in code): this is **sharpening, not a rewrite** — the orchestration already exists and runs; 10+ effects already release-on-disable through `onBuildState`; the delete cascade is already correct. (The full design study that fed this plan, `docs/backlog/lifecycle-unification-analysis.md`, was retired once the work shipped — its analysis is folded into this plan and [lessons.md](../../lessons.md).)
 
 **Decisions (product owner, this session):**
 1. **Option B** — `onBuildState()` is the single "(re)build my derived state for my current (controls, enabled)" entry point, and **`enabled==false` builds the *empty* state (release everything — memory AND hardware)**. Retire `onEnabled` for resource acquire/release.
@@ -63,7 +63,7 @@ No — decision 3 is always-call. `buildState()` keeps calling every node; the `
 - **Core:** `MoonModule.h` (`effectivelyEnabled()` + the two doc contracts), `AudioService.h`, `DevicesModule.h`, `IrService.h` (fold release into onBuildState, drop onEnabled). `MqttModule.h` — **no change** (its onEnabled is the sanctioned edge-trigger; add a one-line doc noting why it's exempt).
 - **Light:** `RmtLedDriver.h`, `ParallelLedDriver.h`, `NetworkSendDriver.h`, `NetworkReceiveEffect.h` (fold + drop onEnabled + remove setup gate); the ~10 effects (`enabled()`→`effectivelyEnabled()` in onBuildState). `DriverBase.h` — `releaseOnDisable` helper is no longer called from onEnabled; either repurpose it as the release helper onBuildState's disabled branch calls, or delete if each driver's teardown suffices (decide during impl — subtraction preferred).
 - **Tests:** extend the three existing boot-gate tests to assert via `effectivelyEnabled`; **add cascade tests** (§ Verification).
-- **Docs:** `architecture.md` (the lifecycle section — one gate, the contract), `lessons.md` (fold the arc: the three traps collapse into "onBuildState is the release gate, keyed on effective-enabled"). Retire the now-shipped study (`backlog/lifecycle-unification-analysis.md`) and the [backlog entry](../../backlog/backlog-core.md) per *Mandatory subtraction*. Mark this plan `(shipped)`.
+- **Docs:** `architecture.md` (the lifecycle section — one gate, the contract), `lessons.md` (fold the arc: the three traps collapse into "onBuildState is the release gate, keyed on effective-enabled"). Retire the now-shipped study (`backlog/lifecycle-unification-analysis.md`) and the [backlog entry](../../../backlog/backlog-core.md) per *Mandatory subtraction*. Mark this plan `(shipped)`.
 
 ## Verification
 
diff --git a/docs/history/plans/archive/Plan-20260710 - Rename module hooks to prepare-tick-release (shipped).md b/docs/history/plans/archive/Plan-20260710 - Rename module hooks to prepare-tick-release (shipped).md
index 9ef5ea5e..6bdaec9d 100644
--- a/docs/history/plans/archive/Plan-20260710 - Rename module hooks to prepare-tick-release (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260710 - Rename module hooks to prepare-tick-release (shipped).md	
@@ -20,7 +20,7 @@
 
 ## Context
 
-Writing the ["Build your own MoonModules" guide](../../usecases/build-your-own-moonmodules.md) surfaced a naming concern (product-owner remark R4): the hook vocabulary a module author must learn isn't as friendly as it could be.
+Writing the ["Build your own MoonModules" guide](../../../usecases/build-your-own-moonmodules.md) surfaced a naming concern (product-owner remark R4): the hook vocabulary a module author must learn isn't as friendly as it could be.
 
 1. **`onBuildControls` vs `onBuildState` read almost identically** (both `onBuild…`) yet do very different things — declare UI controls vs build derived state/memory. The shared prefix *causes* the "wait, are these the same?" confusion the remark names.
 2. **`onBuildState` (acquire) and `teardown` (release) are opposites but don't read as a pair** — nothing in the names signals "these two are the build/unbuild halves."
diff --git a/docs/history/plans/archive/Plan-20260710 - Scratch buffer helper for memory-holding effects (shipped).md b/docs/history/plans/archive/Plan-20260710 - Scratch buffer helper for memory-holding effects (shipped).md
index b3110823..51f93428 100644
--- a/docs/history/plans/archive/Plan-20260710 - Scratch buffer helper for memory-holding effects (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260710 - Scratch buffer helper for memory-holding effects (shipped).md	
@@ -2,7 +2,7 @@
 
 ## Context
 
-Writing the ["Build your own MoonModules" guide](../../usecases/build-your-own-moonmodules.md) surfaced a recurring boilerplate across memory-holding effects: allocate a heap buffer in `onBuildState()` (sized to the grid, re-alloc only if the count changed), free it in `teardown()`, free it again in the destructor, hand-write a private `release()` helper, and guard `loop()` with `if (!buf_) return;`. This is the pattern in **~11 effects** (Fire, GameOfLife, GEQ, Tetrix, Particles, StarField, StarSky, BouncingBalls, Solid, NetworkReceive, Wave) — several hold *multiple* buffers (GameOfLife allocates 3 planes, StarSky 5, StarField 3), so the bookkeeping is real. It's textbook *[Complexity lives in core](../../../CLAUDE.md#principles)*: the same non-trivial lifecycle wants to live once in a core primitive, so each effect drops to "declare the buffer, use it."
+Writing the ["Build your own MoonModules" guide](../../../usecases/build-your-own-moonmodules.md) surfaced a recurring boilerplate across memory-holding effects: allocate a heap buffer in `onBuildState()` (sized to the grid, re-alloc only if the count changed), free it in `teardown()`, free it again in the destructor, hand-write a private `release()` helper, and guard `loop()` with `if (!buf_) return;`. This is the pattern in **~11 effects** (Fire, GameOfLife, GEQ, Tetrix, Particles, StarField, StarSky, BouncingBalls, Solid, NetworkReceive, Wave) — several hold *multiple* buffers (GameOfLife allocates 3 planes, StarSky 5, StarField 3), so the bookkeeping is real. It's textbook *[Complexity lives in core](../../../CLAUDE.md#principles)*: the same non-trivial lifecycle wants to live once in a core primitive, so each effect drops to "declare the buffer, use it."
 
 Three product-owner remarks on the guide drove this (R6 "should `release()` be a hook", R7 "`if (!heat_) return` sounds like orchestration, hide it", and — writing the memory example — "`static_cast` should not be used by module makers"). The answer to all three is the same primitive.
 
diff --git a/docs/history/plans/archive/Plan-20260712 - Step 1.5 async transmit double-buffer (shipped).md b/docs/history/plans/archive/Plan-20260712 - Step 1.5 async transmit double-buffer (shipped).md
index 2a9de453..4b22cafc 100644
--- a/docs/history/plans/archive/Plan-20260712 - Step 1.5 async transmit double-buffer (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260712 - Step 1.5 async transmit double-buffer (shipped).md	
@@ -9,13 +9,13 @@ Shipped on both parallel peripherals (LCD/S3 + Parlio/P4) as the `asyncTransmit`
 | **P4 / Parlio** (16×256) | ~10,820 µs | ~3,790 µs | **48 → 76 fps** |
 | **S3 / LCD_CAM** (16×144, SE16) | ~17,200 µs | ~11,700 µs | ~15 → ~16 (masked) |
 
-Proven on **both** parallel peripherals — the double-buffer overlaps the WS2812 wire wait on each (P4 driver −65%, S3 driver −32%, both matching the measured `wireUs`). The whole-board fps win is clean on the P4 (+58%); on the SE16 the driver gain is real but *masked* by ~50 ms of other per-tick overhead on that board (a heavy 128×128 render), so its system fps barely moves — the driver-level proof stands, the board-level demo doesn't. A git-worktree baseline at the previous commit confirmed async-OFF reproduces the prior P4 behavior exactly (10,820 vs 10,787 µs) — **provably no regression**. The design cut vs the original plan: (1) `tick()` is two explicit branches (`tickSync` = the literal original path, `tickAsync` = deferred-wait), so OFF is byte-for-byte the pre-change timing; (2) allocation follows the flag — OFF allocates ONE DMA buffer (costs nothing), ON requests the second (degrades to sync if it won't fit); (3) Parlio uses the **same whole-frame double-buffer as LCD**, not a ring (the KPI 4096-light frame fits one transfer — the ring stays Step 4, and per the "65K is a network problem" call is now deferred-indefinitely). Added a **`wireUs` read-only KPI** = the measured DMA wire time (start-of-transmit → done-callback, an in-order completion FIFO pairs each done with its start), live "7474 µs (133 fps max)" on the P4 — the pure output floor, so the fps ceiling is measured not assumed (and it tracks an overclocked slot rate directly). The remaining gap (system 76 fps → wire 133 fps) is the render loop; the effect (~7.3 ms) is the next bottleneck → Step 2 multicore. Full story + the measurement trap that nearly buried the win: [lessons.md](../lessons.md).
+Proven on **both** parallel peripherals — the double-buffer overlaps the WS2812 wire wait on each (P4 driver −65%, S3 driver −32%, both matching the measured `wireUs`). The whole-board fps win is clean on the P4 (+58%); on the SE16 the driver gain is real but *masked* by ~50 ms of other per-tick overhead on that board (a heavy 128×128 render), so its system fps barely moves — the driver-level proof stands, the board-level demo doesn't. A git-worktree baseline at the previous commit confirmed async-OFF reproduces the prior P4 behavior exactly (10,820 vs 10,787 µs) — **provably no regression**. The design cut vs the original plan: (1) `tick()` is two explicit branches (`tickSync` = the literal original path, `tickAsync` = deferred-wait), so OFF is byte-for-byte the pre-change timing; (2) allocation follows the flag — OFF allocates ONE DMA buffer (costs nothing), ON requests the second (degrades to sync if it won't fit); (3) Parlio uses the **same whole-frame double-buffer as LCD**, not a ring (the KPI 4096-light frame fits one transfer — the ring stays Step 4, and per the "65K is a network problem" call is now deferred-indefinitely). Added a **`wireUs` read-only KPI** = the measured DMA wire time (start-of-transmit → done-callback, an in-order completion FIFO pairs each done with its start), live "7474 µs (133 fps max)" on the P4 — the pure output floor, so the fps ceiling is measured not assumed (and it tracks an overclocked slot rate directly). The remaining gap (system 76 fps → wire 133 fps) is the render loop; the effect (~7.3 ms) is the next bottleneck → Step 2 multicore. Full story + the measurement trap that nearly buried the win: [lessons.md](../../lessons.md).
 
 RMT stayed **deferred** (its shared per-pin symbol buffer isn't a small double-buffer delta). Everything below is the original plan as approved.
 
 ## Context
 
-The measured fact (Parlio 16-lane sweep, [performance.md § Multi-pin](../../performance.md#multi-pin-led-driving-all-three-peripherals-128128-grid); [multicore top-down § Step 1.5](Plan-20260713%20-%20Multicore%20Step%202%20render-encode%20pipeline%20(shipped).md)): the driver `tick()` runs **encode → transmit → wait, serially, on one buffer**:
+The measured fact (Parlio 16-lane sweep, [performance.md § Multi-pin](../../../performance.md#multi-pin-led-driving-all-three-peripherals-128128-grid); [multicore top-down § Step 1.5](Plan-20260713%20-%20Multicore%20Step%202%20render-encode%20pipeline%20(shipped).md)): the driver `tick()` runs **encode → transmit → wait, serially, on one buffer**:
 
 ```
 tick() {                                    // ParallelLedDriver.h:178
@@ -75,7 +75,7 @@ Ship as **one coherent change per peripheral seam + the shared base**, but built
 ### Increment 1 — LCD (S3) + Parlio (P4): whole-frame double-buffer (`platform_esp32_lcd.cpp`, `platform_esp32_parlio.cpp`)
 Both peripherals get the **same** whole-frame ping-pong (each already does one autonomous single-transfer today, so a second buffer + alternating is identical for both). `LcdState`/`ParlioState` grow `buf[2]` + `done[2]` (a binary semaphore per buffer — each transfer gives its own; the recognizable ping-pong handshake).
 - `busBuffer(i)` returns buffer i; `busTransmit(i, bytes)` transmits from buffer i and arms `done[i]`; `busWait(i, ms)` waits on `done[i]`. i80 (`esp_lcd_panel_io_tx_color`) and Parlio (`parlio_tx_unit_transmit`) both take the buffer pointer per transmit, so alternating is a pointer choice, not a bus rebuild. (Parlio's `trans_queue_depth` grows 1→2 so a second transfer can be queued while the first drains.)
-- **Memory — TRY-ALLOC the second buffer, degrade to single if it won't fit (PO-confirmed, matches Step 2's memory rule, [top-down § Step 2 design](Plan-20260713%20-%20Multicore%20Step%202%20render-encode%20pipeline%20(shipped).md)).** The second DMA buffer is *large* — the same size as the first (up to a whole 16-bit 16-lane frame), so on a memory-tight board it may not allocate. The seam **attempts** the second-buffer alloc (same PSRAM-first-else-internal path as the first) and checks the result: success → double-buffer mode; **null → single-buffer mode** (`buf[1] == nullptr`), base loop behaves exactly as today (wait-after-every-transmit). No `if constexpr (hasPsram)` gate — decide from the *actual* allocation outcome (a PSRAM board can still be too full; a no-PSRAM board can still fit two small frames). Per-board, per-config, at runtime: a tight board keeps the current fps rather than failing to init. The *Robust to any input* + adaptive-memory-degradation rule ([ADR 0002](../../adr/0002-adaptive-memory-degradation-cascade.md)): never *require* the second buffer.
+- **Memory — TRY-ALLOC the second buffer, degrade to single if it won't fit (PO-confirmed, matches Step 2's memory rule, [top-down § Step 2 design](Plan-20260713%20-%20Multicore%20Step%202%20render-encode%20pipeline%20(shipped).md)).** The second DMA buffer is *large* — the same size as the first (up to a whole 16-bit 16-lane frame), so on a memory-tight board it may not allocate. The seam **attempts** the second-buffer alloc (same PSRAM-first-else-internal path as the first) and checks the result: success → double-buffer mode; **null → single-buffer mode** (`buf[1] == nullptr`), base loop behaves exactly as today (wait-after-every-transmit). No `if constexpr (hasPsram)` gate — decide from the *actual* allocation outcome (a PSRAM board can still be too full; a no-PSRAM board can still fit two small frames). Per-board, per-config, at runtime: a tight board keeps the current fps rather than failing to init. The *Robust to any input* + adaptive-memory-degradation rule ([ADR 0002](../../../adr/0002-adaptive-memory-degradation-cascade.md)): never *require* the second buffer.
 - The contiguous-DMA ceiling is **per-buffer**, so double-buffering ~halves the max frame a board can hold; the degrade-to-single path covers the board that fits one but not two (keeps its old ceiling at the old fps).
 
 ### Increment 2 — RMT (RmtLedDriver.h / platform_esp32_rmt.cpp) — include only if a small delta
diff --git a/docs/history/plans/archive/Plan-20260714 - Shift-register LED driver (shipped).md b/docs/history/plans/archive/Plan-20260714 - Shift-register LED driver (shipped).md
index f1dd0915..c037401e 100644
--- a/docs/history/plans/archive/Plan-20260714 - Shift-register LED driver (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260714 - Shift-register LED driver (shipped).md	
@@ -4,7 +4,7 @@
 
 A **74HCT595 shift-register expander board** turns each physical data GPIO into **8 outputs**. The PO owns two S3-N16R8-driven panels — **15×256** (3,840 lights) and **48×256** (12,288 lights) — not yet wired. Goal: drive them from the drivers we already have, not a new driver class.
 
-The feasibility research is [`docs/history/shift-register-driver-analysis.md`](../shift-register-driver-analysis.md). The two facts that shape this plan:
+The feasibility research is [`docs/history/shift-register-driver-analysis.md`](../../shift-register-driver-analysis.md). The two facts that shape this plan:
 
 1. **The ×8 fan-out costs 8× the DMA frame** (~145 KB for *both* targets — extra strands ride the bus width and are free; the ×8 rides the serial shift and is not). Confirmed from hpwit's sizing expressions and his 8.00× clock ratio.
 2. **The 8× bus clock is granted by `esp_lcd`** — bench-confirmed 2026-07-14 on S3 **and** P4: `request 20000000 Hz -> GRANTED (prescale 4 -> granted 20000000 Hz)`.
diff --git a/docs/history/plans/archive/Plan-20260722 - Black pixels (dark gaps) in Layouts (shipped).md b/docs/history/plans/archive/Plan-20260722 - Black pixels (dark gaps) in Layouts (shipped).md
index 9bd8d98c..303ac106 100644
--- a/docs/history/plans/archive/Plan-20260722 - Black pixels (dark gaps) in Layouts (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260722 - Black pixels (dark gaps) in Layouts (shipped).md	
@@ -71,7 +71,7 @@ Remove the `g`/`+` gap syntax entirely, as its own commit/step so the diff reads
 - **[ParallelLedDriver.h](src/light/drivers/ParallelLedDriver.h):** remove `laneGaps_`, the gap semantics of `laneWire_`, the gap branch of `laneRowLit`, `laneNextBoundary`'s gap logic, the `laneGapCount`/`laneRowLitForTest`/`laneWire` test accessors, the `assignCounts(..., laneGaps_)` argument, the wire-length gap accumulation, and the `if (laneGaps_[i].n) return false` in `uniformLaneCounts`. Restore `laneRowLit` to the pre-gap `row < laneCounts_` test.
 - **[RmtLedDriver.h](src/light/drivers/RmtLedDriver.h) / [NetworkSendDriver.h](src/light/drivers/NetworkSendDriver.h):** confirm the `assignCounts` call sites compile after the trailing param drops.
 - **Tests:** remove the gap TEST_CASEs from [unit_RmtLedDriver_pins.cpp](test/unit/light/unit_RmtLedDriver_pins.cpp) and [unit_MultiPinLedDriver.cpp](test/unit/light/unit_MultiPinLedDriver.cpp).
-- **Docs:** revert the `ledsPerPin` gap paragraph in [drivers.md](docs/moonmodules/light/drivers.md) and the backlog item edit in [backlog-light.md](docs/backlog/backlog-light.md).
+- **Docs:** revert the `ledsPerPin` gap paragraph in [drivers.md](../../../moonmodules/light/drivers.md) and the backlog item edit in [backlog-light.md](../../../backlog/backlog-light.md).
 
 ## Tests (pin behavior)
 
diff --git a/docs/history/plans/archive/Plan-20260722 - Release 4 scope - effect breadth + rename runway (shipped).md b/docs/history/plans/archive/Plan-20260722 - Release 4 scope - effect breadth + rename runway (shipped).md
new file mode 100644
index 00000000..76a42a04
--- /dev/null
+++ b/docs/history/plans/archive/Plan-20260722 - Release 4 scope - effect breadth + rename runway (shipped).md	
@@ -0,0 +1,105 @@
+# Plan — Release 4 scope: effect breadth + the rename runway
+
+## Status — SHIPPED 2026-09-07 (decomposed)
+
+**The headline SHIPPED and was overachieved; the driver work never started.** Verified against the
+tree rather than inferred: this plan asked for Stage-1 primitives plus "the next effect batch" to
+move the rename's breadth gate, and the library is now **66 compiled effects and 32 scripted**
+against the ~21 this document counted. The gate it existed to serve is met; the remaining blocker
+for the rename is DMX, not effects ([the migration plan's status](../Plan-20260630%20-%20MoonLight%20migration%20%28multi-stage%29.md)).
+
+| item | state |
+|---|---|
+| Stage-1 primitives (palette, draw, FastLED-named set, tags) | **shipped** |
+| The next effect batch | **shipped, overachieved**: 98 effects against a 21 baseline |
+| `ActiveInstance` primitive | **shipped** (`src/core/ActiveInstance.h`, used by AudioService + DevicesModule) |
+| CodeRabbit #29, the scenario finding | **shipped 2026-09-07**, see below |
+| CodeRabbit #29, the other three | **open**, moved to backlog |
+| RS-485 / DMX-512 driver | **not started**, and scoped OUT by the product owner 2026-09-07 |
+| High-light-count driver work (4 items) | **not started**, moved to backlog |
+
+**SHIPPED as a release-scope plan.** Its headline landed and was overachieved, which is what this
+document existed to do. What did not land was never work this plan owned: each item was a pointer
+to something with its own home, and each is still there.
+
+- **DMX** is Stage 5 of the [MoonLight migration plan](../Plan-20260630%20-%20MoonLight%20migration%20%28multi-stage%29.md),
+  which describes it in far more detail than this plan ever did, and where it belongs: it is the
+  transport half of the moving-head work whose effect half already shipped.
+- **The high-light-count drivers** and the **CodeRabbit #29 findings** stay in the backlog. Neither
+  belongs to the migration plan, which is about porting MoonLight's library, not about lane drivers
+  or a core/platform boundary.
+
+Nothing is orphaned by closing this, which is the test for whether a plan can be closed at all.
+
+### The one thing fixed while decomposing
+
+The CodeRabbit #29 **scenario finding** is closed: `scenario_modifier_chain` routed a
+modifier-composition test through `NetworkSendDriver`, pulling socket behavior into a test that is
+not about the network. It now uses `PreviewDriver`, the in-process sink (the shape
+`scenario_Audio_mutation` already used).
+
+Its `tick_us` half was NOT a defect and is left alone: a `measure` step asserts nothing, it RECORDS,
+and that recording is what feeds the per-commit performance trend (CLAUDE.md, "scenarios record").
+Removing it would have blinded the trend to fix nothing.
+
+## Context
+
+Release 3 is being cut now. This plan captures the **Release 4** candidates — the next strategic thread after R3 — so the direction is recorded before the work starts. The product owner's steer: the items below are R4, not R3.
+
+The backlog has one dominant strategic thread that most other items orbit: the **projectMM → MoonLight rename** ([backlog rename plan](../../../backlog/rename-to-moonlight.md)). Its gate is *"the effect library must not feel thin next to the predecessor's 60+ effects."* Two in-flight plans feed that gate, and R4 is where they land. The shape of R4 is therefore **"the effects release + the rename runway"**: grow visible feature breadth while moving the single most important strategic gate (rename readiness), and leave the hardware-verification-bound driver work to its own dedicated push.
+
+This is a roadmap/scope plan, not a single-feature `/plan`. Each item below gets its own `/plan` + commit when reached; this document is the *map* and the *why*.
+
+## The spine — effect-breadth parity (headline)
+
+**MoonLight migration, Stage 1 + the next effect batch.** ([Plan-20260630 - MoonLight migration (multi-stage)](../Plan-20260630%20-%20MoonLight%20migration%20%28multi-stage%29.md).)
+
+This is the biggest lever and the explicit *"execution vehicle for the effect-breadth parity gate."* ~21 of the predecessor's 60+ effects are ported. Stage 1's prerequisites are the highest-value core work available, because every future effect leans on them:
+
+- **Shared palette** — hard prerequisite; many effects color via `ColorFromPalette`. Generalize the pattern `PlasmaPaletteEffect` hard-codes today.
+- **The shared primitive library** — FastLED-named, our own implementation, hot-path-tuned integer-only: `beatsin8`, `inoise8`, `qadd8`, `nscale8`, `random8`/`random16`, `ColorFromPalette`, and the dimension-agnostic draw set. Extends the existing `color.h` (`scale8`, `sin8`).
+- **Tag/emoji legend** — settle before batch-migrating so every module is consistent from batch one.
+- **Per-library doc model** — `effects_<library>.md` compact table rows (per [ADR 0015](../../../adr/0015-library-is-a-tag-not-a-folder.md)); changes the `check_specs.py` contract.
+
+Then the next migration batch on top. This is the R4 headline: it unblocks the rename *and* is pure user-visible feature growth.
+
+## Two quick wins — scoped and ready
+
+- **Active-instance election primitive.** ([Plan-20260710 - Active-instance election primitive](Plan-20260710%20-%20Active-instance%20election%20primitive%20%28shipped%29.md).) A core `ActiveInstance<T>` that removes duplicated singleton-election bookkeeping from `AudioService` + `DevicesModule` (both had real dangling-static bugs). Textbook *Complexity-lives-in-core* subtraction; small; in flight.
+- **CodeRabbit #29 boundary findings (4).** ([backlog-core § MoonLive core/platform layering](../../../backlog/backlog-core.md#moonlive-coreplatform-layering-jit-sdkconfig-scoping-coderabbit-29-3-findings-left).) MoonLive core-includes-platform + compiled-into-`mm_core`, W^X disabled in the board default, a scenario riding timing + network. Real, already scoped; good hygiene to close before a named release.
+
+## What did not happen, and where it lives now
+
+Each of these was a POINTER to a backlog item rather than work this plan owned, and each is still
+there under its own name. Listed here only so the decomposition is traceable; the backlog is the
+one home for what they are and why.
+
+- **RS-485 / DMX-512 wired output** moved to the [MoonLight migration plan's Stage 5](../Plan-20260630%20-%20MoonLight%20migration%20%28multi-stage%29.md),
+  which is its real home: the moving-head EFFECTS shipped there, and this is their transport.
+  Scoped OUT by the product owner on 2026-09-07 ("out of scope for now, will do later").
+- **Classic-ESP32 shift-register ring on raw I2S**, **P4 Parlio streaming ring**, **shared
+  lane-driver scaffolding** ([backlog-light § Drivers](../../../backlog/backlog-light.md#drivers)) and
+  the **MoonI80 prime-only ring stall backstop**
+  ([backlog-core](../../../backlog/backlog-core.md#mooni80-prime-only-ring-no-stall-backstop-sibling-path-gap)).
+  All four are hardware-verification-bound: each needs the expander wall and the relevant board, so
+  they land with bench sign-off or not at all.
+- **CodeRabbit #29, three findings**
+  ([backlog-core](../../../backlog/backlog-core.md#moonlive-coreplatform-layering-jit-sdkconfig-scoping-coderabbit-29-3-findings-left)).
+  The fourth is closed, above.
+
+## Success shape (as written in July, and what became of it)
+
+> R4 ships when: the migration Stage-1 primitives + the next effect batch have landed (moving the
+> rename's breadth gate forward), the `ActiveInstance` primitive and the CodeRabbit #29 boundary
+> fixes are in, the RS-485/DMX driver reaches a verified first output, and the high-light-count
+> driver work above is bench-verified.
+
+The first half happened and then some. The second half did not, and DMX is now deferred, so this
+shape is unmeetable as stated: kept verbatim because a scope that was written down and then overtaken
+is worth reading next to what actually shipped, not quietly rewritten to match the outcome.
+
+The lesson worth carrying, and the reason this document is decomposed rather than extended: it
+bundled **effect work that needed only a keyboard** with **driver work that needs a wall of LEDs**.
+The first raced ahead; the second never started, because it was gated on bench time rather than on
+anything this plan could schedule. A release scope that mixes the two makes neither legible. Split
+by what a task is BLOCKED ON, not by which release it is wanted for.
diff --git a/docs/history/plans/Plan-20260728 - Doc-comment size reporting via clang-query.md b/docs/history/plans/archive/Plan-20260728 - Doc-comment size reporting via clang-query (shipped).md
similarity index 99%
rename from docs/history/plans/Plan-20260728 - Doc-comment size reporting via clang-query.md
rename to docs/history/plans/archive/Plan-20260728 - Doc-comment size reporting via clang-query (shipped).md
index 940176b7..0578a08e 100644
--- a/docs/history/plans/Plan-20260728 - Doc-comment size reporting via clang-query.md	
+++ b/docs/history/plans/archive/Plan-20260728 - Doc-comment size reporting via clang-query (shipped).md	
@@ -164,7 +164,7 @@ So the host now **emulates** the peripherals rather than declaring itself incapa
 buses with heap memory instead of returning `false`/`nullptr`. `ParallelLedDriver` runs on macOS
 against all three real backends, switchable live.
 
-Recorded as a hard rule in [architecture.md § Platform abstraction](../../architecture.md). Its
+Recorded as a hard rule in [architecture.md § Platform abstraction](../../../architecture.md). Its
 limit is deliberate: timing, wire protocol and pin state are NOT emulated, because faking them
 would let a self-test report on hardware it never touched.
 
diff --git "a/docs/history/plans/archive/Plan-20260813 - MoonLive on a stack machine \342\200\224 the frame is where values live (shipped).md" "b/docs/history/plans/archive/Plan-20260813 - MoonLive on a stack machine \342\200\224 the frame is where values live (shipped).md"
index 4aaf5651..5d4f16bf 100644
--- "a/docs/history/plans/archive/Plan-20260813 - MoonLive on a stack machine \342\200\224 the frame is where values live (shipped).md"	
+++ "b/docs/history/plans/archive/Plan-20260813 - MoonLive on a stack machine \342\200\224 the frame is where values live (shipped).md"	
@@ -137,7 +137,7 @@ this is removing a distinction the storage layer never made — not introducing
 still decides is which slots it WRITES each frame; reading is uniform.
 
 This is a breaking change for any script using a modifier's `x`/`y`/`z`, so it needs its
-[MIGRATING.md](../../MIGRATING.md) entry and a sweep of the shipped `moonlive/` scripts.
+[MIGRATING.md](../../../MIGRATING.md) entry and a sweep of the shipped `moonlive/` scripts.
 
 ### Clean first, with speed decisions made deliberately
 
@@ -435,7 +435,7 @@ window-overflow handler spills a frame's a4..a7 into the frame's OWN top 32 byte
 reserved 16, so the parked arena pointer of step 3b sat in hardware-owned memory and any interrupt
 during a host call destroyed it. Frame LAYOUT, not register choice; spatial, not temporal; and
 invisible to every encoding check because each instruction was correct. See
-[lessons § the register-window frame bug](../lessons.md#lessons-from-the-moonlive-on-xtensa-branch-the-register-window-frame-bug).
+[lessons § the register-window frame bug](../../lessons.md#lessons-from-the-moonlive-on-xtensa-branch-the-register-window-frame-bug).
 All four boards (S3, classic, P4, S31) now run scripted layouts and effects.
 
 ## Status: CLOSED
diff --git a/docs/history/plans/archive/Plan-20260817 - MoonLive scripts are classes (shipped).md b/docs/history/plans/archive/Plan-20260817 - MoonLive scripts are classes (shipped).md
index a93ceb97..9dc65ea8 100644
--- a/docs/history/plans/archive/Plan-20260817 - MoonLive scripts are classes (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260817 - MoonLive scripts are classes (shipped).md	
@@ -750,7 +750,7 @@ therefore needs a host test that proves the semantics and a bench run that prove
    The P4 is up and holds its scripts, but it panics with `Cache error` every few minutes while
    idle. Established as PRE-EXISTING rather than a regression: it runs the default module tree with
    no MoonLive module at all, and a firmware built from a clean `main` crashes identically. Recorded
-   in [backlog-core](../../backlog/backlog-core.md). A SEPARATE P4 boot loop found in the same
+   in [backlog-core](../../../backlog/backlog-core.md). A SEPARATE P4 boot loop found in the same
    session WAS this branch's regression and is fixed: the engine had grown to 1440 bytes held by
    value in every scripted module, which `registerType`'s stack probe could not absorb.
 
@@ -765,7 +765,7 @@ therefore needs a host test that proves the semantics and a bench run that prove
   the compiler.
 - **`while`, `break`, `continue`.** `for` and `if` cover what an effect does; the rest is language
   completeness rather than expressiveness, and each one costs a grammar rule and a test surface.
-- **Floating point.** The render path is integer by rule ([coding-standards](../../coding-standards.md)),
+- **Floating point.** The render path is integer by rule ([coding-standards](../../../coding-standards.md)),
   and the Xtensa classic has no FPU, so a float in a script would be a silent softfloat call per light.
 - **A scripted DRIVER as the fourth role.** It is the honest test of step 5's dispatch, but it needs
   the driver surface to be as settled as the other three are, and that is its own question.
diff --git a/docs/history/plans/Plan-20260823 - A Windows installer, and settings that persist.md b/docs/history/plans/archive/Plan-20260823 - A Windows installer, and settings that persist (shipped).md
similarity index 100%
rename from docs/history/plans/Plan-20260823 - A Windows installer, and settings that persist.md
rename to docs/history/plans/archive/Plan-20260823 - A Windows installer, and settings that persist (shipped).md
diff --git a/docs/history/plans/Plan-20260823 - Five types for MoonLive scripts.md b/docs/history/plans/archive/Plan-20260823 - Five types for MoonLive scripts (shipped).md
similarity index 98%
rename from docs/history/plans/Plan-20260823 - Five types for MoonLive scripts.md
rename to docs/history/plans/archive/Plan-20260823 - Five types for MoonLive scripts (shipped).md
index 0e2c0155..2f9a8d9e 100644
--- a/docs/history/plans/Plan-20260823 - Five types for MoonLive scripts.md	
+++ b/docs/history/plans/archive/Plan-20260823 - Five types for MoonLive scripts (shipped).md	
@@ -13,7 +13,7 @@ renders wrong" and never as an error:
 
 Not one was a mistake in a script. Each was a script author choosing a storage width and the engine
 silently disagreeing. The product owner and the agent settled the replacement in
-[moonlive-language-roadmap.md](../../backlog/moonlive-language-roadmap.md): **five types — `int`,
+[moonlive-language-roadmap.md](../../../backlog/moonlive-language-roadmap.md): **five types — `int`,
 `byte`, `bool`, `fixed`, `string` — each usable as scalar or array. Every scalar occupies one uniform
 4-byte slot; arrays pack by element.** A type becomes a semantic rather than a width, which deletes
 the machinery instead of patching it a fifth time.
diff --git a/docs/history/plans/archive/Plan-20260824 - NDI output (shipped).md b/docs/history/plans/archive/Plan-20260824 - NDI output (shipped).md
index 996ae90e..e675dd71 100644
--- a/docs/history/plans/archive/Plan-20260824 - NDI output (shipped).md	
+++ b/docs/history/plans/archive/Plan-20260824 - NDI output (shipped).md	
@@ -10,7 +10,7 @@ an NDI source and reach a Spout pipeline through one hop.
 Input is not the gap: `NetworkReceiveEffect` already binds Art-Net, E1.31/sACN and DDP at once.
 What is missing is the other direction — projectMM's pixels reaching a production visuals rig.
 
-Decision recorded in [backlog-light § Integration with other LED and visuals tools](../../backlog/backlog-light.md):
+Decision recorded in [backlog-light § Integration with other LED and visuals tools](../../../backlog/backlog-light.md):
 **NDI first.** One implementation covers Windows, macOS, Linux and ARM, it discovers by name, and
 it crosses machines. Spout (Windows) and Syphon (macOS) are lower latency and bit-exact but are
 same-machine only, are two platform implementations, and leave Linux and the Pi with nothing. At
diff --git a/docs/history/plans/Plan-20260825 - Client-driven preview adaptation (superseded).md b/docs/history/plans/archive/Plan-20260825 - Client-driven preview adaptation (superseded).md
similarity index 100%
rename from docs/history/plans/Plan-20260825 - Client-driven preview adaptation (superseded).md
rename to docs/history/plans/archive/Plan-20260825 - Client-driven preview adaptation (superseded).md
diff --git a/docs/history/plans/Plan-20260826 - Desktop audio capture.md b/docs/history/plans/archive/Plan-20260826 - Desktop audio capture (shipped).md
similarity index 100%
rename from docs/history/plans/Plan-20260826 - Desktop audio capture.md
rename to docs/history/plans/archive/Plan-20260826 - Desktop audio capture (shipped).md
diff --git a/docs/history/plans/Plan-20260826 - MoonBase, a second boot image (shipped).md b/docs/history/plans/archive/Plan-20260826 - MoonBase, a second boot image (shipped).md
similarity index 100%
rename from docs/history/plans/Plan-20260826 - MoonBase, a second boot image (shipped).md
rename to docs/history/plans/archive/Plan-20260826 - MoonBase, a second boot image (shipped).md
diff --git a/docs/history/plans/Plan-20260827 - HLS on ESP32-P4.md b/docs/history/plans/archive/Plan-20260827 - HLS on ESP32-P4 (shipped).md
similarity index 100%
rename from docs/history/plans/Plan-20260827 - HLS on ESP32-P4.md
rename to docs/history/plans/archive/Plan-20260827 - HLS on ESP32-P4 (shipped).md
diff --git a/docs/history/plans/Plan-20260827 - HLS streaming driver.md b/docs/history/plans/archive/Plan-20260827 - HLS streaming driver (shipped).md
similarity index 98%
rename from docs/history/plans/Plan-20260827 - HLS streaming driver.md
rename to docs/history/plans/archive/Plan-20260827 - HLS streaming driver (shipped).md
index 172cd412..407b6acf 100644
--- a/docs/history/plans/Plan-20260827 - HLS streaming driver.md	
+++ b/docs/history/plans/archive/Plan-20260827 - HLS streaming driver (shipped).md	
@@ -3,7 +3,7 @@
 ## Context
 
 The PO wants to watch effects pixel-exact (1:1, no scaling) on a TV, up to 4K transport. Spec:
-[docs/backlog/hls-driver-spec.md](../../backlog/hls-driver-spec.md). Decisions already made with
+`docs/backlog/hls-driver-spec.md` (deleted when the driver shipped, per the backlog's drain rule). Decisions already made with
 the PO: pipe raw frames to a spawned **ffmpeg** (runtime dependency like Npcap/NDI, never
 vendored; one implementation for every desktop OS + Pi), H.264 + HLS served by our own HTTP
 server, 2-5 s live-tuned latency, ESP32 out of scope. Rides along: GridLayout `width`/`height`
diff --git a/docs/history/plans/Plan-20260827 - Raw-L2 interface dropdown.md b/docs/history/plans/archive/Plan-20260827 - Raw-L2 interface dropdown (shipped).md
similarity index 100%
rename from docs/history/plans/Plan-20260827 - Raw-L2 interface dropdown.md
rename to docs/history/plans/archive/Plan-20260827 - Raw-L2 interface dropdown (shipped).md
diff --git a/docs/history/plans/Plan-20260827 - Sprites and flying toasters.md b/docs/history/plans/archive/Plan-20260827 - Sprites and flying toasters (shipped).md
similarity index 98%
rename from docs/history/plans/Plan-20260827 - Sprites and flying toasters.md
rename to docs/history/plans/archive/Plan-20260827 - Sprites and flying toasters (shipped).md
index 2d424ca7..e81f54ba 100644
--- a/docs/history/plans/Plan-20260827 - Sprites and flying toasters.md	
+++ b/docs/history/plans/archive/Plan-20260827 - Sprites and flying toasters (shipped).md	
@@ -3,7 +3,7 @@
 Classic screensavers on a light wall (a Discord request): sprites, small movable bitmaps with
 transparency, and the first consumer, After Dark's flying toasters. The power-functions catalog
 anticipated this: compositing was deferred "until sprites arrive"
-([bottom-up](power-functions-analysis-bottom-up.md) § below-the-cut); this is the arrival.
+([bottom-up](../../../backlog/power-functions-analysis-bottom-up.md) § below-the-cut); this is the arrival.
 
 ## Division of labor (the design decision)
 
diff --git a/docs/history/plans/Plan-20260830 - Ship the MoonLive script library.md b/docs/history/plans/archive/Plan-20260830 - Ship the MoonLive script library (shipped).md
similarity index 100%
rename from docs/history/plans/Plan-20260830 - Ship the MoonLive script library.md
rename to docs/history/plans/archive/Plan-20260830 - Ship the MoonLive script library (shipped).md
diff --git a/docs/history/plans/Plan-20260831 - Scripts declare dimensions and tags.md b/docs/history/plans/archive/Plan-20260831 - Scripts declare dimensions and tags (shipped).md
similarity index 100%
rename from docs/history/plans/Plan-20260831 - Scripts declare dimensions and tags.md
rename to docs/history/plans/archive/Plan-20260831 - Scripts declare dimensions and tags (shipped).md
diff --git a/docs/metrics/repo-health.json b/docs/metrics/repo-health.json
index 5b41349e..8fc21bd1 100644
--- a/docs/metrics/repo-health.json
+++ b/docs/metrics/repo-health.json
@@ -1,45 +1,47 @@
 {
-  "commit": "7f46574a",
+  "commit": "52e03cbe",
   "flash": {
-    "esp32s3-n16r8": 2065376,
-    "desktop": 1855496,
-    "esp32": 2023776,
-    "esp32p4rev1-eth": 1955408,
+    "esp32s3-n16r8": 2100032,
+    "desktop": 1909016,
+    "esp32": 2059664,
+    "esp32p4rev1-eth": 1979232,
     "esp32p4rev1-eth-wifi": 2019392,
-    "esp32s3-n8r8": 1971008,
+    "esp32s3-n8r8": 2087168,
     "esp32s31": 2348592,
     "esp32-16mb": 1809472,
     "esp32-eth": 1397456,
     "esp32-wrover": 1843760,
     "qemu": 1383648,
     "esp32p4rev3-eth": 1643760,
-    "esp32s3-zero": 1788624,
+    "esp32s3-zero": 2024192,
     "esp32-pico": 2071584
   },
   "measured": {
-    "esp32p4rev1-eth": "2026-09-06",
+    "esp32p4rev1-eth": "2026-09-08",
     "esp32s31": "2026-09-06",
-    "esp32": "2026-09-06",
+    "esp32": "2026-09-08",
     "esp32-pico": "2026-09-06",
-    "esp32s3-n16r8": "2026-09-06",
-    "desktop": "2026-09-06"
+    "esp32s3-n16r8": "2026-09-08",
+    "desktop": "2026-09-08",
+    "esp32s3-n8r8": "2026-09-08",
+    "esp32s3-zero": "2026-09-08"
   },
   "perf": {
     "desktop": {
-      "tick_us": 137,
-      "fps": 7299,
+      "tick_us": 140,
+      "fps": 7142,
       "scenario_p50": {
         "Layer_base_pipeline": {
           "p50": 71,
-          "p95": 179,
+          "p95": 197,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "Layer_memory_1to1": {
           "p50": 5,
           "p95": 40,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         }
       }
     },
@@ -50,10 +52,10 @@
     "scenario_matrix": {
       "MoonModule_control_change": {
         "desktop-macos": {
-          "p50": 144,
+          "p50": 143,
           "p95": 248,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "p50": 89895,
@@ -169,7 +171,7 @@
           "p50": 26,
           "p95": 70,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 40,
@@ -192,18 +194,18 @@
       },
       "Aurora_fps": {
         "desktop-macos": {
-          "p50": 1514,
+          "p50": 1518,
           "p95": 1828,
-          "n": 23,
-          "last": "2026-09-06"
+          "n": 26,
+          "last": "2026-09-07"
         }
       },
       "Driver_mutation": {
         "desktop-macos": {
-          "p50": 21,
-          "p95": 64,
+          "p50": 20,
+          "p95": 88,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 42,
@@ -226,10 +228,10 @@
       },
       "Effects_composition": {
         "desktop-macos": {
-          "p50": 169,
+          "p50": 148,
           "p95": 768,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 549,
@@ -240,26 +242,26 @@
       },
       "Fields_polar_lut": {
         "desktop-macos": {
-          "p50": 1234,
-          "p95": 1402,
-          "n": 24,
-          "last": "2026-09-06"
+          "p50": 1239,
+          "p95": 1686,
+          "n": 27,
+          "last": "2026-09-07"
         }
       },
       "Fluid_solver": {
         "desktop-macos": {
-          "p50": 220,
-          "p95": 249,
-          "n": 17,
-          "last": "2026-09-06"
+          "p50": 222,
+          "p95": 259,
+          "n": 20,
+          "last": "2026-09-07"
         }
       },
       "GridBlacks_blackpixel": {
         "desktop-macos": {
           "p50": 2,
-          "p95": 12,
+          "p95": 16,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "p50": 267,
@@ -285,7 +287,7 @@
           "p50": 127,
           "p95": 311,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "p50": 82231,
@@ -327,9 +329,9 @@
       "Layer_base_pipeline": {
         "desktop-macos": {
           "p50": 71,
-          "p95": 179,
+          "p95": 197,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 118,
@@ -343,7 +345,7 @@
           "p50": 5,
           "p95": 40,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 1,
@@ -354,10 +356,10 @@
       },
       "Layouts_mutation": {
         "desktop-macos": {
-          "p50": 96,
+          "p50": 97,
           "p95": 248,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 111,
@@ -407,9 +409,9 @@
       "MoonLiveEffect_livescript": {
         "desktop-macos": {
           "p50": 6,
-          "p95": 22,
-          "n": 32,
-          "last": "2026-09-06"
+          "p95": 8,
+          "n": 16,
+          "last": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "p50": 8255,
@@ -459,7 +461,7 @@
           "p50": 6,
           "p95": 21,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 1,
@@ -471,9 +473,9 @@
       "MultiplyModifier_memory_lut": {
         "desktop-macos": {
           "p50": 3,
-          "p95": 21,
+          "p95": 19,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 3,
@@ -487,7 +489,7 @@
           "p50": 126,
           "p95": 283,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 225,
@@ -498,18 +500,18 @@
       },
       "Trails_ladder": {
         "desktop-macos": {
-          "p50": 355,
-          "p95": 608,
-          "n": 18,
-          "last": "2026-09-06"
+          "p50": 360,
+          "p95": 442,
+          "n": 21,
+          "last": "2026-09-07"
         }
       },
       "modifier_chain": {
         "desktop-macos": {
-          "p50": 47,
-          "p95": 123,
+          "p50": 44,
+          "p95": 112,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 69,
@@ -529,7 +531,7 @@
           "p50": 24,
           "p95": 87,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "esp32-eth": {
           "p50": 1010,
@@ -567,7 +569,7 @@
           "p50": 279,
           "p95": 1114,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "p50": 16915,
@@ -599,7 +601,7 @@
           "p50": 17,
           "p95": 61,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "p50": 2485,
@@ -640,10 +642,10 @@
           "last": "2026-07-25"
         },
         "desktop-macos": {
-          "p50": 308,
+          "p50": 296,
           "p95": 881,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "desktop-windows": {
           "p50": 649,
@@ -667,9 +669,9 @@
         },
         "desktop-macos": {
           "p50": 4,
-          "p95": 16,
+          "p95": 14,
           "n": 32,
-          "last": "2026-09-06"
+          "last": "2026-09-07"
         },
         "esp32p4rev1-eth": {
           "p50": 217,
@@ -693,54 +695,54 @@
     }
   },
   "loc": {
-    "core": 25516,
-    "light": 34615,
-    "platform": 18036,
-    "ui": 10204,
-    "test": 56361,
-    "moondeck": 22570
+    "core": 26039,
+    "light": 35627,
+    "platform": 18503,
+    "ui": 10621,
+    "test": 57455,
+    "moondeck": 22710
   },
   "comments": {
     "core": {
-      "lines": 10242,
-      "ratio": 0.434
+      "lines": 10452,
+      "ratio": 0.433
     },
     "light": {
-      "lines": 13197,
-      "ratio": 0.419
+      "lines": 13532,
+      "ratio": 0.417
     },
     "platform": {
-      "lines": 6336,
+      "lines": 6500,
       "ratio": 0.385
     },
     "ui": {
-      "lines": 3014,
-      "ratio": 0.312
+      "lines": 3164,
+      "ratio": 0.314
     },
     "test": {
-      "lines": 10536,
-      "ratio": 0.214
+      "lines": 10784,
+      "ratio": 0.215
     },
     "moondeck": {
-      "lines": 3673,
+      "lines": 3690,
       "ratio": 0.186
     }
   },
   "tests": {
-    "cases": 1955,
+    "cases": 1992,
     "scenarios": 27
   },
   "docs": {
-    "md_files": 219,
-    "md_lines": 36362,
-    "plans_files": 115,
-    "backlog_lines": 6747,
+    "md_files": 220,
+    "md_lines": 36832,
+    "plans_files": 116,
+    "backlog_lines": 6794,
     "lessons_lines": 705,
     "claude_md_lines": 259
   },
   "complexity": {
-    "functions": 3441,
-    "over_threshold": 239,
+    "functions": 3498,
+    "over_threshold": 249,
     "worst_ccn": 108
   }
 }
diff --git a/docs/metrics/repo-health.md b/docs/metrics/repo-health.md
index 183df585..07314a18 100644
--- a/docs/metrics/repo-health.md
+++ b/docs/metrics/repo-health.md
@@ -1,6 +1,6 @@
 # Repo health
 
-Measured at `7f46574a`. Generated by [`moondeck/check/repo_health.py`](../../moondeck/check/repo_health.py) on every KPI-gate run. **Do not edit by hand.**
+Measured at `52e03cbe`. Generated by [`moondeck/check/repo_health.py`](../../moondeck/check/repo_health.py) on every KPI-gate run. **Do not edit by hand.**
 
 Current state only; the trend is this file's git history (`git log -p docs/metrics/repo-health.md`). Nothing here fails a build: the numbers make growth visible, the judgment stays human.
 
@@ -8,19 +8,19 @@ Current state only; the trend is this file's git history (`git log -p docs/metri
 
 | Target | Flash | Capacity | Used | Built |
 |---|---:|---:|---:|:--:|
-| desktop | 1,812 KB (+0 KB) ⚠ | - | - | yes |
-| esp32 | 1,976 KB (+2 KB) ⚠ | 2,496 KB | 79% | yes |
+| desktop | 1,864 KB | - | - | yes |
+| esp32 | 2,011 KB (+3 KB) ⚠ | 2,496 KB | 81% | yes |
 | esp32-16mb | 1,767 KB | - | - | carried (age?) |
 | esp32-eth | 1,365 KB | - | - | carried (age?) |
-| esp32-pico | 2,023 KB (+2 KB) ⚠ | 3,072 KB | 66% | yes |
+| esp32-pico | 2,023 KB | 3,072 KB | 66% | carried 2d |
 | esp32-wrover | 1,801 KB | - | - | carried (age?) |
-| esp32p4rev1-eth | 1,910 KB | 4,096 KB | 47% | yes |
+| esp32p4rev1-eth | 1,933 KB | 4,096 KB | 47% | yes |
 | esp32p4rev1-eth-wifi | 1,972 KB | - | - | carried (age?) |
 | esp32p4rev3-eth | 1,605 KB | - | - | carried (age?) |
-| esp32s3-n16r8 | 2,017 KB | 4,096 KB | 49% | yes |
-| esp32s3-n8r8 | 1,925 KB | - | - | carried (age?) |
-| esp32s3-zero | 1,747 KB | - | - | carried (age?) |
-| esp32s31 | 2,294 KB | 4,096 KB | 56% | yes |
+| esp32s3-n16r8 | 2,051 KB | 4,096 KB | 50% | yes |
+| esp32s3-n8r8 | 2,038 KB | 3,072 KB | 66% | yes |
+| esp32s3-zero | 1,977 KB | 2,496 KB | 79% | yes |
+| esp32s31 | 2,294 KB | 4,096 KB | 56% | carried 2d |
 | qemu | 1,351 KB | - | - | carried (age?) |
 
 `Built: yes` was measured this run. `carried (age?)` was not rebuilt either and predates this record, so its age is unknown: it dates itself on the next build. `carried Nd` was NOT rebuilt and its number is N days old, so an absent delta says nothing about the change. **STALE** marks a carry older than 7 days: the number has gone unchecked long enough that growth will surface later as one jump, blamed on whichever commit happens to rebuild that target. `Used` is against the app slot in the firmware's own partition table.
@@ -29,40 +29,40 @@ Current state only; the trend is this file's git history (`git log -p docs/metri
 
 | Target | Tick | FPS |
 |---|---:|---:|
-| desktop | 137 µs (−17 µs) ✓ | 7,299 (+806) ✓ |
+| desktop | 140 µs (−489 µs) ✓ | 7,142 (+5,553) ✓ |
 | esp32 | 8,354 µs | 119 |
 
 ### Scenario tick by target (p50 of each sample window)
 
 | Scenario | desktop-macos | desktop-windows | esp32 | esp32s3-n16r8 | esp32p4rev1-eth | esp32s31 | esp32-eth | esp32-eth-wifi | unknown |
 |---|---|---|---|---|---|---|---|---|---|
-| Audio_mutation | 26 (−2) ✓ | 40 ? | 13,152 | 47 ? | - | - | - | - | - |
-| Aurora_fps | 1,514 (+8) ⚠ | - | - | - | - | - | - | - | - |
-| Driver_mutation | 21 (−11) ✓ | 42 ? | 12,812 | 39 ? | - | - | - | - | - |
-| Effects_composition | 169 (−197) ✓ | 549 ? | - | - | - | - | - | - | - |
-| Fields_polar_lut | 1,234 (+6) ⚠ | - | - | - | - | - | - | - | - |
-| Fluid_solver | 220 (−2) ✓ | - | - | - | - | - | - | - | - |
-| GridBlacks_blackpixel | 2 (−3) ✓ | 8 ? | 269 ? | 267 ? | - | - | - | - | - |
-| GridLayout_resize | 127 (−1) ✓ | 219 ? | 1,352 ? | 1,011 ? | 1,143 ? | - | 95,771 ? | 82,231 ? | - |
-| Layer_base_pipeline | 71 (−23) ✓ | 118 ? | - | - | - | - | - | - | - |
-| Layer_memory_1to1 | 5 (−4) ✓ | 1 ? | - | - | - | - | - | - | - |
-| Layouts_mutation | 96 (−42) ✓ | 111 ? | 13,692 | 45 ? | - | - | 27 ? | - | - |
+| Audio_mutation | 26 | 40 ? | 13,152 | 47 ? | - | - | - | - | - |
+| Aurora_fps | 1,518 | - | - | - | - | - | - | - | - |
+| Driver_mutation | 20 | 42 ? | 12,812 | 39 ? | - | - | - | - | - |
+| Effects_composition | 148 | 549 ? | - | - | - | - | - | - | - |
+| Fields_polar_lut | 1,239 | - | - | - | - | - | - | - | - |
+| Fluid_solver | 222 | - | - | - | - | - | - | - | - |
+| GridBlacks_blackpixel | 2 | 8 ? | 269 ? | 267 ? | - | - | - | - | - |
+| GridLayout_resize | 127 | 219 ? | 1,352 ? | 1,011 ? | 1,143 ? | - | 95,771 ? | 82,231 ? | - |
+| Layer_base_pipeline | 71 | 118 ? | - | - | - | - | - | - | - |
+| Layer_memory_1to1 | 5 | 1 ? | - | - | - | - | - | - | - |
+| Layouts_mutation | 97 | 111 ? | 13,692 | 45 ? | - | - | 27 ? | - | - |
 | MoonLiveEffect_controls | 11 ? | - | 12,901 | 4,624 ? | - | - | - | - | - |
-| MoonLiveEffect_livescript | 6 (−3) ✓ | - | 13,433 ? | 8,255 ? | 11,336 ? | - | - | - | - |
-| MoonLive_pipeline | 6 (−4) ✓ | 1 ? | 9,604 ? | 3,278 ? | - | 11,398 ? | - | - | 4,393 ? |
-| MoonModule_control_change | 144 (+1) ⚠ | 262 ? | 212 ? | 166 ? | 165 ? | - | 111,731 ? | 89,895 ? | - |
+| MoonLiveEffect_livescript | 6 | - | 13,433 ? | 8,255 ? | 11,336 ? | - | - | - | - |
+| MoonLive_pipeline | 6 | 1 ? | 9,604 ? | 3,278 ? | - | 11,398 ? | - | - | 4,393 ? |
+| MoonModule_control_change | 143 | 262 ? | 212 ? | 166 ? | 165 ? | - | 111,731 ? | 89,895 ? | - |
 | MqttModule_haDiscovery_toggle | 3 ? | - | 36 ? | 36 ? | - | - | - | - | - |
-| MultiplyModifier_memory_lut | 3 (−1) ✓ | 3 ? | - | - | - | - | - | - | - |
+| MultiplyModifier_memory_lut | 3 | 3 ? | - | - | - | - | - | - | - |
 | MultiplyModifier_pipeline | 126 | 225 ? | - | - | - | - | - | - | - |
 | NetworkModule_eth_reconfigure | - | - | 1,169 ? | 97,843 ? | - | - | - | - | - |
 | NetworkModule_mdns_toggle | 13 ? | - | 36 ? | 36 ? | 21 ? | - | 109,767 ? | 93,963 ? | - |
-| Trails_ladder | 355 (+2) ⚠ | - | - | - | - | - | - | - | - |
-| modifier_chain | 47 (−8) ✓ | 69 ? | 13,337 | - | - | - | - | - | - |
-| modifier_swap | 24 (−9) ✓ | 41 ? | 12,250 | 354 ? | 362 ? | - | 1,010 ? | - | - |
-| perf_full | 279 (−150) ✓ | 592 ? | 10,392 | 16,915 ? | 17,433 ? | - | - | - | - |
-| perf_light | 17 (−10) ✓ | 35 ? | 2,183 | 2,485 ? | 2,038 ? | - | - | - | - |
-| peripheral_grid_sweep | 308 (−177) ✓ | 649 ? | 6,991 ? | - | 11,495 ? | 12,273 ? | - | - | - |
-| peripheral_switch | 4 (−3) ✓ | 9 ? | 437 | 46 ? | 217 ? | - | - | - | - |
+| Trails_ladder | 360 | - | - | - | - | - | - | - | - |
+| modifier_chain | 44 | 69 ? | 13,337 | - | - | - | - | - | - |
+| modifier_swap | 24 | 41 ? | 12,250 | 354 ? | 362 ? | - | 1,010 ? | - | - |
+| perf_full | 279 | 592 ? | 10,392 | 16,915 ? | 17,433 ? | - | - | - | - |
+| perf_light | 17 | 35 ? | 2,183 | 2,485 ? | 2,038 ? | - | - | - | - |
+| peripheral_grid_sweep | 296 | 649 ? | 6,991 ? | - | 11,495 ? | 12,273 ? | - | - | - |
+| peripheral_switch | 4 | 9 ? | 437 | 46 ? | 217 ? | - | - | - | - |
 
 Microseconds. `?` marks a cell backed by fewer than 4 samples, which is a first impression rather than a percentile; several are months old and were captured during a network reconfigure, so they read as whole milliseconds. `-` means that target has never run that scenario.
 
@@ -72,8 +72,8 @@ Microseconds. `?` marks a cell backed by fewer than 4 samples, which is a first
 
 | Scenario | p50 | p95 | n |
 |---|---:|---:|---:|
-| Layer_base_pipeline | 71 µs (−23 µs) ✓ | 179 µs | 32 |
-| Layer_memory_1to1 | 5 µs (−4 µs) ✓ | 40 µs | 32 |
+| Layer_base_pipeline | 71 µs | 197 µs | 32 |
+| Layer_memory_1to1 | 5 µs | 40 µs | 32 |
 
 These build a bare pipeline with no optional modules, so a change here is a change in the pipeline itself rather than in what was measured. A new module belongs in an advanced scenario, which keeps its own numbers.
 
@@ -81,36 +81,36 @@ These build a bare pipeline with no optional modules, so a change here is a chan
 
 | Area | Lines | Comments | Comment share |
 |---|---:|---:|---:|
-| core | 25,516 (+30) ⚠ | 10,242 | 43.4 % (+0.1 %) ⚠ |
-| light | 34,615 (+57) ⚠ | 13,197 | 41.9 % |
-| platform | 18,036 (+173) ⚠ | 6,336 | 38.5 % |
-| ui | 10,204 | 3,014 | 31.2 % |
-| test | 56,361 (+206) ⚠ | 10,536 | 21.4 % |
-| moondeck | 22,570 (+7) ⚠ | 3,673 | 18.6 % |
+| core | 26,039 (+20) ⚠ | 10,452 | 43.3 % |
+| light | 35,627 (+1) ⚠ | 13,532 | 41.7 % |
+| platform | 18,503 (+25) ⚠ | 6,500 | 38.5 % (+0.1 %) ⚠ |
+| ui | 10,621 (+40) ⚠ | 3,164 | 31.4 % (+0.1 %) ⚠ |
+| test | 57,455 (+53) ⚠ | 10,784 | 21.5 % |
+| moondeck | 22,710 (+9) ⚠ | 3,690 | 18.6 % |
 
 ## Tests
 
 | Kind | Count |
 |---|---:|
-| unit cases | 1,955 (+7) ✓ |
+| unit cases | 1,992 (+2) ✓ |
 | scenarios | 27 |
 
 ## Complexity
 
 | Metric | Value |
 |---|---:|
-| functions | 3,441 (+12) ✓ |
-| over threshold | 239 (+1) ⚠ |
+| functions | 3,498 (+1) ✓ |
+| over threshold | 249 |
 | worst CCN | 108 |
 
 ## Documentation
 
 | Metric | Value |
 |---|---:|
-| markdown files | 219 |
-| markdown lines | 36,362 (−207) ✓ |
-| plan files | 115 |
-| backlog lines | 6,747 (−232) ✓ |
-| lessons lines | 705 (+27) ⚠ |
+| markdown files | 220 (+1) ⚠ |
+| markdown lines | 36,832 (+1,940) ⚠ |
+| plan files | 116 (+1) ⚠ |
+| backlog lines | 6,794 |
+| lessons lines | 705 |
 | CLAUDE.md lines | 259 |
 
diff --git a/docs/moonmodules/core/system.md b/docs/moonmodules/core/system.md
index c96638d7..d15f53e5 100644
--- a/docs/moonmodules/core/system.md
+++ b/docs/moonmodules/core/system.md
@@ -103,11 +103,12 @@ Over-the-air firmware flashing — the one operation that swaps the binary and n
 <img src="../../assets/core/FirmwareUpdateModule.png" width="300" alt="Firmware update module controls">
 
 - `firmware` — the OTA image to flash.
-- read-only: `version`, `build`, `firmwarePartition`, `update_pct` (progress; absent on MoonBase
-  devices, where the update overlay carries the progress instead), and on 4 MB
-  boards `moonbase`: the second boot image is present, so installs run through the
-  reboot-into-MoonBase cycle behind one "updating firmware" overlay, and a **MoonBase** button
-  opens the maintenance image directly ([architecture.md § MoonBase](../../architecture.md#moonbase-the-second-boot-image)).
+- read-only: `version`, `build`, `partition`. Where a device carries two images, `image` selects
+  which one those describe and which one an install writes: the app it runs, or MoonBase in the
+  factory slot. Its presence is also what tells the UI that installs run through the
+  reboot-into-MoonBase cycle, behind one "updating firmware" overlay, and that a **Restart in
+  MoonBase** button belongs on the card
+  ([architecture.md § MoonBase](../../architecture.md#moonbase-the-second-boot-image)).
 
 Detail: [technical](moxygen/FirmwareUpdateModule.md)
 
diff --git a/docs/moonmodules/light/MoonLiveLayout.md b/docs/moonmodules/light/MoonLiveLayout.md
index 51051490..ecf4b2c1 100644
--- a/docs/moonmodules/light/MoonLiveLayout.md
+++ b/docs/moonmodules/light/MoonLiveLayout.md
@@ -65,7 +65,7 @@ A script reads whatever it declares. `byte cols = 16;` is a member the script ow
 ### Seeing inside a script
 
 `print(v)` logs a value and returns it, so it wraps any part of an expression: `addLight(print(x), y, 0)`.
-It is for debugging and comes back out again — [what print costs](writing-scripts.md#debugging-print).
+It is for debugging and comes back out again: [what print costs](https://github.com/MoonModules/projectMM/blob/main/moonlive/README.md#debugging-print).
 
 ## How the count is known
 
diff --git a/docs/moonmodules/light/MoonLiveModifier.md b/docs/moonmodules/light/MoonLiveModifier.md
index 824b8133..6dd2b794 100644
--- a/docs/moonmodules/light/MoonLiveModifier.md
+++ b/docs/moonmodules/light/MoonLiveModifier.md
@@ -37,7 +37,7 @@ setXYZ((width - 1 - xPos) * 2, yPos, zPos);   // mirror, then stretch
 ### Seeing inside a script
 
 `print(v)` logs a value and returns it, so it wraps any part of an expression: `setXYZ(print(width - 1 - xPos), yPos, zPos)`.
-It is for debugging and comes back out again — [what print costs](writing-scripts.md#debugging-print).
+It is for debugging and comes back out again: [what print costs](https://github.com/MoonModules/projectMM/blob/main/moonlive/README.md#debugging-print).
 
 ## Limits
 
diff --git a/docs/moonmodules/light/effects.md b/docs/moonmodules/light/effects.md
index a0a4c500..1c9c3f56 100644
--- a/docs/moonmodules/light/effects.md
+++ b/docs/moonmodules/light/effects.md
@@ -29,7 +29,7 @@ Three emitters feed it: circles on an orbit, a Lissajous point tracing a figure
 
 Compare with [Fluid](#fluid): that one solves for pressure and gets vortices forming out of the flow's own history, at roughly twenty passes over the grid against this one's one. Reach for the solver when the medium is the subject, and for this when the subject is the color being carried.
 
-Origin: MoonLight · concept by [Stefan Petrick](https://github.com/StefanPetrick), composition by Jeff (mindful_stone / [4wheeljive](https://github.com/4wheeljive)) in [AuroraPortal](https://github.com/4wheeljive/AuroraPortal/blob/main/src/programs/colorTrails_detail.hpp) · via [MoonLight](https://github.com/MoonModules/MoonLight/blob/main/src/MoonLight/Nodes/Effects/E_FastLED.h)
+Origin: MoonLight · concept by [Stefan Petrick](https://github.com/StefanPetrick), composition by Jeff (mindful_stone / [4wheeljive](https://github.com/4wheeljive)) in [FlowFields](https://github.com/4wheeljive/FlowFields/blob/main/src/flows/flow_noise.h) · via [MoonLight](https://github.com/MoonModules/MoonLight/blob/main/src/MoonLight/Nodes/Effects/E_FastLED.h)
 
 <a id="distortionwaves"></a>
 
@@ -315,7 +315,7 @@ An aquarium on a light wall: fish of three shapes swim across a dark tank, each
 - `school`: how many tiny schooling fish (0-8).
 - `speed`: swim rate in body-lengths, so motion reads the same on any grid; each fish varies around it, and the smaller shapes drift slower, which reads as depth.
 - `spriteSize`: integer magnification (crisp nearest-neighbor); 0 = auto, scaling with the grid so a fish reads as a fish on a 16x16 matrix and on a 768-wide desktop grid alike.
-- `soundReactive`: move to the music: each sprite follows its own frequency band, so the scene breathes rather than surging as one block, and silence stands it still. Without an audio source the sprites keep moving normally.
+- `audioReactive`: move to the music: each sprite follows its own frequency band, so the scene breathes rather than surging as one block, and silence stands it still. Without an audio source the sprites keep moving normally.
 
 Uses the global palette: every fish takes a body color from it, with its band a paler version of that same color rather than a second pick, which would read as two fish fused together.
 
@@ -333,12 +333,59 @@ The classic screensaver on a light wall: chrome toasters with flapping wings and
 - `toast`: how many slices trail along (0–8).
 - `speed`: drift rate in sprite-widths, so flight reads the same on any grid; each flier varies ±25% around it.
 - `spriteSize`: integer magnification for toasters AND toast (crisp nearest-neighbor); 0 = auto, scaling with the grid so a toaster reads as a toaster on a big wall.
-- `soundReactive`: move to the music: each sprite follows its own frequency band, so the scene breathes rather than surging as one block, and silence stands it still. Without an audio source the sprites keep moving normally.
+- `audioReactive`: move to the music: each sprite follows its own frequency band, so the scene breathes rather than surging as one block, and silence stands it still. Without an audio source the sprites keep moving normally.
 
 The sprites carry their own colors (chrome, wing, crust), so the global palette does not apply. Needs a grid at least the toaster's size (12×9).
 
 Origin: projectMM original; inspired by After Dark's Flying Toasters (Berkeley Systems, 1989), suggested by Frank ([softhack007](https://github.com/softhack007)): the pixel art here is drawn fresh for this effect
 
+<a id="fixedpoint"></a>
+
+### FixedPoint 💫🖌️ · 2D
+
+Shapes placed BETWEEN pixels rather than on them. A clock hand drawn on whole pixels jumps a full
+pixel at a time and reads as broken; the same hand placed at a fractional position and antialiased
+moves smoothly, because a pixel's brightness carries the fraction its position cannot.
+
+- `demo`: which figure, or `all` to cycle them.
+    - **clock**: a rim, twelve tick marks and three hands geared 1:12:144. The hands run on fixed
+      periods from the clock rather than on `bpm`, accelerated 10x so a second sweeps in 6 seconds.
+    - **orbits**: four rings circling the center, each breathing on its own oscillator.
+    - **star web**: a pentagram inside two rings, its stroke pulsing on a third harmonic.
+    - **spirograph**: a pen on a wheel rolling inside a larger circle. The figure closes because
+      the rates share a 3:2 ratio.
+    - **lissajous**: two perpendicular oscillators at 3:2, with the phase creeping so the figure
+      morphs rather than repeating.
+    - **cube thin** / **cube thick**: a wireframe cube in perspective, tumbling on two axes. Depth
+      reads as brightness, and on the thick one as stroke width too.
+    - **walkers**: six points on a damped random walk, held near the middle by a weak spring.
+    - **boids**: seven of them on the classic three rules (separation, alignment, cohesion) with
+      soft walls. The flock's shape is emergent; nothing tells it to form one.
+    - **hypotrochoid**: the spirograph with the wheel and pen sizes varying, so each visit draws a
+      different rosette.
+    - **tree**: a recursive trunk forking six levels deep, swaying on a 9 second wind cycle and
+      growing on a 10 second one, so it never repeats a pose.
+- `bpm`: how fast the orbits and curve figures run. The clock keeps its own periods.
+- `fade`: how much of the previous frame survives, which is what leaves the trail. At 255 the
+  shapes are crisp with no trail.
+- `dwell`: seconds each demo holds before `all` moves on (hidden unless `demo` is `all`).
+- `drift`: how far the whole scene wanders from the panel's center, in pixels. The original orbits
+  its origin rather than pinning it; 0 pins it.
+- `zoom`: the camera. It pushes in toward the second hand's tip on a 20 second cycle, so the scene
+  grows and slides off-center at the peak and settles back, which is what makes the clock sweep
+  across the panel rather than sit still. 0 holds the camera fixed.
+
+Built on `draw::disc` / `draw::ring` / `draw::strokeLine`, the sub-pixel family in the draw layer;
+the effect computes no coverage itself. Concept and the original fixed-point canvas demos:
+[Sutaburosu](https://github.com/sutaburosu) in FastLED, via MoonLight, which bundles twelve behind
+one control; all eleven are ported here.
+
+Origin: MoonLight (Sutaburosu)
+
+Detail: [technical](moxygen/FixedPointEffect.md)
+
+[Tests](../../tests/unit-tests.md#fixedpointeffect)
+
 <a id="movinghead"></a>
 
 ### MovingHead 💫🎶🎯 · 1D
@@ -365,11 +412,17 @@ an LED strip paints the color pattern and moves nothing.
 - `panRange` / `tiltRange`: how much of the fixture's travel to use. A head at full pan spends
   much of its sweep pointing away from the audience, so the default is a band around center.
 - `panCenter` / `tiltCenter`: where the sweep is centered (128 = the fixture's middle).
-- `soundReactive`: move and light with the music: the beam swings wider as the room gets louder,
+- `audioReactive`: move and light with the music: the beam swings wider as the room gets louder,
   each head takes its brightness from its own frequency band so the rig ripples rather than pulsing
   as one block, and a beat widens the sweep and flares the color with a short decay so a kick is
   visible rather than a one-frame flicker. Silence holds the rig still, which is what makes it read
   as reactive rather than merely animated.
+- `gobo` / `rotate`: the beam's own wheels, shown only on a rig whose fixtures carry them. Both are
+  raw fixture bytes rather than a slot count: a gobo channel is a range per pattern and every model
+  splits it differently, so the fixture's manual is what says which value selects what.
+- `goboOnBeat`: roll a new gobo on a bass hit instead of holding one pattern all night, then hold
+  that pattern for about two seconds. Without the hold a four-to-the-floor kick changes the pattern
+  four times a second, which reads as a flicker rather than as patterns.
 
 A fixture chain is one-dimensional, so lay the rig out as a **1 x N** grid (width 1, height N):
 extrude duplicates the x=0 column, so N x 1 would copy the first head's aim over every head.
@@ -390,7 +443,7 @@ In this first iteration the characters travel independently and do not notice ea
 - `ghosts`: how many ghosts (0-8); the arcade cast is four.
 - `speed`: travel rate in sprite-widths, so motion reads the same on any grid; Pacman runs slightly ahead of the ghosts, as in the original.
 - `spriteSize`: integer magnification (crisp nearest-neighbor); 0 = auto, scaling with the grid so the characters read on a 16x16 matrix and on a 768-wide desktop grid alike.
-- `soundReactive`: move to the music: each sprite follows its own frequency band, so the scene breathes rather than surging as one block, and silence stands it still. Without an audio source the sprites keep moving normally.
+- `audioReactive`: move to the music: each sprite follows its own frequency band, so the scene breathes rather than surging as one block, and silence stands it still. Without an audio source the sprites keep moving normally.
 
 Pacman is always his own yellow; the ghosts take their body colors from the active palette, so they stay four distinguishable characters whatever palette is loaded.
 
@@ -410,7 +463,7 @@ On a panel narrower than the formation the ranks scroll through the court instea
 - `stepX`: how far a step moves the formation sideways, in pixels.
 - `dropY`: how far a wall turn drops it, in pixels.
 - `size`: integer magnification per art pixel; 1 on a matrix, 2 or more on a wall.
-- `soundReactive`: the beat becomes the clock: the formation steps on transients and stands still in silence, so the march locks to the track.
+- `audioReactive`: the beat becomes the clock: the formation steps on transients and stands still in silence, so the march locks to the track.
 
 The invaders take their body color from the active palette. Origin: projectMM original; inspired by Taito's Space Invaders (1978), the pixel art drawn fresh for this effect
 
@@ -429,7 +482,7 @@ Physics run on elapsed time, not per frame, so the plume looks the same on a 60
 - `rate`: sprites launched per beat of the emit clock.
 - `emitBpm`: launches per minute, so the plume's density is a choice rather than a side effect of how fast the device runs.
 - `size`: integer magnification per art pixel.
-- `soundReactive`: one sprite per frequency band, thrown when that band is loud, so the cast maps onto the spectrum in order: the bass bands throw fish, the treble bands throw invaders. Silence throws nothing.
+- `audioReactive`: one sprite per frequency band, thrown when that band is loud, so the cast maps onto the spectrum in order: the bass bands throw fish, the treble bands throw invaders. Silence throws nothing.
 
 Colors come from the active palette, one entry per sprite, held for its whole flight. Origin: projectMM original
 
@@ -448,7 +501,7 @@ The court is fixed point rather than pixels, so the game plays identically on a
 - `reflex`: how sharply a paddle chases the ball. Below full speed it lags a fast ball, which is where the misses come from.
 - `size`: integer magnification, when the ball is a sprite.
 - `spriteBall`: swap the classic square for a member of the shared sprite cast, re-picked on every hit, so a paddle knocks one character away and another back.
-- `soundReactive`: the ball advances only on the beat, so it crosses the court in time with the track and stands still in silence.
+- `audioReactive`: the ball advances only on the beat, so it crosses the court in time with the track and stands still in silence.
 
 Uses the global palette. Origin: projectMM original; inspired by Atari's Pong (1972)
 
@@ -1178,22 +1231,6 @@ Nothing is transported. The effect keeps a short history of band frames and ever
 
 Origin: projectMM original, the radial spectrogram on `PolarLut` and the onset detector
 
-<a id="audiovolume"></a>
-
-### AudioVolume 💫🎵
-
-<img src="../../assets/light/effects/AudioVolumeEffect.gif" width="300" alt="AudioVolume effect preview">
-
-A whole-grid VU meter: every light pulses with the mic level, color indexing the palette by loudness.
-
-- `brightness`: overall brightness ceiling for the VU pulse (1–255).
-
-Origin: projectMM original (VU meter)
-
-Detail: [technical](moxygen/AudioVolumeEffect.md)
-
-[Tests](../../tests/unit-tests.md#audioservice)
-
 <a id="demoreel"></a>
 
 ### DemoReel 💫 · 3D
diff --git a/docs/moonmodules/light/layouts.md b/docs/moonmodules/light/layouts.md
index 0c09f7f7..bc4b7b1a 100644
--- a/docs/moonmodules/light/layouts.md
+++ b/docs/moonmodules/light/layouts.md
@@ -101,6 +101,7 @@ The classic 241-LED concentric-ring disc: nested rings of 1, 8, 12, 16, 24, 32,
 
 - `scale` — overall radius scale (1–10).
 - `outside in`: light 0 on the outer ring, wired inward, instead of at the center wired outward. The direction around each ring is unchanged.
+- `angleFirst`: where light 0 of each ring sits, in degrees from the bottom (0-359), the same control [Ring](#ring) has. A disc is soldered with its first LED wherever the builder started, so this turns the image to match the hardware rather than re-wiring it. 0 is the unrotated placement.
 
 Origin: MoonLight · via [MoonLight](https://github.com/MoonModules/MoonLight/blob/main/src/MoonLight/Nodes/Layouts/L_MoonLight.h)
 
diff --git a/docs/tutorials/generative-effects.md b/docs/tutorials/generative-effects.md
index a7f3006c..070fab12 100644
--- a/docs/tutorials/generative-effects.md
+++ b/docs/tutorials/generative-effects.md
@@ -388,5 +388,5 @@ before trusting it, because a test that passes on both is measuring nothing.
 ## Where to go next
 
 - **[Power functions](../moonmodules/light/power-functions.md)**: the catalog, with what each one costs and who calls it
-- **[Writing scripts](../moonmodules/light/writing-scripts.md)**: the MoonLive language reference
+- **[Writing scripts](https://github.com/MoonModules/projectMM/blob/main/moonlive/README.md)**: the MoonLive language reference
 - **[Effects](../moonmodules/light/effects.md)**: every effect in the tree, with its controls
diff --git a/moonbase/main/CMakeLists.txt b/moonbase/main/CMakeLists.txt
index 4939f6f0..4640e6e9 100644
--- a/moonbase/main/CMakeLists.txt
+++ b/moonbase/main/CMakeLists.txt
@@ -1,6 +1,11 @@
 idf_component_register(
     SRCS "moonbase_main.cpp"
-    INCLUDE_DIRS ""
+    # The app's src/ is NOT on the include path: MoonBase shares no sources with the application,
+    # which is the trade for an image that stays small and rarely changes. core/FirmwareImage.h is
+    # the one exception, and earns it: a header-only parser of the ESP32 image format that depends
+    # on nothing but <cstdint>. Both images must refuse to install the other, and that rule living
+    # in two hand-written copies is how they drift.
+    INCLUDE_DIRS "../../src"
     # The app's own logo, embedded IDF-natively; served as /logo.png (header + favicon).
     EMBED_FILES "../../src/ui/moonlight-logo.png"
     # esp_https_ota brings esp_http_client and esp-tls with it, so neither is listed separately.
diff --git a/moonbase/main/moonbase_main.cpp b/moonbase/main/moonbase_main.cpp
index 2e8f5f5f..f16ec381 100644
--- a/moonbase/main/moonbase_main.cpp
+++ b/moonbase/main/moonbase_main.cpp
@@ -23,6 +23,8 @@
 #include "esp_event.h"
 #include "esp_http_client.h"
 #include "esp_crt_bundle.h"
+#include "core/FirmwareImage.h"  // identify(): the one shared header, see main/CMakeLists.txt
+#include "esp_app_desc.h"    // esp_app_get_description: this image's own version
 #include "esp_https_ota.h"
 #include "esp_littlefs.h"
 #include "esp_netif.h"
@@ -365,8 +367,12 @@ const char kPage[] =
     "<div id=hdr><img src=/logo.png alt=''><h1>MoonBase</h1>"
     // The (?) module cards carry, pointing at the published MoonBase doc.
     "<a id=hlp target=_blank rel=noopener title='MoonBase documentation' "
-    "href='https://moonmodules.org/projectMM/architecture.html#moonbase-the-second-boot-image-4-mb-boards'>?</a></div>"
-    "<p class=sub>Install firmware to return this device to normal operation.</p>"
+    "href='https://moonmodules.org/projectMM/gettingstarted.html#if-your-device-shows-moonbase'>?</a></div>"
+    "<p class=sub>Install firmware to return this device to normal operation."
+    // WHICH MoonBase this is. Filled by the boot script below rather than baked into this
+    // literal: PROJECT_VER is defined only for IDF's own descriptor TU, and the descriptor is
+    // already in the image, so reading it back costs nothing and cannot drift from it.
+    "<br><small id=v></small></p>"
     "<section><b>From a file</b><br><input type=file id=f accept=.bin>"
     "<button onclick=up()>Install</button>"
     // The last resort when no URL is at hand: name where the firmware-<variant>-v*.bin files
@@ -381,14 +387,34 @@ const char kPage[] =
     // Shown only while an install is running (S() toggles it): the one moment cancel applies.
     "<button id=c onclick=cx() style=display:none>Cancel install</button></section>"
     "<div id=s></div>"
+    // A real bar, not a sweep: an install is a minute of a user watching a number they cannot
+    // read as a fraction. Hidden until a byte count actually arrives.
+    "<progress id=p max=100 style='display:none;width:100%'></progress>"
     "<script>"
     // S() renders the status AND reveals Cancel only while an install is running.
     "const S=t=>{document.getElementById('s').textContent=t;"
     "document.getElementById('c').style.display="
-    "/downloading|starting|preparing|retrying/.test(t)?'':'none';};"
+    "/downloading|starting|preparing|retrying/.test(t)?'':'none';"
+    // The status already carries "N of M bytes"; reading the fraction out of it keeps one source
+    // of truth rather than adding a second endpoint that could disagree with the text.
+    //
+    // A THIRD reader of that shape, and the one that cannot be shared: this page lives in the
+    // MoonBase image, which shares no sources with the app (that is the trade for an image that
+    // stays small). The app's own two readers were merged into installProgress(); this one has
+    // to match it by hand, so keep the shape the same on both sides when either changes.
+    "const m=/(\\d+) of (\\d+)/.exec(t),b=document.getElementById('p');"
+    "if(m&&+m[2]>0){b.style.display='';b.value=100*m[1]/m[2];}else{b.style.display='none';}};"
     // Surface the last install status on load: after a failed unattended install the user lands
     // here, and the page should say what went wrong rather than look freshly booted.
-    "fetch('/moonbase').then(r=>r.text()).then(t=>{if(t&&t!='idle')S(t)}).catch(()=>{});"
+    "fetch('/moonbase').then(r=>r.text()).then(t=>{if(t&&t!='idle'){S(t);"
+    // AND WATCH IT. An install staged by the app runs unattended, so nothing on this page had
+    // started the watcher: the install finished, the app came back at this same address, and the
+    // page sat on its last status until someone reloaded by hand.
+    "if(/downloading|starting|preparing|retrying/.test(t))W();}}).catch(()=>{});"
+    // A device that cannot say which MoonBase it runs cannot be diagnosed: two boards looked
+    // identical while one could not install firmware, and telling them apart took a git bisect.
+    "fetch('/api/version').then(r=>r.text()).then(t=>{"
+    "document.getElementById('v').textContent='version '+t}).catch(()=>{});"
     // The file is sent as the RAW request body, not multipart: the device then writes bytes
     // straight to flash with no boundary parsing, which is a meaningful saving in an image this
     // size and matches how the application's own upload route works.
@@ -415,8 +441,15 @@ const char kPage[] =
 
 // The application slot. From the factory partition esp_ota_get_next_update_partition returns the
 // first OTA slot, which is the one we want and is never the one we are running from.
+//
+// UNLESS THIS IMAGE IS ITSELF IN THE APP SLOT, which happens when someone installs MoonBase as if
+// it were the app: both partitions then hold MoonBase, next_update_partition hands back the one
+// executing, and every install fails with ESP_ERR_OTA_PARTITION_CONFLICT (0x1501) while boot-app
+// points the bootloader at itself. The device answers, serves this page, and cannot be recovered
+// over the network. Returning null here is what lets the callers say so rather than loop.
 const esp_partition_t* appPartition() {
-    return esp_ota_get_next_update_partition(nullptr);
+    const esp_partition_t* part = esp_ota_get_next_update_partition(nullptr);
+    return (part && part == esp_ota_get_running_partition()) ? nullptr : part;
 }
 
 // Write a firmware image pulled from `url` straight into the application slot. This is what makes
@@ -463,6 +496,21 @@ bool installFromUrl(const char* url) {
                       static_cast<unsigned>(beginErr));
         return false;
     }
+    // NOT ANOTHER MOONBASE. This writes the APP slot, and a MoonBase image landing there leaves
+    // both partitions holding MoonBase: every install then fails with a partition conflict
+    // because next_update_partition hands back the running one, and boot-app points the
+    // bootloader at itself. The device still answers and still serves this page, which is what
+    // makes it so easy to do and so hard to undo: only a cable gets it back. The two images sit
+    // side by side on the releases page, one paste apart.
+    esp_app_desc_t incoming = {};
+    if (esp_https_ota_get_img_desc(handle, &incoming) == ESP_OK &&
+        std::strncmp(incoming.project_name, "projectMM-moonbase",
+                     sizeof(incoming.project_name)) == 0) {
+        std::snprintf(status_, sizeof(status_), "error: that is a MoonBase image, not an app");
+        esp_https_ota_abort(handle);
+        return false;
+    }
+
     esp_err_t err;
     while ((err = esp_https_ota_perform(handle)) == ESP_ERR_HTTPS_OTA_IN_PROGRESS) {
         if (cancelRequested_) {
@@ -538,7 +586,13 @@ void sendResponse(int sock, const char* status, const char* type, const char* bo
 // arrived in the same read as the headers.
 bool installFromSocketLocked(int sock, const char* prefix, size_t prefixLen, size_t contentLen) {
     const esp_partition_t* part = appPartition();
-    if (!part) { std::snprintf(status_, sizeof(status_), "error: no app partition"); return false; }
+    if (!part) {
+        // Either no OTA slot at all, or this MoonBase is running FROM it (see appPartition):
+        // the second is what a user meets, and a cable is the only way back.
+        std::snprintf(status_, sizeof(status_),
+                      "error: this MoonBase is in the app slot; reflash over USB");
+        return false;
+    }
     if (contentLen == 0 || contentLen > part->size) {
         std::snprintf(status_, sizeof(status_), "error: image is %u bytes, the slot holds %u",
                       static_cast<unsigned>(contentLen), static_cast<unsigned>(part->size));
@@ -553,6 +607,27 @@ bool installFromSocketLocked(int sock, const char* prefix, size_t prefixLen, siz
 
     size_t written = 0;
     if (prefixLen > contentLen) prefixLen = contentLen;   // never store bytes past the declared body
+    // Same refusal as the URL path, from the bytes already in hand. The offsets and the rule come
+    // from core/FirmwareImage.h, the same header the app's install path uses: hand-written
+    // offsets here would be a second copy of the image format to keep in step.
+    //
+    // Refused when the prefix is too SHORT to identify, rather than passed. identify() on a short
+    // buffer reports "no description" for an image that has one, so a guard that only rejects a
+    // described MoonBase image would wave it through whenever the headers arrived alone. Every
+    // real image carries its descriptor in the first 128 bytes.
+    if (prefixLen < mm::firmware::kIdentifyBytes) {
+        esp_ota_abort(handle);
+        std::snprintf(status_, sizeof(status_), "error: could not identify the image");
+        return false;
+    }
+    const auto incomingUp = mm::firmware::identify(
+        reinterpret_cast<const uint8_t*>(prefix), prefixLen);
+    if (incomingUp.described &&
+        std::strcmp(incomingUp.project, "projectMM-moonbase") == 0) {
+        esp_ota_abort(handle);
+        std::snprintf(status_, sizeof(status_), "error: that is a MoonBase image, not an app");
+        return false;
+    }
     if (prefixLen) {
         if (esp_ota_write(handle, prefix, prefixLen) != ESP_OK) {
             esp_ota_abort(handle);
@@ -707,6 +782,13 @@ void serveOne(int sock) {
         const esp_partition_t* app = appPartition();
         const bool ok = app && esp_ota_set_boot_partition(app) == ESP_OK;
         if (ok) std::snprintf(status_, sizeof(status_), "booting the app");
+        else if (!app) {
+            // appPartition returns null when THIS image is the one in the app slot. Before this,
+            // boot-app pointed the bootloader at itself and reported success, so the device
+            // "rebooted into the app" and arrived back here, forever.
+            std::snprintf(status_, sizeof(status_),
+                          "error: this MoonBase is in the app slot; reflash over USB");
+        }
         else    std::snprintf(status_, sizeof(status_), "error: no valid app image");
         sendResponse(sock, ok ? "200 OK" : "500 Internal Server Error", "text/plain", status_);
         installed = ok;   // reuse the reply-then-restart tail below
@@ -727,6 +809,16 @@ void serveOne(int sock) {
         } else {
             sendResponse(sock, "200 OK", "text/plain", "nothing to cancel");
         }
+    } else if (std::strncmp(head, "GET /api/version", 16) == 0) {
+        // This image's version, from the app descriptor IDF puts in every binary (PROJECT_VER,
+        // set by build_moonbase to the same string the application reports). Its own route
+        // rather than an addition to /moonbase, whose body the app UI parses as install status.
+        //
+        // The app reads the same version from the factory partition instead (otaMoonBaseVersion),
+        // because it cannot ask an image that is not running. Two readers, two situations: this
+        // one serves a user looking at MoonBase's own page, that one a user looking at the app's.
+        const esp_app_desc_t* d = esp_app_get_description();
+        sendResponse(sock, "200 OK", "text/plain", d ? d->version : "unknown");
     } else if (std::strncmp(head, "GET /moonbase", 13) == 0) {
         // Identity probe: the app UI polls this across the update cycle to tell which image is
         // answering at the shared address (the app 404s it). Body = the live install status, so
diff --git a/moondeck/MoonDeck.md b/moondeck/MoonDeck.md
index 219d8390..2cbd3c62 100644
--- a/moondeck/MoonDeck.md
+++ b/moondeck/MoonDeck.md
@@ -995,6 +995,25 @@ uv run moondeck/build/erase_flash_esp32.py --port /dev/tty.usbserial-0001
 
 Typical use: forcing a fresh-first-boot after firmware experiments leave the LittleFS partition in a state the new firmware can't migrate from, or before testing the post-flash Improv provisioning flow as if the device just came out of the factory. After erase, re-run **Build** then **Flash** — the device boots with empty persistence and goes straight to AP-fallback / Improv-awaiting-credentials.
 
+### serve_firmware
+
+Serve a built firmware over HTTP so a board can install it by URL. Long-running.
+
+```bash
+uv run moondeck/run/serve_firmware.py esp32 --port 8099
+uv run moondeck/run/serve_firmware.py build/moonbase-esp32/projectMM-moonbase.bin --port 8098
+```
+
+Takes a firmware name (resolved to `build/esp32-<name>/projectMM.bin`) or a path to any `.bin`, and
+prints the LAN URL to paste into the Firmware card or MoonBase's own page. The file is re-read per
+request, so a rebuild needs no restart.
+
+**It exists because `python -m http.server` speaks HTTP/1.0**, whose default is no keep-alive and a
+body that ends at connection close rather than at Content-Length. `esp_https_ota` asks for
+keep-alive and a 32 KB receive buffer, and against a 1.0 server the transfer crawls and then fails
+with `0xffffffff` partway through. That cost two failed OTA attempts on a bench board before the
+`HTTP/1.0` in the response line was spotted, while the same URL from GitHub worked first time.
+
 ### monitor_esp32
 
 Monitor serial output. Long-running — shows Stop button.
diff --git a/moondeck/build/build_esp32.py b/moondeck/build/build_esp32.py
index 0de13e08..988f0d4c 100644
--- a/moondeck/build/build_esp32.py
+++ b/moondeck/build/build_esp32.py
@@ -14,6 +14,8 @@
 import sys
 from pathlib import Path
 
+import compute_version   # sibling: the one place a version string is derived
+
 ROOT = Path(__file__).resolve().parent.parent.parent
 ESP32_DIR = ROOT / "esp32"
 
@@ -539,6 +541,12 @@ def firmware_cmake_args(firmware: str, release: str = "", version: str = "",
     # Same for the computed version — empty leaves build_info.h's library.json default.
     if version:
         args.append(f'-DMM_VERSION="{version}"')
+    # And into the IMAGE's app descriptor, the struct IDF puts in every binary. Without it the
+    # descriptor keeps IDF's `git describe` fallback, which drifts from what the device reports
+    # (a stale tag read "container-test-1-g73e52cb9-dirt" long after that tag was gone). MoonBase
+    # carries the same string, so the app can compare the two images by equality and say when its
+    # recovery image was built apart from it.
+    args.append(f"-DPROJECT_VER={version or compute_version.compute('local', '')}")
     if spec["eth_only"]:
         # Drop the WiFi components from the link, and tell our code to compile
         # out the WiFi paths (MM_ETH_ONLY → esp32/main/CMakeLists.txt).
@@ -824,7 +832,7 @@ def main():
     subprocess.run(cmd + b_arg + ["size"], cwd=ESP32_DIR, env=env)
 
     if FIRMWARES[firmware].get("moonbase"):
-        build_moonbase(cmd, env, chip)
+        build_moonbase(cmd, env, chip, args.version)
 
 
 # ---- MoonBase flash layout, shared by every consumer of the build output ----
@@ -909,19 +917,32 @@ def moonbase_flash_files(firmware: str, build_dir: Path) -> list[tuple[str, Path
     return writes
 
 
-def build_moonbase(cmd: list[str], env: dict, chip: str) -> None:
+def build_moonbase(cmd: list[str], env: dict, chip: str, version: str = "") -> None:
     """Build the MoonBase image for `chip` into build/moonbase-<chip>.
 
-    MoonBase (moonbase/) is the second boot image the 4 MB variants carry in their factory
+    MoonBase (moonbase/) is the second boot image the MoonBase variants carry in their factory
     partition: a small firmware whose job is installing the application, since a board with one
     app slot cannot rewrite the partition it is executing from. It is chip-specific but variant-
-    agnostic, so the four classic variants share one build. Its size budget lives in
+    agnostic, so every classic variant shares one build. Its size budget lives in
     moonbase/sdkconfig.defaults; the shared partition table keeps the two images provably agreed
     on where everything lives.
+
+    `version` becomes PROJECT_VER, which IDF writes into the image's app descriptor. The app
+    reads it back from the factory partition to report which MoonBase a device carries, so
+    without it a device cannot say what it is running: a bench board that could not install
+    firmware took a bisect of the git log to identify, because every MoonBase looked alike.
+    A version is variant-independent, so passing it keeps one image per chip valid. Empty for a
+    local build, where IDF falls back to `git describe`.
     """
     moonbase_dir = ROOT / "moonbase"
     build_dir = ROOT / "build" / f"moonbase-{chip}"
     b_arg = ["-B", str(build_dir), f"-DSDKCONFIG={build_dir}/sdkconfig"]
+    if not version:
+        # The app resolves this through build_info.h's #ifndef; MoonBase has no build_info.h, so
+        # it resolves the same library.json default here rather than reporting a git-describe
+        # string the app has no way to compare against.
+        version = compute_version.compute("local", "")
+    b_arg.append(f"-DPROJECT_VER={version}")
     # Same trap as stale_feature_cache: IDF generates sdkconfig from the defaults only when it is
     # absent, so an edited moonbase/sdkconfig.defaults silently changes nothing. One defaults file
     # here, so mtime is a sufficient staleness signal.
diff --git a/moondeck/check/check_nonblocking.py b/moondeck/check/check_nonblocking.py
index 8387e40b..1281a1bb 100644
--- a/moondeck/check/check_nonblocking.py
+++ b/moondeck/check/check_nonblocking.py
@@ -427,8 +427,24 @@ def build_output(build_dir, clean=True):
 
     # FAIL CLOSED. -Wfunction-effects exists only on Clang 20+; CMake silently omits the flag
     # on anything else, and this script would then report "0 findings" from a build that never
-    # ran the check — indistinguishable from a clean tree. A zero is only trustworthy if the
+    # ran the check: indistinguishable from a clean tree. A zero is only trustworthy if the
     # warning is actually enabled, so say so instead of reporting a comfortable number.
+    #
+    # INCREMENTAL asks a narrower question and needs a narrower guard. A run where nothing
+    # recompiled legitimately produces no diagnostics, so an empty log there is not proof the
+    # flag is missing. What it IS proof of is that nothing was measured, and a gate that prints
+    # a tick for an empty read is the silent zero this whole function exists to prevent. So the
+    # caller is told which of the two happened rather than being handed a clean bill either way.
+    if not clean and "[-Wfunction-effects]" not in out:
+        compiled = any(line.startswith("[") and ".cpp" in line for line in out.splitlines())
+        print("Nothing was measured: this incremental build produced no -Wfunction-effects\n"
+              + ("output, and no translation unit recompiled. Every file is cached, so this run\n"
+                 "says nothing about the tree. Re-run without --incremental for the full picture.\n"
+                 if not compiled else
+                 "output even though something recompiled, which means the warning is not enabled\n"
+                 "(it needs Clang 20+; CMake omits it silently otherwise).\n"),
+              file=sys.stderr)
+        return None
     if clean and "[-Wfunction-effects]" not in out:
         print("No -Wfunction-effects diagnostics in the build output.\n"
               "That means either the tree really is clean, or the compiler does not support the\n"
diff --git a/moondeck/run/serve_firmware.py b/moondeck/run/serve_firmware.py
new file mode 100644
index 00000000..53126d80
--- /dev/null
+++ b/moondeck/run/serve_firmware.py
@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+"""Serve a built firmware binary over HTTP so a board can pull it via OTA.
+
+MoonBase and the app's updater both take a URL and stream it with
+`esp_https_ota`, which is the fast path for putting a local build on a board
+that is not on USB. What it needs from the other end is HTTP/1.1.
+
+WHY THIS SCRIPT EXISTS rather than `python -m http.server`: that serves
+HTTP/1.0, whose default is no keep-alive and a body that ends when the
+connection closes rather than at Content-Length. MoonBase asks for keep-alive
+and a 32 KB receive buffer, and against a 1.0 server the transfer crawls and
+then fails with `0xffffffff` (ESP_FAIL) partway through. That cost two failed
+OTA attempts on a bench board before the `HTTP/1.0` in the response line was
+spotted, while the identical URL from GitHub (HTTP/1.1) worked first time.
+
+Serves exactly one file, read fresh per request so a rebuild is picked up
+without a restart.
+"""
+
+import argparse
+import http.server
+import socket
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent.parent
+
+
+def _lan_ip() -> str:
+    """The address a board on the LAN can reach, not 127.0.0.1.
+
+    No packet is sent: connect() on a UDP socket only picks the route, which is
+    what names the interface the board would arrive on. That needs a route to
+    exist, though, and a bench network with no way out has none, so a failure
+    here falls back to the hostname and finally to a placeholder. The address is
+    only PRINTED, so getting it wrong must not stop the server binding: an
+    isolated network is exactly where this script is most useful.
+    """
+    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    try:
+        s.connect(("8.8.8.8", 80))
+        return s.getsockname()[0]
+    except OSError:
+        try:
+            return socket.gethostbyname(socket.gethostname())
+        except OSError:
+            return "<this machine>"
+    finally:
+        s.close()
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__,
+                                 formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("firmware", help="path to the .bin, or a firmware name under build/esp32-<name>/")
+    ap.add_argument("--port", type=int, default=8099)
+    args = ap.parse_args()
+
+    binary = Path(args.firmware)
+    if not binary.is_file():
+        binary = ROOT / f"build/esp32-{args.firmware}/projectMM.bin"
+    if not binary.is_file():
+        print(f"no firmware at {binary}", file=sys.stderr)
+        return 1
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        # THE POINT OF THIS SCRIPT. Content-Length framing and keep-alive, both
+        # of which esp_https_ota relies on.
+        protocol_version = "HTTP/1.1"
+
+        def _send(self, body: bool) -> None:
+            data = binary.read_bytes()   # re-read per request: a rebuild needs no restart
+            self.send_response(200)
+            self.send_header("Content-Type", "application/octet-stream")
+            self.send_header("Content-Length", str(len(data)))
+            self.end_headers()
+            if body:
+                self.wfile.write(data)
+
+        def do_HEAD(self) -> None:
+            self._send(body=False)
+
+        def do_GET(self) -> None:
+            self._send(body=True)
+
+        def log_message(self, fmt: str, *a) -> None:
+            print(f"  {self.address_string()} {fmt % a}", flush=True)
+
+    url = f"http://{_lan_ip()}:{args.port}/{binary.name}"
+    print(f"serving {binary} ({binary.stat().st_size} bytes) as HTTP/1.1")
+    print(f"  {url}")
+    print("  paste that into MoonBase's 'From a URL', or POST it to /api/firmware/url")
+    print("  ctrl-c to stop")
+    with http.server.ThreadingHTTPServer(("", args.port), Handler) as httpd:
+        try:
+            httpd.serve_forever()
+        except KeyboardInterrupt:
+            print("\nstopped")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/moonlive/README.md b/moonlive/README.md
index dcbd06fc..2a417f33 100644
--- a/moonlive/README.md
+++ b/moonlive/README.md
@@ -17,14 +17,16 @@ class CrosshairEffect {
 
   void defineControls() { addControl("bpm", bpm, 1, 240); }
 
-  void column() { for (int y = 0; y < height; y = y + 1) { setRGB(y * width + scale(beat(bpm, t), width), 255, 40, 0); } }
-  void tick()   { fill(0, 0, 0); column(); }
+  void column(int cx) { for (int y = 0; y < height; y = y + 1) { setRGB(y * width + cx, 255, 40, 0); } }
+  void tick()         { fill(0, 0, 0); column(scale(beat(bpm, t), width)); }
 }
 ```
 
 These are real calls, not pasted-in text: the callee gets its own frame when it runs, which is what
-lets one helper call another and lets a function recurse. A function takes no arguments yet, so a
-helper is parameterized through the class's members. `effects/crosshair.mle` is the worked example.
+lets one helper call another and lets a function recurse. Arguments are passed BY VALUE, so a
+function that writes a parameter changes its own copy and the caller's variable is untouched.
+`effects/crosshair.mle` is the worked example; `layouts/sixteen-rings.mll` is the one where the
+arguments earn their place, calling one helper sixteen times with different coordinates.
 
 **A script is C++, and a compiler checks that.** Every shipped script compiles under
 `c++ -std=c++20 -fsyntax-only` (`test/python/test_scripts_are_cpp.py`), so the language cannot drift
@@ -169,6 +171,31 @@ working script looks like.
 `unit_MoonLiveScripts` compiles every file here, so a script that stops parsing when the language
 changes fails the build rather than waiting to be pasted into a device.
 
+## Editing a shipped script forks it
+
+A device keeps two copies of the library. The ones that ship live in `/.moonlive`; anything you edit
+on the device is saved to `/moonlive`, and **your copy is the one that runs**. That is what makes an
+edit reversible: the original is still there, so the card's delete button becomes a **revert arrow**
+(↺) for a script you have changed, and pressing it brings the shipped version back without needing a
+network.
+
+The cost of that arrangement is that your copy also HIDES later updates to the shipped one, so the
+card says which case it is in. Its status carries one of:
+
+| status | what it means |
+|---|---|
+| (nothing) | the shipped script is running, unedited |
+| `edited copy` | your version is running; the shipped one has not changed since you forked it |
+| `edited copy, shipped one updated` | your version is running, and **the library has a newer one** |
+
+The third is the one to act on: revert to take the new version (losing your changes), or keep yours
+and ignore it. Nothing is decided for you, and nothing overwrites an edit.
+
+Two details worth knowing. Opening a shipped script and saving it **without changing anything**
+creates no copy, so browsing the library cannot accidentally pin a script at today's version. And
+the comparison is against the version you actually forked from, recorded when the fork is made, so
+editing your own copy later does not make an outdated fork look current.
+
 ## Debugging: print
 
 `print(v)` writes a value to the serial log and returns it, so it wraps any part of an expression
diff --git a/moonlive/effects/balls.mle b/moonlive/effects/balls.mle
index e1bda640..9d325602 100644
--- a/moonlive/effects/balls.mle
+++ b/moonlive/effects/balls.mle
@@ -5,11 +5,6 @@ class BallsEffect {
   byte size = 5;
   byte bpm = 20;
 
-  byte b = 0; // the ball being drawn
-  byte radius = 4; // that ball's radius in lights
-  byte px = 0; // its center, across
-  byte py = 0; // its center, down
-
   int dimensions() { return 2; }
 
   string tags() { return "💫"; }
@@ -20,13 +15,13 @@ class BallsEffect {
     addControl("bpm", bpm, 1, 120); // how fast they travel
   }
 
-  void drawBall() {
+  // One ball: a filled disc at (px, py), shaded from its center outward.
+  void drawBall(int px, int py, int radius, int hue) {
     for (int dy = 0; dy < 21; dy = dy + 1) {
       for (int dx = 0; dx < 21; dx = dx + 1) {
-        if ((dx - radius) * (dx - radius) + (dy - radius) * (dy - radius) <= radius * radius) {
-          setPaletteColor(px + dx, py + dy, b * 64,
-                          255 - scale(((dx - radius) * (dx - radius)
-                                       + (dy - radius) * (dy - radius)) * 640, 256));
+        int away = (dx - radius) * (dx - radius) + (dy - radius) * (dy - radius);
+        if (away <= radius * radius) {
+          setPaletteColor(px + dx, py + dy, hue, 255 - scale(away * 640, 256));
         }
       }
     }
@@ -35,19 +30,16 @@ class BallsEffect {
   void tick() {
     fill(0, 0, 0);
 
-    radius = scale(height, size * 819) + 1;
+    int radius = scale(height, size * 819) + 1;
     if (width < height) { radius = scale(width, size * 819) + 1; }
     if (radius > 10) { radius = 10; }
     if (width < radius * 2 + 2) { radius = 0; }
     if (height < radius * 2 + 2) { radius = 0; }
 
-    for (int i = 0; i < 4; i = i + 1) {
-      b = i;
-      if (b < count) {
-        px = beatsin(bpm + b * 7, t, width - radius * 2 - 1);
-        py = beatsin(bpm + b * 5 + 3, t, height - radius * 2 - 1);
-        drawBall();
-      }
+    for (int i = 0; i < count; i = i + 1) {
+      drawBall(beatsin(bpm + i * 7, t, width - radius * 2 - 1),
+               beatsin(bpm + i * 5 + 3, t, height - radius * 2 - 1),
+               radius, i * 64);
     }
   }
 }
diff --git a/moonlive/effects/crosshair.mle b/moonlive/effects/crosshair.mle
index ad220277..77d2e0a5 100644
--- a/moonlive/effects/crosshair.mle
+++ b/moonlive/effects/crosshair.mle
@@ -4,9 +4,6 @@ class CrosshairEffect {
   byte bpm = 30;
   byte spread = 3;
 
-  int cx = 0; // where the sight sits, across
-  int cy = 0; // where the sight sits, down
-
   int dimensions() { return 2; }
 
   string tags() { return "💫"; }
@@ -16,15 +13,18 @@ class CrosshairEffect {
     addControl("spread", spread, 0, 20); // how thick the lines are
   }
 
-  void column() {
+  // The vertical line of the sight.
+  void column(int cx) {
     for (int y = 0; y < height; y = y + 1) { setRGB(y * width + cx, 200, 30, 0); }
   }
 
-  void row() {
+  // The horizontal one.
+  void row(int cy) {
     for (int x = 0; x < width; x = x + 1) { setRGB(cy * width + x, 0, 90, 200); }
   }
 
-  void center() {
+  // The bright cross where the two lines meet, `spread` lights along each arm.
+  void center(int cx, int cy) {
     for (int i = 0; i < spread + spread + 1; i = i + 1) {
       int d = i - spread;
       if (cx + d >= 0) { if (cx + d < width) { setRGB(cy * width + cx + d, 255, 255, 255); } }
@@ -34,10 +34,10 @@ class CrosshairEffect {
 
   void tick() {
     fill(0, 0, 0);
-    cx = scale(beat(bpm, t), width);
-    cy = scale(beat(bpm + 7, t), height);
-    column();
-    row();
-    center();
+    int cx = scale(beat(bpm, t), width);
+    int cy = scale(beat(bpm + 7, t), height);
+    column(cx);
+    row(cy);
+    center(cx, cy);
   }
 }
diff --git a/moonlive/effects/aim.mle b/moonlive/effects/mh-aim.mle
similarity index 100%
rename from moonlive/effects/aim.mle
rename to moonlive/effects/mh-aim.mle
diff --git a/moonlive/effects/mh-ambient.mle b/moonlive/effects/mh-ambient.mle
new file mode 100644
index 00000000..5a8deb86
--- /dev/null
+++ b/moonlive/effects/mh-ambient.mle
@@ -0,0 +1,34 @@
+// Ambient: heads that drift, and lift toward the ceiling as the room gets louder.
+
+class AmbientEffect {
+  byte panBpm = 5;
+  byte panMin = 45;
+  byte panMax = 135;
+  byte tiltMin = 128;
+  byte tiltMax = 255;
+
+  int dimensions() { return 1; }
+
+  string tags() { return "🗼🎶🎯"; }
+
+  void defineControls() {
+    addControl("panBpm", panBpm, 1, 60); // how fast the slow drift travels
+    addControl("panMin", panMin, 0, 255); // one end of the drift
+    addControl("panMax", panMax, 0, 255); // the other end
+    addControl("tiltMin", tiltMin, 0, 255); // where the heads rest when the room is quiet
+    addControl("tiltMax", tiltMax, 0, 255); // how high they lift when it is loud
+  }
+
+  void tick() {
+    int loud = audioLevel();
+    for (int i = 0; i < height; i = i + 1) {
+      // Each head takes its own band, so the rig ripples rather than lifting as one block.
+      int band = audioBand(div(i * 16, height));
+      int spread = div(i * 255, height);
+      int swing = beatsin(panBpm, t + spread, 255);
+      setPan(i, panMin + div(swing * (panMax - panMin), 255));
+      setTilt(i, tiltMin + div(band * (tiltMax - tiltMin), 255));
+      setRGB(i, div(loud * 255, 256), div(band * 128, 256), 64);
+    }
+  }
+}
diff --git a/moonlive/effects/mh-sweep.mle b/moonlive/effects/mh-sweep.mle
new file mode 100644
index 00000000..25419829
--- /dev/null
+++ b/moonlive/effects/mh-sweep.mle
@@ -0,0 +1,47 @@
+// Sweep: the moving-head formations, in script form. MOTION ONLY, no color.
+
+class SweepEffect {
+  byte formation = 0;
+  byte panBpm = 6;
+  byte tiltBpm = 9;
+  byte panRange = 128;
+  byte tiltRange = 96;
+
+  int dimensions() { return 1; }
+
+  string tags() { return "💫🎯"; }
+
+  void defineControls() {
+    addControl("formation", formation, 0, 4); // 0 fan, 1 mirror, 2 chase, 3 cross, 4 unison
+    addControl("panBpm", panBpm, 1, 120); // how fast the heads swing sideways
+    addControl("tiltBpm", tiltBpm, 1, 120); // how fast they swing up and down
+    addControl("panRange", panRange, 0, 255); // how far the sideways swing travels
+    addControl("tiltRange", tiltRange, 0, 255); // how far the vertical swing travels
+  }
+
+  // Aim one head. `spread` delays its sweep, `dir` reverses it: every formation is a choice of
+  // those two per head, which is why they are the only thing the branches below decide.
+  void head(int i, int spread, int dir) {
+    setPan(i, 128 + div((beatsin(panBpm, t + spread, 255) - 128) * dir * panRange, 256));
+    setTilt(i, 128 + div((beatsin(tiltBpm, t + spread, 255) - 128) * tiltRange, 256));
+  }
+
+  void tick() {
+    for (int i = 0; i < height; i = i + 1) {
+      // One line per formation, each saying what it IS rather than which variables it sets.
+      if (formation == 0) { head(i, div(i * 128, height), 1); }        // fan: a widening delay
+      else if (formation == 1) {
+        int half = 1;                                                  // mirror: the halves oppose
+        if (i >= div(height, 2)) { half = 0 - 1; }
+        head(i, 0, half);
+      }
+      else if (formation == 2) { head(i, div(i * 255, height), 1); }   // chase: a travelling wave
+      else if (formation == 3) {
+        int alt = 1;                                                   // cross: neighbours oppose
+        if (mod(i, 2) == 1) { alt = 0 - 1; }
+        head(i, 0, alt);
+      }
+      else { head(i, 0, 1); }                                          // unison: all as one
+    }
+  }
+}
diff --git a/moonlive/effects/mh-troy.mle b/moonlive/effects/mh-troy.mle
new file mode 100644
index 00000000..aa05645a
--- /dev/null
+++ b/moonlive/effects/mh-troy.mle
@@ -0,0 +1,40 @@
+// Troy: a tight sweep on the beat, with the gobo wheel rolling on the bass.
+
+class TroyEffect {
+  byte bpm = 30;
+  byte pan = 175;
+  byte tilt = 90;
+  byte range = 20;
+  byte gobo = 0;
+  byte cutin = 200;
+
+  int dimensions() { return 1; }
+
+  string tags() { return "🗼🎶🎯"; }
+
+  void defineControls() {
+    addControl("bpm", bpm, 1, 120); // how fast the heads swing
+    addControl("pan", pan, 0, 255); // where the sideways swing is centered
+    addControl("tilt", tilt, 0, 255); // where the vertical swing is centered
+    addControl("range", range, 0, 127); // how far either swing travels
+    addControl("gobo", gobo, 0, 255); // the pattern the wheel holds between rolls
+    addControl("cutin", cutin, 0, 255); // how loud the bass has to be to open the beam
+  }
+
+  void tick() {
+    int bass = audioBand(0);
+    for (int i = 0; i < height; i = i + 1) {
+      int p = beatsin(bpm, t, 255);
+      int q = beatsin(bpm, t, 255);
+      if (mod(i, 2) == 0) {
+        p = 255 - p;
+        q = 255 - q;
+      }
+      setPan(i, pan - range + div((p * range * 2), 255));
+      setTilt(i, tilt - range + div((q * range * 2), 255));
+      setGobo(i, gobo);
+      if (bass > cutin) { setZoom(i, 255); } else { setZoom(i, 0); }
+      setRGB(i, audioBand(15), audioBand(7), bass);
+    }
+  }
+}
diff --git a/moonlive/effects/mh-wowi.mle b/moonlive/effects/mh-wowi.mle
new file mode 100644
index 00000000..a0ca6e4d
--- /dev/null
+++ b/moonlive/effects/mh-wowi.mle
@@ -0,0 +1,31 @@
+// Wowi: a wide slow sweep with alternate heads mirrored, and no audio at all.
+
+class WowiEffect {
+  byte bpm = 30;
+  byte pan = 175;
+  byte tilt = 90;
+  byte range = 20;
+  byte zoom = 20;
+
+  int dimensions() { return 1; }
+
+  string tags() { return "🗼🎯"; }
+
+  void defineControls() {
+    addControl("bpm", bpm, 1, 120); // how fast the heads swing
+    addControl("pan", pan, 0, 255); // where the sideways swing is centered
+    addControl("tilt", tilt, 0, 255); // where the vertical swing is centered
+    addControl("range", range, 0, 127); // how far either swing travels
+    addControl("zoom", zoom, 0, 255); // how tight the beam is
+  }
+
+  void tick() {
+    for (int i = 0; i < height; i = i + 1) {
+      int phase = t;
+      if (mod(i, 2) == 0) { phase = t + 32768; }
+      setPan(i, pan - range + div(beatsin(bpm, phase, 255) * range * 2, 255));
+      setTilt(i, tilt - range + div(beatsin(bpm, phase, 255) * range * 2, 255));
+      setZoom(i, zoom);
+    }
+  }
+}
diff --git a/moonlive/effects/ripples.mle b/moonlive/effects/ripples.mle
index a10b091e..9ba3eee3 100644
--- a/moonlive/effects/ripples.mle
+++ b/moonlive/effects/ripples.mle
@@ -13,17 +13,24 @@ class RipplesEffect {
     addControl("rings", rings, 1, 32); // how tightly the rings pack
   }
 
+  // One source's rings at (x, y): the distance to a source that is itself gliding, turned into a
+  // wave. Naming it also computes each source position ONCE, where the inline form evaluated every
+  // beatsin twice for the same pixel.
+  int wave(int x, int y, int bpmX, int bpmY) {
+    int dx = x - beatsin(bpmX, t, width - 1);
+    int dy = y - beatsin(bpmY, t, height - 1);
+    return scale(sin((dx * dx + dy * dy) * rings * 64), 256);
+  }
+
   void tick() {
     for (int y = 0; y < height; y = y + 1) {
       for (int x = 0; x < width; x = x + 1) {
+        // Two sources on different rates, plus a diagonal sweep: where their rings cross is the
+        // interference the effect is named for.
         setRGB(y * width + x,
-          scale(sin(((x - beatsin(bpm, t, width - 1)) * (x - beatsin(bpm, t, width - 1))
-                   + (y - beatsin(bpm + 4, t, height - 1)) * (y - beatsin(bpm + 4, t, height - 1)))
-                  * rings * 64), 256),
-          scale(sin(((x - beatsin(bpm + 7, t, width - 1)) * (x - beatsin(bpm + 7, t, width - 1))
-                   + (y - beatsin(bpm + 3, t, height - 1)) * (y - beatsin(bpm + 3, t, height - 1)))
-                  * rings * 64), 256),
-          scale(sin((x + y) * rings * 32 + beat(bpm, t)), 256));
+               wave(x, y, bpm, bpm + 4),
+               wave(x, y, bpm + 7, bpm + 3),
+               scale(sin((x + y) * rings * 32 + beat(bpm, t)), 256));
       }
     }
   }
diff --git a/moonlive/effects/stadbeest-eyes.mle b/moonlive/effects/stadbeest-eyes.mle
new file mode 100644
index 00000000..1d19ca10
--- /dev/null
+++ b/moonlive/effects/stadbeest-eyes.mle
@@ -0,0 +1,53 @@
+// StadBeestEyes: a frog's eye. Golden iris, black slit pupil, and it looks around.
+
+class StadBeestEyesEffect {
+  byte hue = 30;
+  byte pupil = 70;
+  byte wander = 40;
+  byte bpm = 7;
+  byte audioReactive = 0;
+
+  int dimensions() { return 2; }
+
+  string tags() { return "💫🎶"; }
+
+  void defineControls() {
+    addControl("hue", hue, 0, 255); // iris color: 30 is amber, 60 green, 180 blue
+    addControl("pupil", pupil, 10, 200); // how wide the slit opens
+    addControl("wander", wander, 0, 100); // how far the eye looks around
+    addControl("bpm", bpm, 1, 60); // how restless the gaze is
+    addControl("audioReactive", audioReactive, 0, 1); // the pupil dilates on sound
+  }
+
+  void tick() {
+    int gazeX = div((beatsin(bpm, t, 255) - 128) * wander, 400);
+    int gazeY = div((beatsin(bpm + 3, t, 255) - 128) * wander, 400);
+
+    int open = pupil;
+    if (audioReactive == 1) { open = pupil + div(audioLevel() * 90, 256); }
+
+    int cx = div(width, 2) + gazeX;
+    int cy = div(height, 2) + gazeY;
+
+    for (int y = 0; y < height; y = y + 1) {
+      for (int x = 0; x < width; x = x + 1) {
+        int dx = x - cx;
+        int dy = y - cy;
+        int r = polarR(dx, dy);
+
+        int slit = polarR(dx, dy * 5);
+
+        if (slit < div(open, 16)) {
+          setRGB(y * width + x, 0, 0, 0);           // the pupil: genuinely black
+        } else {
+          int a = polarA(dx, dy);
+          int fibre = div(sin(a * 12) + 32768, 512);
+          int bright = 255 - div(r * 9, 16) + div(fibre, 3);
+          if (bright < 30) { bright = 30; }
+          if (bright > 255) { bright = 255; }
+          setPaletteColor(x, y, hue + div(r, 3), bright);
+        }
+      }
+    }
+  }
+}
diff --git a/moonlive/effects/stadbeest-legs.mle b/moonlive/effects/stadbeest-legs.mle
new file mode 100644
index 00000000..3347888c
--- /dev/null
+++ b/moonlive/effects/stadbeest-legs.mle
@@ -0,0 +1,50 @@
+// StadBeestLegs: a crawl travelling down ten legs, each offset so the rig reads as walking.
+
+class StadBeestLegsEffect {
+  byte hue = 100;
+  byte bpm = 12;
+  byte spread = 60;
+  byte tail = 40;
+  byte audioReactive = 0;
+
+  int dimensions() { return 2; }
+
+  string tags() { return "💫🎶"; }
+
+  void defineControls() {
+    addControl("hue", hue, 0, 255); // base color: 100 is a sickly green, 200 violet
+    addControl("bpm", bpm, 1, 60); // how fast the pulses travel down a leg
+    addControl("spread", spread, 0, 255); // how far apart the legs are in the gait
+    addControl("tail", tail, 5, 120); // how long a pulse's trail is
+    addControl("audioReactive", audioReactive, 0, 1); // each leg takes its own frequency band
+  }
+
+  void tick() {
+    for (int leg = 0; leg < width; leg = leg + 1) {
+      int phase = div(leg * spread, 4);
+
+      int drive = 255;
+      if (audioReactive == 1) {
+        drive = audioBand(div(leg * 16, width)) + 40;
+        if (drive > 255) { drive = 255; }
+      }
+
+      int head = div(beat(bpm, t + phase) * height, 65536);
+      int shimmer = div(noise(leg * 900, 0, t), 6);
+
+      for (int y = 0; y < height; y = y + 1) {
+        int behind = y - head;
+        if (behind < 0) { behind = behind + height; }
+
+        int bright = 0;
+        if (behind < tail) { bright = 255 - div(behind * 255, tail); }
+
+        bright = bright + shimmer - div(y * 12, height);
+        if (bright > 255) { bright = 255; }
+        bright = div(bright * drive, 256);
+
+        setPaletteColor(leg, y, hue + div(y * 40, height), bright);
+      }
+    }
+  }
+}
diff --git a/moonlive/effects/sweep.mle b/moonlive/effects/sweep.mle
deleted file mode 100644
index 22b29c6a..00000000
--- a/moonlive/effects/sweep.mle
+++ /dev/null
@@ -1,43 +0,0 @@
-// Sweep: the moving-head formations, in script form. MOTION ONLY, no color.
-
-class SweepEffect {
-  byte formation = 0;
-  byte panBpm = 6;
-  byte tiltBpm = 9;
-  byte panRange = 128;
-  byte tiltRange = 96;
-
-  int dimensions() { return 1; }
-
-  string tags() { return "💫🎯"; }
-
-  void defineControls() {
-    addControl("formation", formation, 0, 4); // 0 fan, 1 mirror, 2 chase, 3 cross, 4 unison
-    addControl("panBpm", panBpm, 1, 120); // how fast the heads swing sideways
-    addControl("tiltBpm", tiltBpm, 1, 120); // how fast they swing up and down
-    addControl("panRange", panRange, 0, 255); // how far the sideways swing travels
-    addControl("tiltRange", tiltRange, 0, 255); // how far the vertical swing travels
-  }
-
-  void tick() {
-    for (int i = 0; i < height; i = i + 1) {
-      int spread = 0;
-      int dir = 1;
-      if (formation == 1) {
-        if (i < div(height, 2)) { dir = 1; } else { dir = 0 - 1; }
-      }
-      if (formation == 2) {
-        spread = div(i * 255, height);
-      }
-      if (formation == 3) {
-        if (mod(i, 2) == 1) { dir = 0 - 1; }
-      }
-      if (formation == 0) {
-        spread = div(i * 128, height);
-      }
-
-      setPan(i, 128 + div((beatsin(panBpm, t + spread, 255) - 128) * dir * panRange, 256));
-      setTilt(i, 128 + div((beatsin(tiltBpm, t + spread, 255) - 128) * tiltRange, 256));
-    }
-  }
-}
diff --git a/moonlive/layouts/lightcrafter16.mll b/moonlive/layouts/lightcrafter16.mll
new file mode 100644
index 00000000..da4beafe
--- /dev/null
+++ b/moonlive/layouts/lightcrafter16.mll
@@ -0,0 +1,36 @@
+// LightCrafter16: eight columns down, then the same eight back up, one continuous run.
+
+class LightCrafter16Layout {
+  int ledsPerPin = 10;
+  byte pinsAreColumns = 0;
+
+  int dimensions() { return 2; }
+
+  string tags() { return "🚥"; }
+
+  void defineControls() {
+    addControl("ledsPerPin", ledsPerPin, 1, 2047); // lights on each of the sixteen strips
+    addControl("pinsAreColumns", pinsAreColumns, 0, 1); // swap which axis the strips run along
+  }
+
+  // One strip along `column`, running from `from` toward `to`.
+  void strip(int column, int from, int to) {
+    int dir = 1;
+    if (from > to) { dir = 0 - 1; }
+    int y = from;
+    for (int n = 0; n < ledsPerPin; n = n + 1) {
+      if (pinsAreColumns == 1) { addLight(column, y, 0); } else { addLight(y, column, 0); }
+      y = y + dir;
+    }
+  }
+
+  void placeLights() {
+    // Out along columns 0..7 with each strip running backwards, then home along 7..0 running
+    // forwards: the boustrophedon a single cable makes when it has to end where it started.
+    for (int c = 0; c < 8; c = c + 1) { strip(c, ledsPerPin - 1, 0); }
+    for (int n = 0; n < 8; n = n + 1) {
+      int c = 7 - n;
+      strip(c, ledsPerPin, ledsPerPin * 2 - 1);
+    }
+  }
+}
diff --git a/moonlive/layouts/se16.mll b/moonlive/layouts/se16.mll
new file mode 100644
index 00000000..965bd8a3
--- /dev/null
+++ b/moonlive/layouts/se16.mll
@@ -0,0 +1,47 @@
+// SE16: sixteen strips in a grid, wired in the pair order that board's connectors use.
+
+class Se16Layout {
+  int ledsPerPin = 10;
+  byte mirrored = 0;
+  byte pinsAreColumns = 0;
+
+  int dimensions() { return 2; }
+
+  string tags() { return "🚥"; }
+
+  void defineControls() {
+    addControl("ledsPerPin", ledsPerPin, 1, 2047); // lights on each of the sixteen strips
+    addControl("mirrored", mirrored, 0, 1); // 8 columns of two strips running opposite ways
+    addControl("pinsAreColumns", pinsAreColumns, 0, 1); // swap which axis the strips run along
+  }
+
+  // One strip along `column`, running from `from` toward `to`. A return leg is the same call with
+  // its ends swapped, which is what the wiring does at the far end of a column.
+  void strip(int column, int from, int to) {
+    int dir = 1;
+    if (from > to) { dir = 0 - 1; }
+    int y = from;
+    for (int n = 0; n < ledsPerPin; n = n + 1) {
+      if (pinsAreColumns == 1) { addLight(column, y, 0); } else { addLight(y, column, 0); }
+      y = y + dir;
+    }
+  }
+
+  void placeLights() {
+    if (mirrored == 1) {
+      // Eight columns, each carrying an outward and a return strip: the far end folds back.
+      for (int n = 0; n < 8; n = n + 1) {
+        int c = 7 - n;
+        strip(c, ledsPerPin, ledsPerPin * 2 - 1);
+        strip(c, ledsPerPin - 1, 0);
+      }
+    } else {
+      // Sixteen columns taken in swapped pairs, which is the order the connectors sit in.
+      for (int n = 0; n < 8; n = n + 1) {
+        int p = 7 - n;
+        strip(p * 2, 0, ledsPerPin - 1);
+        strip(p * 2 + 1, 0, ledsPerPin - 1);
+      }
+    }
+  }
+}
diff --git a/moonlive/layouts/sixteen-rings.mll b/moonlive/layouts/sixteen-rings.mll
new file mode 100644
index 00000000..69c5bc93
--- /dev/null
+++ b/moonlive/layouts/sixteen-rings.mll
@@ -0,0 +1,46 @@
+// Sixteen rings scattered across a wall, each a circle of lights at its own spot.
+
+class SixteenRingsLayout {
+  byte ringLights = 24;
+  byte radius = 5;
+  byte spread = 1;
+
+  int dimensions() { return 2; }
+
+  string tags() { return "🚥"; }
+
+  void defineControls() {
+    addControl("ringLights", ringLights, 3, 255); // lights around each ring
+    addControl("radius", radius, 1, 60); // how wide a ring is
+    addControl("spread", spread, 1, 10); // spreads the whole arrangement out
+  }
+
+  // One ring at a spot on the wall.
+  void ring(int cx, int cy) {
+    for (int i = 0; i < ringLights; i = i + 1) {
+      addLight(cx * spread + scale(cos(i * turn(ringLights)), radius * 2 + 1),
+               cy * spread + scale(sin(i * turn(ringLights)), radius * 2 + 1), 0);
+    }
+  }
+
+  void placeLights() {
+    // The centers are hand-placed rather than laid out on a grid: this is one physical
+    // installation, and these are where its rings actually hang.
+    ring(59, 23);
+    ring(70, 28);
+    ring(59, 10);
+    ring(59, 34);
+    ring(47, 17);
+    ring(59, 46);
+    ring(41, 5);
+    ring(47, 39);
+    ring(35, 17);
+    ring(41, 53);
+    ring(22, 10);
+    ring(35, 39);
+    ring(22, 23);
+    ring(22, 46);
+    ring(10, 28);
+    ring(22, 34);
+  }
+}
diff --git a/moonlive/palettes/beat-flash.mlp b/moonlive/palettes/beat-flash.mlp
index 2a13128e..169bdd57 100644
--- a/moonlive/palettes/beat-flash.mlp
+++ b/moonlive/palettes/beat-flash.mlp
@@ -1,5 +1,4 @@
-// Beat flash: the palette sits in a deep color and jumps to white on every drum hit, so any effect
-// using it pulses with the room. Decays between beats rather than snapping back.
+// Beat flash: a deep color that jumps to white on every drum hit, then decays back.
 
 class BeatFlash {
   byte hue = 160;
diff --git a/moonlive/palettes/spectrum.mlp b/moonlive/palettes/spectrum.mlp
index 7f00d0c1..71a221cf 100644
--- a/moonlive/palettes/spectrum.mlp
+++ b/moonlive/palettes/spectrum.mlp
@@ -1,5 +1,4 @@
-// Spectrum: the palette IS the room. Each entry takes its brightness from one frequency band, so
-// every effect using this palette reacts to the music without knowing anything about audio.
+// Spectrum: each entry takes its brightness from one frequency band, so the palette IS the room.
 
 class Spectrum {
   byte gain = 100;
diff --git a/moonlive/palettes/temperature.mlp b/moonlive/palettes/temperature.mlp
index d8bd9ebc..2959be3b 100644
--- a/moonlive/palettes/temperature.mlp
+++ b/moonlive/palettes/temperature.mlp
@@ -1,5 +1,4 @@
-// Temperature: a physical color ramp from deep blue through white to amber, the way a heated
-// object actually changes color. Slide `kelvin` to move the whole palette along that curve.
+// Temperature: the color a heated object glows, from deep blue through white to amber.
 
 class Temperature {
   byte kelvin = 128;
diff --git a/moonlive/services/button.mls b/moonlive/services/button.mls
index c1746e2e..eec38ecc 100644
--- a/moonlive/services/button.mls
+++ b/moonlive/services/button.mls
@@ -1,9 +1,11 @@
+// Button: a wired push button, driving the switch1 control.
+
 class Button {
   int pin = 0;
   int last = 1;
 
   void defineControls() {
-    addControl("pin", pin, 0, 48);
+    addControl("pin", pin, 0, 48); // which GPIO the button is wired to
   }
 
   void tick20ms() {
diff --git a/moonlive/services/power.mls b/moonlive/services/power.mls
index 98eed595..4ebfc8b4 100644
--- a/moonlive/services/power.mls
+++ b/moonlive/services/power.mls
@@ -1,3 +1,5 @@
+// Power: reads supply voltage and current from two analog pins, into readouts.
+
 class Power {
   int pinV = 5;
   int pinI = 6;
diff --git a/moonlive/services/sweep.mls b/moonlive/services/sweep.mls
index b101543a..3c2892b0 100644
--- a/moonlive/services/sweep.mls
+++ b/moonlive/services/sweep.mls
@@ -1,8 +1,10 @@
+// Sweep: drives four faders on a slow triangle, two of them inverted.
+
 class Sweep {
   int bpm = 8;
 
   void defineControls() {
-    addControl("bpm", bpm, 1, 60);
+    addControl("bpm", bpm, 1, 60); // how fast the sweep travels
   }
 
   void tick20ms() {
diff --git a/src/core/AudioFrame.h b/src/core/AudioFrame.h
index b268fa90..3faa4ca9 100644
--- a/src/core/AudioFrame.h
+++ b/src/core/AudioFrame.h
@@ -5,7 +5,7 @@
 namespace mm {
 
 // One snapshot of analysed audio, produced by AudioService (src/core/AudioService.h)
-// once per render tick and consumed by audio-reactive effects (AudioVolumeEffect,
+// once per render tick and consumed by audio-reactive effects (
 // AudioSpectrumEffect). The producer/consumer-via-plain-struct model the codebase
 // already uses (PreviewDriver writes pixels HttpServer reads); the struct is the
 // whole contract between the two, so effects never touch I2S or the FFT.
diff --git a/src/core/AudioService.h b/src/core/AudioService.h
index 7782861c..df957e1c 100644
--- a/src/core/AudioService.h
+++ b/src/core/AudioService.h
@@ -23,7 +23,7 @@ namespace mm {
 /// are *recomputed* only when a full sample block has accumulated (a 512-sample
 /// block at 22 kHz takes ~23 ms, longer than one tick), so a tick that doesn't
 /// complete a block re-publishes the previous `AudioFrame` unchanged rather than
-/// re-analysing. `AudioVolumeEffect` and `AudioSpectrumEffect` are the consumers,
+/// re-analyzing. `AudioSpectrumEffect` and the other audio effects are the consumers,
 /// reaching the live frame through the static `latestFrame()`.
 ///
 /// **Named for what it does**: audio acquisition plus analysis, not for one
diff --git a/src/core/FirmwareImage.h b/src/core/FirmwareImage.h
new file mode 100644
index 00000000..83416df0
--- /dev/null
+++ b/src/core/FirmwareImage.h
@@ -0,0 +1,96 @@
+#pragma once
+
+// Reading an ESP32 firmware image's header, without ESP-IDF.
+//
+// The layout is a fixed on-disk format the bootloader parses, so it is the same bytes whether
+// they arrive on a device or in a test: magic, chip id, then the app descriptor carrying the
+// project name and version. Defining it here rather than including esp_app_format.h is what
+// lets the vetting run in a host test, which matters because the code it guards ERASES a
+// device's only recovery image. The layout is pinned by unit_FirmwareImage against real
+// binaries built by the ESP32 toolchain.
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+namespace mm::firmware {
+
+/// First byte of every ESP32 image.
+constexpr uint8_t kImageMagic = 0xE9;
+/// Marks the app descriptor that follows the image and first segment headers.
+constexpr uint32_t kDescMagic = 0xABCD5432;
+/// Offset of the app descriptor: a 24-byte image header plus an 8-byte segment header.
+constexpr size_t kDescOffset = 32;
+/// Offset of the chip id within the image header.
+constexpr size_t kChipIdOffset = 12;
+/// Enough bytes to identify an image: through the descriptor's version and project name.
+constexpr size_t kIdentifyBytes = kDescOffset + 96;
+
+/// Chip ids, as the image header encodes them (esp_chip_id_t).
+/// Every id esp_chip_id_t defines, not only the ones that ship MoonBase today: a missing entry
+/// makes a valid image land on Invalid, so it is still refused but described as "for another
+/// chip" when the truth is "for a chip this table does not name". S31 is already built here.
+enum class ChipId : uint16_t {
+    Esp32    = 0x0000,
+    Esp32S2  = 0x0002,
+    Esp32C3  = 0x0005,
+    Esp32S3  = 0x0009,
+    Esp32C2  = 0x000C,
+    Esp32C6  = 0x000D,
+    Esp32H2  = 0x0010,
+    Esp32P4  = 0x0012,
+    Esp32C5  = 0x0017,
+    Esp32H4  = 0x001C,
+    Esp32S31 = 0x0020,
+    Invalid  = 0xFFFF,
+};
+
+/// What an image says about itself. Empty strings when the descriptor is absent or unreadable.
+struct ImageInfo {
+    bool   valid       = false;   ///< begins with the image magic
+    bool   described   = false;   ///< carries a readable app descriptor
+    ChipId chip        = ChipId::Invalid;
+    char   project[32] = {};      ///< "projectMM" or "projectMM-moonbase"
+    char   version[32] = {};
+};
+
+/// Read what `buf` claims to be. Reads only the first kIdentifyBytes and never past `len`, so a
+/// truncated or hostile stream reports what it can rather than reading past its own buffer.
+inline ImageInfo identify(const uint8_t* buf, size_t len) {
+    ImageInfo out;
+    if (!buf || len == 0) return out;
+    if (buf[0] != kImageMagic) return out;
+    out.valid = true;
+    if (len >= kChipIdOffset + 2) {
+        uint16_t id = 0;
+        std::memcpy(&id, buf + kChipIdOffset, 2);
+        out.chip = static_cast<ChipId>(id);
+    }
+    if (len < kDescOffset + 96) return out;
+    uint32_t magic = 0;
+    std::memcpy(&magic, buf + kDescOffset, 4);
+    if (magic != kDescMagic) return out;
+    out.described = true;
+    // The descriptor's version is at +16 and its project name at +48, each a fixed 32-byte field
+    // that IDF may leave unterminated when the string exactly fills it.
+    std::memcpy(out.version, buf + kDescOffset + 16, 31);
+    std::memcpy(out.project, buf + kDescOffset + 48, 31);
+    return out;
+}
+
+/// Is this a MoonBase image for `chip`? Returns the reason it is not, for a caller that has to
+/// tell a person which file they should have picked.
+///
+/// The three ways to be wrong, in the order they are cheapest to detect:
+///   not an image      a 404 body, an HTML error page, a .zip
+///   the wrong chip    one MoonBase per chip, one paste apart, and a checksum will NOT catch it
+///   not MoonBase      an app image, which sits beside it on the releases page
+inline const char* moonBaseRejection(const ImageInfo& info, ChipId chip) {
+    if (!info.valid)     return "not a firmware image";
+    if (info.chip != chip) return "image is for another chip";
+    if (!info.described) return "image carries no description";
+    if (std::strcmp(info.project, "projectMM-moonbase") != 0) return "not a MoonBase image";
+    return nullptr;
+}
+
+} // namespace mm::firmware
diff --git a/src/core/FirmwareUpdateModule.h b/src/core/FirmwareUpdateModule.h
index e54cbe1d..c1e988ef 100644
--- a/src/core/FirmwareUpdateModule.h
+++ b/src/core/FirmwareUpdateModule.h
@@ -35,8 +35,20 @@ inline uint32_t g_otaBytesTotal     = 0;
 inline bool otaInFlight() {
     return std::strcmp(g_otaStatus, "starting")    == 0 ||
            std::strcmp(g_otaStatus, "downloading") == 0 ||
-           std::strcmp(g_otaStatus, "flashing")    == 0 ||
-           std::strcmp(g_otaStatus, "rebooting")   == 0;
+           // A PREFIX: this one carries its byte counts ("flashing: N of M bytes") so the UI can
+           // draw a bar from the status alone, the same shape the MoonBase write reports in.
+           std::strncmp(g_otaStatus, "flashing", 8) == 0 ||
+           std::strcmp(g_otaStatus, "rebooting")   == 0 ||
+           // A MoonBase install passes through its own states, and they matter MORE than the
+           // app's: this window is the one where the device has no recovery image, so a second
+           // install starting into a half-written factory partition is the worst case there is.
+           std::strcmp(g_otaStatus, "checking")    == 0 ||
+           std::strcmp(g_otaStatus, "erasing")     == 0 ||
+           // A PREFIX, because this one carries its byte counts ("writing MoonBase: N of M
+           // bytes") so the UI can draw a bar from the status alone. An exact compare here
+           // silently stopped matching the moment those numbers were added, which would have
+           // let a second install start into a half-written factory partition.
+           std::strncmp(g_otaStatus, "writing MoonBase", 16) == 0;
 }
 
 /// A thin status surface for OTA flashing — surfaces flash progress as live
@@ -61,11 +73,15 @@ inline bool otaInFlight() {
 /// build-time variant key (`esp32`, `esp32-eth`, `esp32s3-n16r8`, … / `desktop-*`) that
 /// identifies which release asset matches the device (a legacy `esp32-eth-wifi` key
 /// OTA-maps to `esp32`); the physical hardware is SystemModule's `deviceModel`.
-/// `firmwarePartition` — running app image size / app-partition size (named distinctly
-/// from `firmware` so a `find(name === "firmware")` caller resolves the string).
-/// `update_pct` — live byte counters rendered "X KB / Y KB" (`total` is 0 until
-/// `esp_https_ota_get_image_size` reports it just after the TLS handshake; the name is
-/// historical, the wire shape is bytes).
+/// `partition`: the selected image's size against the slot that holds it. During an install it
+/// shows the INCOMING image filling that same slot, which is the same quantity measured live.
+/// `image` selects WHICH of a device's two images the four controls above describe: the running
+/// app, or MoonBase in the factory slot (read from its app descriptor). Present only where there
+/// are two, and hidden, because the card draws it as a tab strip rather than as a setting.
+///
+/// **Progress is not a control.** The byte counters below drive the overlay the UI raises while
+/// an install runs; a card row would sit at zero for the whole life of a device that is not
+/// mid-install.
 ///
 /// **Flash phase is not a control** — it surfaces through the module's shared status slot
 /// (`setStatus()`): `idle` clears the banner, an `error:` prefix maps to `Severity::Error`,
@@ -77,7 +93,7 @@ inline bool otaInFlight() {
 /// `starting` and spawns the platform OTA task, which walks: `downloading` → `esp_https_ota_begin`
 /// opens the TLS connection and follows redirects (a GitHub release URL 302s to
 /// `release-assets.githubusercontent.com`) → `flashing`, `esp_https_ota_perform` advancing
-/// `update_pct` 0→100 → `esp_https_ota_finish` commits the image to the next OTA partition and flips
+/// the byte counters → `esp_https_ota_finish` commits the image to the next OTA partition and flips
 /// the boot pointer → `rebooting`, a ~600 ms delay so the HTTP response reaches the browser first,
 /// then `esp_restart()`. The device boots the new image and the UI re-reads `version` / `firmware`.
 ///
@@ -117,7 +133,6 @@ class FirmwareUpdateModule : public MoonModule {
         // first WS state push surfaces a coherent "idle" / 0 pair.
         std::snprintf(statusStr_, sizeof(statusStr_), "%s", g_otaStatus);   // always NUL-terminates
         publishStatus();
-        bytesRead_ = g_otaBytesRead;
         totalSnap_ = g_otaBytesTotal;
 
         // Firmware identity (static for this build). version is PURE SEMVER (kVersion from
@@ -135,23 +150,74 @@ class FirmwareUpdateModule : public MoonModule {
         // while the firmware moves on (a stale date reads as a failed flash; see build_info.h).
         std::snprintf(buildStr_, sizeof(buildStr_), "%s · %s", kBuildId, kBuildDate);
         std::snprintf(firmwareStr_, sizeof(firmwareStr_), "%s", kFirmwareName);
+        readMoonBaseVersion();
     }
 
-    void defineControls() override {
-        // Firmware identity (static), then OTA progress. firmwarePartition is the running app
-        // partition's usage; queried here (idempotent, no I/O) so the gate sees a real total.
-        controls_.addReadOnly("version", versionStr_, sizeof(versionStr_));
-        controls_.addReadOnly("build", buildStr_, sizeof(buildStr_));
-        controls_.addReadOnly("firmware", firmwareStr_, sizeof(firmwareStr_));
-        firmwareSizeVal_ = static_cast<uint32_t>(platform::firmwareSize());
-        totalFlashVal_ = static_cast<uint32_t>(platform::firmwarePartition());
-        if (totalFlashVal_ > 0) {
-            controls_.addProgress("firmwarePartition", firmwareSizeVal_, totalFlashVal_);
+    /// WHICH MOONBASE this device carries, read from the factory partition rather than assumed.
+    /// MoonBase is the one image nothing else updates, so it drifts: a bench board that could not
+    /// install firmware was running a MoonBase built long before its app, and nothing on the
+    /// device said so. Both strings come from the same computed version, so a mismatch means the
+    /// two images were built apart, which is exactly what to surface.
+    ///
+    /// Re-read after installing a new one, not only at setup: rebuildControls() re-runs
+    /// defineControls(), which re-binds this buffer but never refills it, so a card refreshed
+    /// without this kept showing the version of the image that was just replaced.
+    void readMoonBaseVersion() {
+        char installed[32] = {};
+        if (platform::otaMoonBaseVersion(installed, sizeof(installed))) {
+            const bool matches = std::strcmp(installed, kVersion) == 0;
+            std::snprintf(moonbaseStr_, sizeof(moonbaseStr_), "%s%s",
+                          installed, matches ? "" : " (outdated)");
         }
-        // Present only on tables that carry a MoonBase factory image: its presence tells the UI to
-        // install through the reboot-into-MoonBase flow rather than in place (app.js reads it).
+        // The rest of its identity, so the UI can describe MoonBase with the same four fields it
+        // describes the app with: one row builder serves whichever image the user selected.
+        platform::otaMoonBaseBuild(moonbaseBuildStr_, sizeof(moonbaseBuildStr_));
+    }
+
+    void defineControls() override {
+        // Firmware identity for the SELECTED image, queried here (idempotent, no I/O) so the
+        // gate sees a real total.
+        // ONE SET OF CONTROLS, describing whichever image `image` selects. A device carries two
+        // (the app it runs, and MoonBase the recovery image) and both are described by the same
+        // four facts, so publishing eight controls would be the same fact twice under two names,
+        // and a UI drawing its own copies underneath would be a third. The selector re-runs this
+        // (onControlChanged below), the way MoonLiveService rebuilds when its script changes.
         if (platform::otaHasMoonBase()) {
-            controls_.addReadOnly("moonbase", moonbaseStr_, sizeof(moonbaseStr_));
+            static const char* const kImages[] = { "App", "MoonBase" };
+            controls_.addSelect("image", imageSel_, kImages, 2);
+            // Drawn by the card as a TAB STRIP, not by the generic control list: it selects which
+            // image every row below describes, which reads as a tab rather than as one setting
+            // among the settings it governs. Same convention as the File Manager's own panel
+            // controls: hidden here so the value never renders twice.
+            controls_.setHidden(controls_.count() - 1, true);
+        } else {
+            imageSel_ = 0;   // nothing else to describe: the app is the only image
+        }
+
+        if (imageSel_ == 0) {
+            controls_.addReadOnly("version", versionStr_, sizeof(versionStr_));
+            controls_.addReadOnly("build", buildStr_, sizeof(buildStr_));
+            controls_.addReadOnly("firmware", firmwareStr_, sizeof(firmwareStr_));
+            firmwareSizeVal_ = static_cast<uint32_t>(platform::firmwareSize());
+            totalFlashVal_ = static_cast<uint32_t>(platform::firmwarePartition());
+            if (totalFlashVal_ > 0) {
+                controls_.addProgress("partition", firmwareSizeVal_, totalFlashVal_);
+            }
+        } else {
+            // Read here rather than trusting a value setup() left behind: this runs on every
+            // rebuild, and a member filled once at setup is one refactor away from being read
+            // before it is written. That is exactly what went wrong on the bench.
+            readMoonBaseVersion();
+            platform::otaMoonBaseSize(&moonbaseSizeVal_, &moonbaseTotalVal_);
+            controls_.addReadOnly("version", moonbaseStr_, sizeof(moonbaseStr_));
+            controls_.addReadOnly("build", moonbaseBuildStr_, sizeof(moonbaseBuildStr_));
+            // MoonBase has no variant: one image per chip, since it carries no board-specific
+            // code. The chip is what names its release asset, so that is what this reports.
+            std::snprintf(moonbaseChipStr_, sizeof(moonbaseChipStr_), "%s", platform::chipModel());
+            controls_.addReadOnly("firmware", moonbaseChipStr_, sizeof(moonbaseChipStr_));
+            if (moonbaseTotalVal_ > 0) {
+                controls_.addProgress("partition", moonbaseSizeVal_, moonbaseTotalVal_);
+            }
         }
 
         // OTA status goes through MoonModule::setStatus() (the per-module status
@@ -159,16 +225,15 @@ class FirmwareUpdateModule : public MoonModule {
         // choice DevicesModule made. The error-prefixed states map to
         // Severity::Error; everything else is neutral. See publishStatus().
         //
-        // Total is captured by value into the descriptor's `aux`; we re-bind
-        // (via markDirty → HttpServerModule rebuildControls) when totalSnap_
-        // changes. Initially 0; the UI shows "0KB / 0KB" until esp_https_ota
-        // reports the image size, then "X KB / 1297KB" for the rest.
-        // On a MoonBase device the in-place OTA task this control reports on never runs
-        // (installs happen in MoonBase; the update overlay carries the progress), so the
-        // control does not exist there.
-        if (!platform::otaHasMoonBase()) {
-            controls_.addProgress("update_pct", bytesRead_, totalSnap_);
-        }
+        // There is no progress CONTROL: an install's progress belongs in the overlay the UI puts
+        // up while it runs, not in a card row that sits at zero for the life of the device. The
+        // counters below still drive it, read from the status the same overlay polls.
+    }
+
+    /// Switching `image` changes which image every other control describes, so the set is rebuilt.
+    /// Same mechanism MoonLiveService uses when a script redeclares its controls.
+    void onControlChanged(const char* controlName) override {
+        if (std::strcmp(controlName, "image") == 0) rebuildControls();
     }
 
     void tick1s() MM_NONBLOCKING override {
@@ -177,16 +242,46 @@ class FirmwareUpdateModule : public MoonModule {
         // read shows as a brief mid-update glimpse — visually harmless.
         std::snprintf(statusStr_, sizeof(statusStr_), "%s", g_otaStatus);   // always NUL-terminates
         publishStatus();
-        bytesRead_ = g_otaBytesRead;
+        // A MoonBase install finishes on its own task with no reboot to announce it, so the
+        // version this card shows goes stale the moment the write completes. Watching the status
+        // fall back out of the installing states is what notices.
+        const bool installing = std::strcmp(statusStr_, "checking") == 0 ||
+                                std::strcmp(statusStr_, "erasing") == 0 ||
+                                std::strncmp(statusStr_, "writing MoonBase", 16) == 0;
+        if (wasInstallingMoonBase_ && !installing) {
+            readMoonBaseVersion();
+            rebuildControls();
+        }
+        wasInstallingMoonBase_ = installing;
+
+        // THE PARTITION BAR DOUBLES AS THE INSTALL BAR. At rest it shows how much of the slot the
+        // installed image fills, which is what a user wants to know about a partition. During an
+        // install it shows the INCOMING image filling that same slot, which is the same quantity
+        // measured live, so the card itself shows activity rather than only a popup: a URL
+        // install on a device with no MoonBase had no bar at all, just a line of status text.
+        //
+        // The control binds this member by reference, so pointing it at the live count is enough;
+        // no second control, and no re-bind. Restored from the real image size when the install
+        // ends, which also corrects it after a MoonBase install that does not reboot.
+        const bool writing = otaInFlight();
+        if (writing) {
+            firmwareSizeVal_ = g_otaBytesRead;
+            moonbaseSizeVal_ = g_otaBytesRead;
+        } else if (wasWriting_) {
+            firmwareSizeVal_ = static_cast<uint32_t>(platform::firmwareSize());
+            platform::otaMoonBaseSize(&moonbaseSizeVal_, &moonbaseTotalVal_);
+        }
+        wasWriting_ = writing;
+
         // Re-bind on total transition. Only fires once per OTA (and once on
         // any later OTA the user starts — we deliberately don't reset the
         // total to 0 between updates; the previous value is a fine starting
         // estimate until the new task reports the new size). rebuildControls
         // re-runs defineControls() so the addProgress' captured `aux` (total)
         // is refreshed to the new totalSnap_ value.
-        if (g_otaBytesTotal != totalSnap_ && !platform::otaHasMoonBase()) {
+        if (g_otaBytesTotal != totalSnap_) {
             totalSnap_ = g_otaBytesTotal;
-            rebuildControls();   // refresh update_pct's captured total; absent on MoonBase devices
+            rebuildControls();   // re-bind the progress total the overlay reads
         }
     }
 
@@ -208,7 +303,6 @@ class FirmwareUpdateModule : public MoonModule {
 
 private:
     char     statusStr_[64] = "idle";
-    uint32_t bytesRead_     = 0;
     uint32_t totalSnap_     = 0;
     // Firmware identity (static for this build) + the running app-partition usage.
     char     versionStr_[32] = {};   ///< pure semver — such as "2.0.0" or "2.1.0-dev.7"
@@ -216,7 +310,17 @@ class FirmwareUpdateModule : public MoonModule {
     char     firmwareStr_[24] = {};  ///< build variant name, such as "esp32s3-n16r8"
     uint32_t firmwareSizeVal_ = 0;   ///< bytes used in the app partition
     uint32_t totalFlashVal_   = 0;   ///< app partition size
-    char     moonbaseStr_[8]  = "standby";  ///< MoonBase present in the factory slot
+    /// The installed MoonBase's version, plus an "(outdated)" mark when it differs from this
+    /// app's. Falls back to "standby" when the image carries no readable descriptor, which is
+    /// every MoonBase built before it reported a version.
+    char     moonbaseStr_[48] = "standby";
+    char     moonbaseBuildStr_[32] = {};   ///< when the installed MoonBase was built
+    uint32_t moonbaseSizeVal_  = 0;        ///< bytes its image occupies
+    uint32_t moonbaseTotalVal_ = 0;        ///< the factory slot's size
+    char     moonbaseChipStr_[16] = {};    ///< the chip whose MoonBase image this board takes
+    uint8_t  imageSel_ = 0;                ///< 0 = the app, 1 = MoonBase: which image is described
+    bool     wasWriting_ = false;          ///< edge-detects the end of any install, to restore the bar
+    bool     wasInstallingMoonBase_ = false;   ///< edge-detects the end of a MoonBase install
 };
 
 } // namespace mm
diff --git a/src/core/HttpServerModule.cpp b/src/core/HttpServerModule.cpp
index 5e9310f6..919277d6 100644
--- a/src/core/HttpServerModule.cpp
+++ b/src/core/HttpServerModule.cpp
@@ -201,7 +201,7 @@ void HttpServerModule::handleConnection(platform::TcpConnection& conn) {
             contentLen = static_cast<int>(parsed);
             int headerSize = static_cast<int>(headerEnd + 4 - req);
             int bodyNeeded = headerSize + contentLen;
-            // Only the STREAMING routes (/api/file, /api/firmware/upload) may carry a body larger than
+            // Only the STREAMING routes (/api/file, /api/firmware/upload, the MoonBase update) may carry a body larger than
             // buf: they take the buffered prefix and pull the remainder straight off the socket. For
             // every OTHER route the body is parsed whole from buf, so a body over the buffer must be
             // REJECTED (413), not truncated: a capped read would parse a JSON prefix as if complete
@@ -209,7 +209,14 @@ void HttpServerModule::handleConnection(platform::TcpConnection& conn) {
             // The request line sits at the start of req; a substring match on the path is sufficient.
             const bool isStreamingRoute =
                 std::strncmp(req, "POST /api/file", 14) == 0 ||
-                std::strncmp(req, "POST /api/firmware/upload", 25) == 0;
+                std::strncmp(req, "POST /api/firmware/upload", 25) == 0 ||
+                // A MoonBase image is ~750 KB and streams the same way. Omitted at first, and the
+                // bench caught it: the 413 fires before the handler, so the route answered "body
+                // too large" for every image, valid or not.
+                // The trailing space matters: without it this prefix also matches
+                // `moonbase-update-url`, whose body is a small JSON object that must be read
+                // WHOLE. Treating it as streaming truncates it to the prefix buffer.
+                std::strncmp(req, "POST /api/firmware/moonbase-update ", 35) == 0;
             if (bodyNeeded > static_cast<int>(sizeof(buf) - 1)) {
                 if (!isStreamingRoute) {
                     sendResponse(conn, 413, "application/json",
@@ -394,6 +401,19 @@ void HttpServerModule::handleConnection(platform::TcpConnection& conn) {
             // Reboot into MoonBase with nothing staged: the UI uses this for install-from-file,
             // where the browser holds the image and re-POSTs it to MoonBase once it answers.
             handleBootMoonBase(conn);
+        } else if (std::strcmp(path, "/api/firmware/moonbase-update-url") == 0 && body) {
+            // Install a new MoonBase the device fetches itself, so a release asset can be taken
+            // straight from GitHub rather than downloaded by the browser and pushed back up.
+            handleMoonBaseUrl(conn, body);
+        } else if (std::strcmp(path, "/api/firmware/moonbase-update") == 0 && body) {
+            // Install a new MOONBASE from an uploaded image: the one direction the other
+            // firmware routes cannot go, since only the running app may write the factory slot.
+            const size_t initialLen = static_cast<size_t>(totalRead) - static_cast<size_t>(body - req);
+            if (!hasContentLen) {
+                sendResponse(conn, 411, "application/json", "{\"error\":\"length required\"}");
+                return;
+            }
+            handleMoonBaseUpload(conn, body, initialLen, static_cast<size_t>(contentLen));
         } else if (std::strcmp(path, "/api/firmware/upload") == 0 && body) {
             // OTA from an uploaded .bin body (no URL, no host to serve it): the browser POSTs the
             // firmware image straight to the device, which streams it into the OTA partition. Same
@@ -922,6 +942,15 @@ void HttpServerModule::applyFileChanged(const char* path) {
     // and deferring also sends this response before a network-reconfiguring apply can cut the
     // socket (the bench found both).
     if (auto* fs = FilesystemModule::instance()) fs->requestConfigApply(path);
+    // A write into the USER script directory of a name the firmware also ships is a FORK: from here
+    // on that copy shadows the shipped one and every library update is invisible behind it. Record
+    // what it was forked from, so the binding can later say "the shipped one has been updated"
+    // rather than leaving an edit and a stale leftover looking identical forever.
+    //
+    // Here rather than in the editor because the DEVICE is what knows both copies exist: every
+    // writer gets lineage, including a script pushed by a script or restored from a backup, and the
+    // UI stays out of a bookkeeping job it would have to repeat per caller.
+    moonlive::noteForkedFrom(path);
     if (!scheduler_) return;
     // requestPrepareTree, never prepareTree: the immediate walk runs a scripted layout's JIT'd code
     // on the CALLING task's stack (Scheduler.h:74-77), and a write arrives on the small web-server
@@ -973,6 +1002,110 @@ void HttpServerModule::handleFirmwareUpload(platform::TcpConnection& conn, const
     platform::reboot();  // noreturn: boots the flashed image
 }
 
+void HttpServerModule::handleMoonBaseUpload(platform::TcpConnection& conn, const char* initialBody,
+                                            size_t initialLen, size_t contentLen) {
+    if constexpr (!platform::hasOta) {
+        sendResponse(conn, 501, "application/json", "{\"error\":\"OTA not supported on this platform\"}");
+        return;
+    }
+    if (!platform::otaHasMoonBase()) {
+        sendResponse(conn, 409, "application/json", "{\"error\":\"no MoonBase on this device\"}");
+        return;
+    }
+    // Running FROM MoonBase means the factory slot is the executing one, which cannot be written.
+    // Rejecting here names the fix; otaWriteMoonBase refuses it again and IS the real guard: this
+    // one exists for the message, so a user is told to boot the app rather than reading a generic
+    // write error. Deliberately two checks, cheap ones, and the inner may never be removed.
+    if (platform::otaRunningMoonBase()) {
+        sendResponse(conn, 409, "application/json",
+                     "{\"error\":\"running from MoonBase, boot the app first\"}");
+        return;
+    }
+    if (otaInFlight()) {
+        sendResponse(conn, 409, "application/json", "{\"error\":\"ota already in progress\"}");
+        return;
+    }
+    const size_t initial = initialLen < contentLen ? initialLen : contentLen;
+    UploadSource src{&conn, initialBody, initial, contentLen,
+                     platform::millis() + kFirmwareUploadHardMs};
+    g_otaBytesTotal = static_cast<uint32_t>(contentLen);
+    g_otaBytesRead = 0;
+    const bool ok = platform::otaWriteMoonBase(&uploadPull, &src, contentLen,
+                                               g_otaStatus, sizeof(g_otaStatus), &g_otaBytesRead);
+    if (!ok) {
+        // DRAIN BEFORE ANSWERING. This route rejects an image from its first chunk, which is the
+        // whole point: nothing is erased until the image proves itself. But the client is still
+        // sending, and replying into a socket with ~750 KB in flight means the peer sees a reset
+        // instead of the reason. The bench showed it as an empty 500 on the one case that matters
+        // most, the wrong-chip image. uploadPull is bounded by its own deadlines, so a peer that
+        // stops sending cannot hold the connection open.
+        char discard[512];
+        for (bool done = false; !done;) {
+            bool abort = false;
+            if (uploadPull(discard, sizeof(discard), &src, &abort) == 0 || abort) done = true;
+        }
+        char msg[128];
+        std::snprintf(msg, sizeof(msg), "{\"error\":\"%.90s\"}", g_otaStatus);
+        sendResponse(conn, 500, "application/json", msg);
+        return;
+    }
+    // NO REBOOT, unlike every other firmware route. The app was never replaced: it wrote the
+    // image the device falls back to, and carries on running. Rebooting would cost an outage for
+    // nothing, and would hide whether the app itself still works.
+    // Re-READ then re-bind: the card holds the version in a buffer filled at setup, so rebuilding
+    // the controls alone would re-publish the string belonging to the image just replaced.
+    if (auto* fw = static_cast<FirmwareUpdateModule*>(findModuleByName("Firmware"))) {
+        fw->readMoonBaseVersion();
+        fw->rebuildControls();
+    }
+    sendResponse(conn, 200, "application/json", "{\"ok\":true}");
+}
+
+void HttpServerModule::handleMoonBaseUrl(platform::TcpConnection& conn, const char* body) {
+    if constexpr (!platform::hasOta) {
+        sendResponse(conn, 501, "application/json", "{\"error\":\"OTA not supported on this platform\"}");
+        return;
+    }
+    if (!platform::otaHasMoonBase()) {
+        sendResponse(conn, 409, "application/json", "{\"error\":\"no MoonBase on this device\"}");
+        return;
+    }
+    if (platform::otaRunningMoonBase()) {
+        sendResponse(conn, 409, "application/json",
+                     "{\"error\":\"running from MoonBase, boot the app first\"}");
+        return;
+    }
+    if (otaInFlight()) {
+        sendResponse(conn, 409, "application/json", "{\"error\":\"ota already in progress\"}");
+        return;
+    }
+    char url[512] = {};
+    mm::json::parseString(body, "url", url, sizeof(url));
+    if (url[0] == 0) {
+        sendResponse(conn, 400, "application/json", "{\"error\":\"url required\"}");
+        return;
+    }
+    if (std::strncmp(url, "http://", 7) != 0 && std::strncmp(url, "https://", 8) != 0) {
+        sendResponse(conn, 400, "application/json",
+                     "{\"error\":\"url must start with http:// or https://\"}");
+        return;
+    }
+    g_otaBytesRead = 0;
+    g_otaBytesTotal = 0;
+    // 202 AND RETURN, like the app's URL install. The install runs on its own task, so the
+    // browser is free to poll for progress while it works: a request held open until the install
+    // finished could only ever report "installing" and then "installed", with no bar in between.
+    const bool started = platform::otaFetchMoonBaseUrl(url, g_otaStatus, sizeof(g_otaStatus),
+                                                       &g_otaBytesRead, &g_otaBytesTotal);
+    if (!started) {
+        char msg[128];
+        std::snprintf(msg, sizeof(msg), "{\"error\":\"%.90s\"}", g_otaStatus);
+        sendResponse(conn, 500, "application/json", msg);
+        return;
+    }
+    sendResponse(conn, 202, "application/json", "{\"ok\":true}");
+}
+
 void HttpServerModule::serveFile(platform::TcpConnection& conn, const char* filename, const char* contentType) {
     // Try disk first (desktop development: live editing without rebuild)
     char filepath[256];
diff --git a/src/core/HttpServerModule.h b/src/core/HttpServerModule.h
index bf4559e1..ef8e7c78 100644
--- a/src/core/HttpServerModule.h
+++ b/src/core/HttpServerModule.h
@@ -556,6 +556,15 @@ class HttpServerModule : public MoonModule, public BinaryBroadcaster {
     void handleFirmwareUrl(platform::TcpConnection& conn, const char* body);
     void handleFirmwareUpload(platform::TcpConnection& conn, const char* initialBody,
                               size_t initialLen, size_t contentLen);   // POST /api/firmware/upload
+    /// Install a new MoonBase into the factory slot: the mirror of MoonBase installing the app,
+    /// and the only way to fix a broken recovery image without a cable. Vets the image before
+    /// erasing anything, and does NOT reboot: the running app is untouched.
+    void handleMoonBaseUpload(platform::TcpConnection& conn, const char* initialBody,
+                              size_t initialLen, size_t contentLen);   // POST /api/firmware/moonbase-update
+    /// The same install, fetched by the device from a URL: what makes a GitHub release asset
+    /// installable without the browser relaying ~750 KB. Answers 202 and installs on its own
+    /// task, so the browser can poll for progress; nothing reboots, so there is no handover.
+    void handleMoonBaseUrl(platform::TcpConnection& conn, const char* body);   // POST /api/firmware/moonbase-update-url
 
     // -----------------------------------------------------------------------
     // WebSocket
diff --git a/src/core/moonlive/MoonLiveBuiltins.h b/src/core/moonlive/MoonLiveBuiltins.h
index 3de32e3d..8ee7296f 100644
--- a/src/core/moonlive/MoonLiveBuiltins.h
+++ b/src/core/moonlive/MoonLiveBuiltins.h
@@ -273,7 +273,39 @@ static constexpr uint8_t kDepthSlot = kCtrlBytes + kMaxSysVars * kSysVarBytes;
 /// stack and the rest of the render path need.
 static constexpr uint8_t kMaxCallDepth = 32;
 
-static constexpr uint8_t kArenaBytes  = kCtrlBytes + kMaxSysVars * kSysVarBytes + 1;   // +1: kDepthSlot
+/// WHERE A SCRIPT CALL'S ARGUMENTS ARE PASSED, and why they are not passed in the frame.
+///
+/// Each function opens its OWN frame (`a.prologue`), and a frame slot is addressed off the current
+/// frame pointer: on Xtensa through the windowed ABI's `entry a1, N`. So a caller physically cannot
+/// store into the slot the callee will read, and the obvious design (stage into the callee's
+/// locals) is not expressible on the target that matters most.
+///
+/// The ARENA is what both activations share: every function already holds its pointer (kArg4), so
+/// an argument block here costs no new register, no change to any call sequence, and in particular
+/// leaves Xtensa's `call8` untouched, which is the most defect-prone code in this project.
+///
+/// ONE block, not one per depth, because the CALLEE COPIES ITS ARGUMENTS INTO ITS OWN FRAME as its
+/// first act. The block is therefore live only across the call instruction itself, and the two
+/// cases that look dangerous both hold: in `f(g(x))` the inner call has returned (and its block is
+/// dead) before the outer one writes; and in recursion the callee has already copied out before it
+/// writes the block for the call it makes. Copy-at-entry is what buys the single block, so it is a
+/// requirement of this design rather than an optimization of it.
+static constexpr uint8_t kMaxScriptArgs  = 4;     // per call; a helper wanting more wants an array
+static constexpr uint8_t kScriptArgBytes = 4;     // one machine word, as a frame slot is
+/// ALIGNED to a 4-byte boundary, because these are 32-bit slots: kDepthSlot is a single byte, so
+/// the next free address is odd, and a word store there is unaligned. Xtensa faults on that, and a
+/// misaligned word is a silently wrong value everywhere else.
+static constexpr uint8_t kScriptArgBase  = static_cast<uint8_t>((kDepthSlot + 1 + 3) & ~3);
+
+/// The arena byte offset of argument `i`.
+constexpr uint8_t scriptArgOffset(uint8_t i) {
+    return static_cast<uint8_t>(kScriptArgBase + i * kScriptArgBytes);
+}
+
+/// Sized from the argument block's own END, not from a sum of the parts: the block is ALIGNED up
+/// from kDepthSlot, so adding the pieces underestimates it by the padding and the last argument
+/// would sit past the arena the host allocates.
+static constexpr uint8_t kArenaBytes  = kScriptArgBase + kMaxScriptArgs * kScriptArgBytes;
 
 /// A name the HOST defines and the script only reads (`width`, `height`, `depth`). Reserved: a
 /// script cannot declare one, so the name means the same thing in every script (the `t` rule, one
diff --git a/src/core/moonlive/MoonLiveCompiler.cpp b/src/core/moonlive/MoonLiveCompiler.cpp
index 64c76851..a7af4cea 100644
--- a/src/core/moonlive/MoonLiveCompiler.cpp
+++ b/src/core/moonlive/MoonLiveCompiler.cpp
@@ -166,7 +166,11 @@ struct Parser {
     // Each function the class defined, with the IR index its body starts at. An IR index, not a byte
     // offset: the parser runs before lowering, so the byte an entry lands on is not known yet. The
     // emitter converts one to the other, which is the same seam a linker crosses.
-    struct FnMark { const char* name; uint8_t nameLen; uint16_t irStart; RetType ret; };
+    /// `params` is how many arguments the function declares. They live in the LOWEST frame
+    /// slots of its frame (0..params-1), which is what lets a caller stage arguments into them
+    /// with the same Spill the builtin path already uses: no backend calling convention changes,
+    /// and in particular Xtensa's windowed call8 sequence is untouched.
+    struct FnMark { const char* name; uint8_t nameLen; uint16_t irStart; RetType ret; uint8_t params; };
     FnMark             fns[kMaxEntryPoints] = {};
     uint8_t            fnCount = 0;
     /// What the function currently being parsed declared it returns, so a `return` can be
@@ -682,7 +686,36 @@ struct Parser {
                 if (std::strncmp(fns[i].name, lex.identBeg, lex.identLen) != 0) continue;
                 lex.advance();
                 if (!expect(Tok::LParen, "expected '(' after the function name")) return;
-                if (!expect(Tok::RParen, "a script function takes no arguments yet")) return;
+                // ARGUMENTS, evaluated into REGISTERS first and stored to the arena block only
+                // once they all are. The store cannot follow each argument, because evaluating a
+                // later one may itself contain a call (`paint(0, twice(21))`) whose own arguments
+                // go through the same block: writing as we go had the inner call overwrite the
+                // outer's first argument, and paint drew 21 where 0 belonged.
+                //
+                // Delaying the stores to the last possible moment is what makes ONE block enough:
+                // between the final store and the call there is nothing left to run.
+                const uint8_t want = fns[i].params;
+                VReg staged[kMaxScriptArgs] = {};
+                uint8_t got = 0;
+                while (lex.kind != Tok::RParen && lex.kind != Tok::End) {
+                    if (got > 0 && !expect(Tok::Comma, "expected ',' between arguments")) return;
+                    const VReg a = parseExpr();
+                    if (failed) return;
+                    if (got < want && got < kMaxScriptArgs) staged[got] = a;
+                    else freeTemp(a);
+                    got++;
+                }
+                if (!expect(Tok::RParen, "expected ')' to close the arguments")) return;
+                const uint8_t staging = got < want ? got : want;
+                for (uint8_t a = 0; a < staging && a < kMaxScriptArgs; a++) {
+                    emit({IrOp::StoreCtrl32, 0, staged[a], 0,0,0, scriptArgOffset(a), nullptr, {}});
+                    freeTemp(staged[a]);
+                }
+                if (got != want) {
+                    fail(got < want ? "too few arguments for this function"
+                                    : "too many arguments for this function");
+                    return;
+                }
                 // A call used as a VALUE takes what the callee returned. Refused when the callee
                 // declares void, since there is nothing to take and the script would otherwise
                 // read whatever the return register happened to hold.
@@ -1165,13 +1198,35 @@ struct Parser {
             fail("the condition must test the loop variable"); return false;
         }
         lex.advance();
-        if (!expect(Tok::Less, "expected '<' — it is the only comparison a for condition takes")) return false;
+        // `<` and `<=`. The emitted guard is BranchGe(counter, limit), which IS `counter < limit`,
+        // so `<=` is the same code against a limit one higher: computed once here rather than
+        // re-tested every iteration.
+        //
+        // `>` and `>=` are refused rather than half-supported. The loop's step is parsed but its
+        // DIRECTION is not modelled: a descending loop needs the guard, the back edge and the step
+        // to agree on which way the counter moves, and a `>` accepted here would emit an ascending
+        // guard around a descending body and run zero times or forever. Counting up with the index
+        // inverted inside is the workaround, and it is what the error says.
+        bool inclusive = false;
+        if (lex.kind == Tok::LessEq) { inclusive = true; lex.advance(); }
+        else if (lex.kind == Tok::Greater || lex.kind == Tok::GreaterEq) {
+            fail("a for counts up: use `<` or `<=` and invert the index inside");
+            return false;
+        }
+        else if (!expect(Tok::Less, "expected '<' or '<=' in the for condition")) return false;
         // The bound goes to its own slot: it is read at the entry guard and again at the back edge,
         // so it has to survive the body — and a body containing a call would otherwise have to keep
         // it in a register across that call.
         VReg limitTmp = parseExpr();
         if (exprIsFixed) { fail("a loop counts in whole numbers: write toInt(x)"); return false; }
         if (failed) return false;
+        if (inclusive) {
+            // `i <= n` is `i < n + 1`, so the guard below is untouched.
+            VReg one = alloc();
+            emit({IrOp::Const, one, 0,0,0,0, 1, nullptr, {}});
+            emit({IrOp::Add, limitTmp, limitTmp, one, 0,0, 0, nullptr, {}});
+            freeTemp(one);
+        }
         if (slotHighWater >= kMaxLocals) { fail("too many loop variables"); return false; }
         const uint8_t limitSlot = slotHighWater++;
         emit({IrOp::Spill, 0, limitTmp, 0,0,0, limitSlot, nullptr, {}});
@@ -1502,13 +1557,27 @@ struct Parser {
             emit({IrOp::BranchGe, 0, z, z, 0,0, lEnd, nullptr, {}});
             freeTemp(z);
             emit({IrOp::Label,    0, 0,0,0,0, lElse, nullptr, {}});
-            if (!expect(Tok::LBrace, "expected '{': an else body is braced")) return false;
-            const uint8_t elseLocal = localCount, elseSlot = slotHighWater;
-            while (!failed && lex.kind != Tok::RBrace && lex.kind != Tok::End)
-                if (!parseStatement()) return false;
-            if (failed) return false;
-            localCount = elseLocal; slotHighWater = elseSlot;
-            if (!expect(Tok::RBrace, "expected '}' to close the else body")) return false;
+            // `else if` is an else whose body is ONE if statement, which is what it means in C and
+            // what lets a chain of conditions read as a list rather than as a staircase of nested
+            // braces. Recursing here is the whole implementation: the inner if allocates its own
+            // labels and its own scope, and this one's end-label still closes the chain.
+            //
+            // Without it a mode select (`if (mode == 0) … else if (mode == 1) …`) had to be written
+            // as separate ifs re-testing the same variable, which costs a comparison per arm and,
+            // on a script with several modes, runs into the per-script label budget.
+            if (atKeyword("if", 2)) {
+                const uint8_t chainLocal = localCount, chainSlot = slotHighWater;
+                if (!parseIf()) return false;
+                localCount = chainLocal; slotHighWater = chainSlot;
+            } else {
+                if (!expect(Tok::LBrace, "expected '{': an else body is braced")) return false;
+                const uint8_t elseLocal = localCount, elseSlot = slotHighWater;
+                while (!failed && lex.kind != Tok::RBrace && lex.kind != Tok::End)
+                    if (!parseStatement()) return false;
+                if (failed) return false;
+                localCount = elseLocal; slotHighWater = elseSlot;
+                if (!expect(Tok::RBrace, "expected '}' to close the else body")) return false;
+            }
             emit({IrOp::Label, 0, 0,0,0,0, lEnd, nullptr, {}});
         } else {
             emit({IrOp::Label, 0, 0,0,0,0, lElse, nullptr, {}});
@@ -1679,15 +1748,71 @@ struct Parser {
     /// Stage 1 emits it INLINE at the point the class body reaches it, which is what makes `tick()`
     /// the whole program while it is the only entry point. Real per-function frames arrive with the
     /// call support in this same step; this is the parse shape they will attach to.
-    bool parseFunctionBody() {
+    /// The parameter list, parsed BEFORE the function emits anything: the count decides how many
+    /// copy-out instructions its prologue needs, and inserting into the IR afterwards would shift
+    /// every index the spill pass and the call lowering rely on.
+    bool parseParams(uint8_t* paramsOut) {
         if (!expect(Tok::LParen,  "expected '(' after the function name")) return false;
-        if (!expect(Tok::RParen,  "expected ')': parameters arrive with typed members")) return false;
-        if (!expect(Tok::LBrace,  "expected '{' to open the function body")) return false;
-        // Each function starts with an empty local scope and ends with one, so `tick()` and
-        // `tick20ms()` in the same class each get the whole frame rather than sharing what the
-        // first one happened to leave. Stage 1 emits functions inline, which is exactly why this is
-        // needed: without it the second function's locals would stack on top of the first's.
+        // The locals must be cleared BEFORE the parameters are declared: they become locals 0..N-1
+        // of this function's frame, and a leftover from the previous function would push them up
+        // and leave the caller staging into the wrong slots.
         localCount = 0; slotHighWater = 0;
+        uint8_t params = 0;
+        while (lex.kind != Tok::RParen && lex.kind != Tok::End) {
+            if (params > 0 && !expect(Tok::Comma, "expected ',' between parameters")) return false;
+            // A parameter is declared like a variable, and its type is read the same way, so
+            // `int`/`byte`/`bool` all mean here what they mean anywhere else.
+            if (!atTypeKeyword()) { fail("expected a parameter type"); return false; }
+            const CtrlType t = currentType();
+            lex.advance();
+            if (lex.kind != Tok::Ident) { fail("expected a parameter name"); return false; }
+            // The SAME name checks a local declaration runs. A parameter is a local, so a name
+            // that would be refused inside the body has to be refused in the list: without these
+            // a parameter could shadow a builtin or a system variable (making it unreachable for
+            // the whole function) or repeat another parameter, where lookups find the first while
+            // the caller stages a value into both slots.
+            if (isReservedWord(lex.identBeg, lex.identLen)) {
+                fail("that name is a reserved word"); return false;
+            }
+            if (table.find(lex.identBeg, lex.identLen)) {
+                fail("that name shadows a built-in function"); return false;
+            }
+            if (sysvars.find(lex.identBeg, lex.identLen)) {
+                fail("name is a system variable"); return false;
+            }
+            if (findLocal(lex.identBeg, lex.identLen) >= 0) {
+                fail("that name is already in use here"); return false;
+            }
+            if (findMember(lex.identBeg, lex.identLen) >= 0) {
+                fail("a member of that name is declared"); return false;
+            }
+            if (localCount >= kMaxLocals) { fail("too many locals"); return false; }
+            // Bounded by the ARENA BLOCK, not by kMaxCallArgs. The block carries kMaxScriptArgs
+            // values and the call site clamps to it, but the prologue emits one LoadCtrl32 per
+            // DECLARED parameter: a fifth read past the end of the arena allocation, and a later
+            // one wrote there. Script text is user-supplied on a network-reachable device, so the
+            // declaration is refused where it is written rather than clamped silently.
+            if (params >= moonlive::kMaxScriptArgs) {
+                fail("a function takes at most 4 parameters");
+                return false;
+            }
+            locals[localCount++] = {lex.identBeg, lex.identLen, slotHighWater, t};
+            slotHighWater++;
+            if (slotHighWater > slotsUsed) slotsUsed = slotHighWater;
+            params++;
+            lex.advance();
+        }
+        if (!expect(Tok::RParen,  "expected ')' to close the parameter list")) return false;
+        if (paramsOut) *paramsOut = params;
+        return true;
+    }
+
+    /// The body. Its parameters are already locals 0..N-1, declared by parseParams.
+    bool parseFunctionBody() {
+        if (!expect(Tok::LBrace,  "expected '{' to open the function body")) return false;
+        // Cleared above, BEFORE the parameters were declared, so they are in scope for the body:
+        // clearing here would discard them. Each function still starts with an empty scope, which
+        // is what stops one function's locals stacking on the next's.
         while (!failed && lex.kind != Tok::RBrace && lex.kind != Tok::End)
             if (!parseStatement()) return false;
         if (failed) return false;
@@ -1755,20 +1880,47 @@ struct Parser {
             // the wrong function, silently. Refused here, where a control name already is, so the
             // script author is told rather than the engine guessing.
             if (lex.identLen > kMaxEntryName) { fail("function name too long"); return false; }
-            fns[fnCount] = {lex.identBeg, static_cast<uint8_t>(lex.identLen),
-                            static_cast<uint16_t>(ir.count), ret};
+            // The NAME is captured before the SIGNATURE is parsed, since parsing moves the lexer,
+            // and the signature is parsed before anything is emitted: the parameter count decides
+            // how many copy-out instructions the prologue needs, and inserting into the IR after
+            // the fact would shift every index the spill pass and the call lowering rely on.
+            const char* const fnName = lex.identBeg;
+            const uint8_t fnNameLen = static_cast<uint8_t>(lex.identLen);
+            lex.advance();                       // the function name
+            uint8_t params = 0;
+            if (!parseParams(&params)) return false;
+            fns[fnCount] = {fnName, fnNameLen, static_cast<uint16_t>(ir.count), ret, params};
             curRet = ret;                        // every `return` below is checked against it
             // The IR carries the start INDEX; the lowering turns it into a byte offset.
             ir.fnIrStart[fnCount] = static_cast<uint16_t>(ir.count);
             ir.fnCount = static_cast<uint8_t>(fnCount + 1);
             fnCount++;
-            lex.advance();                       // the function name
             // Park the host arguments in this FUNCTION's frame. Read-only, so one store each, and
             // every later read is a Reload, which frees five registers for the body. Per function
             // rather than per program because each function owns its own frame now: a spill emitted
             // before the first prologue would write to a frame that does not exist yet.
             for (VReg v = 0; v < kFirstTemp; v++)
                 emit({IrOp::Spill, 0, v, 0,0,0, hostArgSlot(v), nullptr, {}});
+            // COPY THE ARGUMENTS OUT of the shared arena block into this function's own slots,
+            // before the body runs and so before it can make a call of its own. That copy is what
+            // lets ONE arena block serve every depth: see kScriptArgBase. It also has to happen
+            // here rather than lazily at each use, since a call in the middle of the body would
+            // overwrite the block the later uses would read.
+            for (uint8_t a = 0; a < params; a++) {
+                const VReg v = alloc();
+                emit({IrOp::LoadCtrl32, v, 0,0,0,0, scriptArgOffset(a), nullptr, {}});
+                // NARROWED to what the parameter was declared as, the same way an assignment to a
+                // local is (parseLocalDecl, and the assignment path). A `byte` parameter handed
+                // 300 kept 300, so the same value behaved differently depending on whether it
+                // arrived as an argument or was assigned inside the body.
+                //
+                // Here rather than at the call site: the callee knows the declared types (they are
+                // its own locals 0..N-1), while the caller would need them carried into FnMark,
+                // and one conversion in the prologue serves every call site.
+                narrowToType(v, locals[a].type);
+                emit({IrOp::Spill, 0, v, 0,0,0, a, nullptr, {}});
+                freeTemp(v);
+            }
             if (!parseFunctionBody()) return false;
             any = true;
         }
diff --git a/src/core/moonlive/MoonLiveIr.h b/src/core/moonlive/MoonLiveIr.h
index 6bbe557a..7da38fcd 100644
--- a/src/core/moonlive/MoonLiveIr.h
+++ b/src/core/moonlive/MoonLiveIr.h
@@ -225,7 +225,14 @@ constexpr uint8_t idxCount(int32_t p) { return uint8_t((p >> 16) & 0xff); }
 /// runs for the whole program rather than per scope — a label is never reused once a loop closes —
 /// so this bounds the TOTAL number of loops in a script (8), not how deeply they nest. Nesting
 /// depth is bounded separately, by `locals`.
-static constexpr uint8_t kIrLabels = 16;
+/// Raised from 16 (2026-09-07). Sixteen bounded a script to eight loops, and a script that SELECTS
+/// between modes spends them fast: each `else if` arm is two, so a five-mode effect with a loop in
+/// each was refused with "too many branches" for asking something ordinary. The cost is four small
+/// stack arrays in the spill pass and the lowering, a few hundred bytes on a machine that already
+/// allocates its exec block from the heap. The ASSEMBLER tables did not move with it: they are
+/// sized by named functions and StoreElems, which an `else if` arm does not add, and raising them
+/// in step would have put lowerWith's frame past the 2 KB this file warns about below.
+static constexpr uint8_t kIrLabels = 40;
 
 /// Labels and fixups an ASSEMBLER's tables hold. Larger than kIrLabels because a backend allocates
 /// labels the IR never names: one per named function (a call may precede its definition, so these
diff --git a/src/light/draw.h b/src/light/draw.h
index 403903ed..66175201 100644
--- a/src/light/draw.h
+++ b/src/light/draw.h
@@ -1262,6 +1262,72 @@ inline void disc(const Canvas& cv, pos_t cx, pos_t cy, pos_t r, RGB c, lengthTyp
     }
 }
 
+/// A circle OUTLINE of a given stroke width, centered on the radius: `thickness` of one pixel
+/// (`kSubOne`) draws a one-pixel ring. Sub-pixel and antialiased like `disc`.
+///
+/// A shape of its own rather than two discs subtracted, and the difference is visible: subtracting
+/// leaves the INNER edge hard, because the cut-out disc's coverage is not blended, only removed. A
+/// ring drawn from its own distance band gets both edges antialiased, which is what lets a thin
+/// ring stay smooth while it grows.
+inline void ring(const Canvas& cv, pos_t cx, pos_t cy, pos_t r, pos_t thickness, RGB c,
+                 lengthType z = 0) {
+    if (r <= 0 || thickness <= 0) return;
+    const pos_t half = thickness / 2;
+    const lengthType x0 = toPixel(cx - r - half) - 1, x1 = toPixel(cx + r + half) + 1;
+    const lengthType y0 = toPixel(cy - r - half) - 1, y1 = toPixel(cy + r + half) + 1;
+    for (lengthType y = y0; y <= y1; y++) {
+        for (lengthType x = x0; x <= x1; x++) {
+            // sdCircle gives the distance to the circle's LINE (signed, negative inside). The ring
+            // is the band within `half` of that line, so its own distance is how far outside the
+            // band the pixel sits: |d| - half.
+            const int32_t d = sdCircle(toSub(x) + kSubOne / 2, toSub(y) + kSubOne / 2, cx, cy, r);
+            const int32_t off = (d < 0 ? -d : d) - half;
+            const uint8_t cov = coverage(off);
+            if (cov == 0) continue;
+            addPixel(cv, {x, y, z}, RGB{scale8(c.r, cov), scale8(c.g, cov), scale8(c.b, cov)});
+        }
+    }
+}
+
+/// A line with WIDTH and sub-pixel endpoints, antialiased along both edges and round-capped.
+///
+/// Distinct from `line` rather than an overload of it, because they answer different questions.
+/// `line` walks whole pixels by Bresenham and is the cheap one, right for a wire-frame or a
+/// scribble. This one places a stroke of real width at a fractional position, which is what a clock
+/// hand or a spoke needs: on a 16-pixel panel a Bresenham hand jumps a whole pixel at a time and
+/// reads as broken, where this moves smoothly because brightness carries the fraction.
+inline void strokeLine(const Canvas& cv, pos_t x0, pos_t y0, pos_t x1, pos_t y1, pos_t thickness,
+                       RGB c, lengthType z = 0) {
+    if (thickness <= 0) return;
+    const pos_t half = thickness / 2;
+    const int64_t dx = static_cast<int64_t>(x1) - x0, dy = static_cast<int64_t>(y1) - y0;
+    const int64_t lenSq = dx * dx + dy * dy;
+    // A zero-length stroke is a dot, which is what a fully retracted hand should still draw.
+    if (lenSq == 0) { disc(cv, x0, y0, half, c, z); return; }
+
+    const pos_t loX = (x0 < x1 ? x0 : x1) - half, hiX = (x0 > x1 ? x0 : x1) + half;
+    const pos_t loY = (y0 < y1 ? y0 : y1) - half, hiY = (y0 > y1 ? y0 : y1) + half;
+    for (lengthType y = toPixel(loY) - 1; y <= toPixel(hiY) + 1; y++) {
+        for (lengthType x = toPixel(loX) - 1; x <= toPixel(hiX) + 1; x++) {
+            const pos_t px = toSub(x) + kSubOne / 2, py = toSub(y) + kSubOne / 2;
+            // Project the pixel onto the segment, CLAMPED to its ends: without the clamp the
+            // stroke would run on along the infinite line, and the two caps would be square rather
+            // than round. `t` is the position along the segment, 0..kSubOne.
+            const int64_t vx = static_cast<int64_t>(px) - x0, vy = static_cast<int64_t>(py) - y0;
+            int64_t t = ((vx * dx + vy * dy) * kSubOne) / lenSq;
+            if (t < 0) t = 0;
+            if (t > kSubOne) t = kSubOne;
+            const pos_t nx = static_cast<pos_t>(x0 + ((dx * t) >> kSubShift));
+            const pos_t ny = static_cast<pos_t>(y0 + ((dy * t) >> kSubShift));
+            // Distance to that nearest point, then the same edge rule every shape here uses:
+            // sdCircle with the stroke's half-width IS "how far outside the stroke am I".
+            const uint8_t cov = coverage(sdCircle(px, py, nx, ny, half));
+            if (cov == 0) continue;
+            addPixel(cv, {x, y, z}, RGB{scale8(c.r, cov), scale8(c.g, cov), scale8(c.b, cov)});
+        }
+    }
+}
+
 /// The volumetric form: a filled sphere, shaded the same way.
 ///
 /// Separate rather than a defaulted depth on `disc`, because the cost differs by an order: a sphere
diff --git a/src/light/drivers/Drivers.h b/src/light/drivers/Drivers.h
index 5ace8294..1f71bd42 100644
--- a/src/light/drivers/Drivers.h
+++ b/src/light/drivers/Drivers.h
@@ -265,21 +265,36 @@ class Drivers : public MoonModule {
     /// the seam holds POINTERS, so a local would dangle the moment this returned.
     void refreshLivePalettes() {
         liveCount_ = 0;
-        platform::fsList(moonlive::kScriptDir, [](const char* name, bool isDir, uint32_t, void* ctx) {
-            auto* self = static_cast<Drivers*>(ctx);
-            if (isDir || self->liveCount_ >= LivePalettes::kMax) return;
-            const size_t n = std::strlen(name);
-            if (n < 5 || std::strcmp(name + n - 4, moonlive::kPaletteExt) != 0) return;
-            // A bounded copy rather than snprintf("%s"): a name longer than the slot is TRUNCATED
-            // to fit, which is what a picker entry wants, and GCC cannot prove the %s form fits.
-            char* slot = self->liveNames_[self->liveCount_];
-            const size_t cap = sizeof(self->liveNames_[0]) - 1;
-            const size_t copy = n < cap ? n : cap;
-            std::memcpy(slot, name, copy);
-            slot[copy] = '\0';
-            self->livePtrs_[self->liveCount_] = self->liveNames_[self->liveCount_];
-            self->liveCount_++;
-        }, this);
+        // BOTH directories, user first, exactly as resolveScript() loads them: a `.mlp` the UI
+        // downloaded sits in the FACTORY directory, and scanning only the user one made every
+        // downloaded palette invisible. The picker then said "reopen the picker to select it" and
+        // reopening changed nothing, because the file was never going to be listed.
+        //
+        // User first matters for the dedupe below: editing a factory palette writes a second file
+        // of the same name to kScriptDir, and the two must appear as ONE entry, the user's.
+        const auto scan = [](const char* dir, void* ctx) {
+            platform::fsList(dir, [](const char* name, bool isDir, uint32_t, void* c) {
+                auto* self = static_cast<Drivers*>(c);
+                if (isDir || self->liveCount_ >= LivePalettes::kMax) return;
+                const size_t n = std::strlen(name);
+                if (n < 5 || std::strcmp(name + n - 4, moonlive::kPaletteExt) != 0) return;
+                // Already seen means the user directory carried it, and that copy SHADOWS this one
+                // (resolveScript prefers it), so the factory pass must not add a second row.
+                for (uint8_t i = 0; i < self->liveCount_; i++)
+                    if (std::strcmp(self->livePtrs_[i], name) == 0) return;
+                // A bounded copy rather than snprintf("%s"): a name longer than the slot is TRUNCATED
+                // to fit, which is what a picker entry wants, and GCC cannot prove the %s form fits.
+                char* slot = self->liveNames_[self->liveCount_];
+                const size_t cap = sizeof(self->liveNames_[0]) - 1;
+                const size_t copy = n < cap ? n : cap;
+                std::memcpy(slot, name, copy);
+                slot[copy] = '\0';
+                self->livePtrs_[self->liveCount_] = self->liveNames_[self->liveCount_];
+                self->liveCount_++;
+            }, ctx);
+        };
+        scan(moonlive::kScriptDir, this);
+        scan(moonlive::kFactoryScriptDir, this);
         // Alphabetical, because the picker MERGES this list with the built-ins by name and that
         // merge walks both in order. An unsorted list here would interleave wrongly.
         for (uint8_t i = 1; i < liveCount_; i++)
@@ -628,8 +643,15 @@ class Drivers : public MoonModule {
         // read its controls, then destroys it): such a probe would take the seam and empty it on
         // its way out, and every `.mlp` vanished from the running picker. prepare() runs only on a
         // module the scheduler actually mounted, which is exactly the owner the seam wants.
+        const uint8_t hadLive = liveCount_;
         refreshLivePalettes();
         LivePalettes::set(livePtrs_, liveTags_, liveCount_);
+        // A CHANGED count needs the control rebuilt, not just the seam republished: `palette`'s
+        // maximum is baked in defineControls() as liveCount_ + kCount, so a palette downloaded
+        // while running was listed by the picker and then REFUSED with "value out of range",
+        // because the control still carried the old cap. A write reaches here through
+        // applyFileChanged() -> requestPrepareTree(), so this is where the new file first appears.
+        if (liveCount_ != hadLive) rebuildControls();
         // Re-resolve the active Layer from the bound container so a Layer that
         // was cleared and rebuilt via the API is picked up here (self-healing).
         // setLayer() pins a Layer directly and leaves effects_ null — skip then.
diff --git a/src/light/effects/AudioVolumeEffect.h b/src/light/effects/AudioVolumeEffect.h
deleted file mode 100644
index a1738f6b..00000000
--- a/src/light/effects/AudioVolumeEffect.h
+++ /dev/null
@@ -1,61 +0,0 @@
-#pragma once
-
-#include "light/effects/EffectBase.h"
-
-namespace mm {
-
-// Audio-reactive VU effect: the whole grid pulses with the microphone's sound
-// level. The simplest audio consumer — one scalar (AudioFrame::level) drives a
-// single brightness, a color shifting from calm to hot as it rises. Reads the
-// live frame from AudioService::latestFrame(); with no mic (or silence) the frame is
-// zero and the grid stays dark, so the effect is safe on any target.
-// Author: projectMM original (VU-meter)
-/// Audio-reactive effect: drives brightness/color from the overall sound level.
-class AudioVolumeEffect : public EffectBase {
-public:
-    const char* tags() const override { return "💫🎵"; }
-    Dim dimensions() const override { return Dim::D3; }
-
-    uint8_t brightness = 255;   // overall ceiling
-
-    void defineControls() override {
-        controls_.addControl("brightness", brightness, 1, 255);
-    }
-
-    void tick() MM_NONBLOCKING override {
-        uint8_t* buf = buffer();
-        const lengthType w = width();
-        const lengthType h = height();
-        const lengthType d = depth();
-        const uint8_t cpl = channelsPerLight();
-        const size_t total = static_cast<size_t>(w) * h * d * cpl;
-
-        // level is ~0..255; scale to the brightness ceiling. Uses the SMOOTHED level so the whole
-        // surface glows/breathes with the music instead of jittering per audio block (the calm VU
-        // look, the same choice as AudioSpectrum's VU bar).
-        const uint16_t level = AudioService::latestFrame()->levelSmoothed;
-        const uint16_t v = static_cast<uint16_t>(
-            (level > 255 ? 255 : level) * brightness / 255);
-
-        // Level drives BOTH the palette index and the brightness: quiet maps to the palette's
-        // start, loud to its end, dimmed by v. Fill every light identically — a VU meter on the
-        // whole surface; modifiers/layouts give it shape.
-        const uint8_t lvl = static_cast<uint8_t>(level > 255 ? 255 : level);
-        const RGB c = colorFromPalette(*Palettes::active(), lvl, static_cast<uint8_t>(v));
-        const uint8_t r = c.r, g = c.g, b = c.b;
-
-        // Write logical RGB only: channel order and any RGBW white are the
-        // driver's Correction (W = min(r,g,b)), like every other effect. Effect
-        // buffers are RGB (cpl == 3) today; the loop stays correct for any cpl by
-        // writing R/G/B where they fit and zeroing any extra channels, so no stale
-        // bytes survive from a prior, differently-shaped frame.
-        for (size_t off = 0; off < total; off += cpl) {
-            if (cpl >= 1) buf[off + 0] = r;
-            if (cpl >= 2) buf[off + 1] = g;
-            if (cpl >= 3) buf[off + 2] = b;
-            for (uint8_t ch = 3; ch < cpl; ch++) buf[off + ch] = 0;
-        }
-    }
-};
-
-} // namespace mm
diff --git a/src/light/effects/ColorTrailsEffect.h b/src/light/effects/ColorTrailsEffect.h
index 703b1ff4..1e39af31 100644
--- a/src/light/effects/ColorTrailsEffect.h
+++ b/src/light/effects/ColorTrailsEffect.h
@@ -18,6 +18,11 @@ namespace mm {
 // effect that runs and one that does not. Reach for the solver when the medium itself is the
 // subject, and for this when the subject is color being carried.
 //
+// The two tiers are Jeff's own arrangement, not our contrast with him: his FlowFields repo carries
+// this separable flow and a full Stam solver (pressure, divergence, vorticity confinement) as
+// sibling flows behind one dispatch table. So "no fluid mechanics" describes THIS flow, not his
+// work.
+//
 // Four pieces, each a power function:
 //
 //   - `inoise16` sampled along one axis fills the two profiles, so the flow drifts and reverses on
@@ -30,10 +35,21 @@ namespace mm {
 // The plane is 16-bit for the reason every transport effect here is: a value multiplied by slightly
 // less than one, many times a second, either dies early or never fades at 8 bits.
 //
-// Credit: Stefan Petrick, whose concept this is, and Jeff (mindful_stone / 4wheeljive), whose
-// ColorTrails in AuroraPortal is the composition it follows, by way of MoonLight:
-// https://github.com/4wheeljive/AuroraPortal/blob/main/src/programs/colorTrails_detail.hpp
+// Credit: Stefan Petrick, whose concept this is (Jeff credits him for the emitter/flow split too),
+// and Jeff (mindful_stone / 4wheeljive), whose ColorTrails is the composition it follows, by way of
+// MoonLight. The work has since moved out of AuroraPortal, where the file this was ported from no
+// longer exists, into its own repo:
+// https://github.com/4wheeljive/FlowFields/blob/main/src/flows/flow_noise.h
+// (the version ported here is AuroraPortal at 91ce0c6861, src/programs/colorTrails_detail.hpp).
 // The separable-noise-advection idea is theirs; the kernels underneath are this project's.
+//
+// Two differences from his, deliberate but worth knowing if output is ever compared. His advection
+// is TWO passes over a temporary: the second samples the already-x-sheared buffer, so the y-shear
+// reads a displaced row. Ours fuses them, reading both offsets from the undisplaced source, which
+// is sequential composition against simultaneous: visually close, a different operator. And he
+// floors the per-line shift at 0.3 to "prevent pure cardinal motion", because a profile passing
+// through zero collapses the flow to a plain horizontal or vertical slide; a low `flow` here can
+// reach that state.
 // @card ColorTrailsEffect.png
 /// Effect: color emitters carried by a flow made of two noise profiles, one per axis.
 class ColorTrailsEffect : public EffectBase {
@@ -54,6 +70,12 @@ class ColorTrailsEffect : public EffectBase {
     uint8_t size        = 128;  // orbit radius, and the Lissajous figure's reach
     uint8_t mode        = static_cast<uint8_t>(Mode::All);
 
+    /// Which wind carries the color. `Noise` is the separable two-profile flow this effect is
+    /// named for; `Radial` is a current running out from the center (or into it), computed per
+    /// pixel from geometry rather than sampled, so it costs no field and no state.
+    enum class Flow : uint8_t { Noise = 0, Radial, RadialIn };
+    uint8_t flowType = static_cast<uint8_t>(Flow::Noise);
+
     void defineControls() override {
         controls_.addControl("speed", speed, 0, 255);
         controls_.addControl("flow", flow, 0, 255);
@@ -63,6 +85,7 @@ class ColorTrailsEffect : public EffectBase {
         controls_.addControl("colorSpeed", colorSpeed, 0, 255);
         controls_.addControl("size", size, 0, 255);
         controls_.addSelect("mode", mode, kModes, 4);
+        controls_.addSelect("flowType", flowType, kFlows, 3);
     }
 
     void prepare() override {
@@ -115,14 +138,42 @@ class ColorTrailsEffect : public EffectBase {
         // The two shears, applied as one advection: a light's source is offset horizontally by its
         // ROW's profile and vertically by its COLUMN's. Doing both in one backward sample is what
         // keeps this to a single pass, where the original takes two and a temporary buffer.
-        const int32_t* xp = xProf_.data();
-        const int32_t* yp = yProf_.data();
-        draw::advect16(dst.data(), src.data(), w, h, d,
-                       [xp, yp](lengthType x, lengthType y, lengthType,
-                                draw::pos_t& vx, draw::pos_t& vy) {
-                           vx = static_cast<draw::pos_t>(yp[y]);
-                           vy = static_cast<draw::pos_t>(xp[x]);
-                       }, draw::Edge::Wrap);
+        const Flow f = static_cast<Flow>(flowType);
+        if (f == Flow::Noise) {
+            const int32_t* xp = xProf_.data();
+            const int32_t* yp = yProf_.data();
+            draw::advect16(dst.data(), src.data(), w, h, d,
+                           [xp, yp](lengthType x, lengthType y, lengthType,
+                                    draw::pos_t& vx, draw::pos_t& vy) {
+                               vx = static_cast<draw::pos_t>(yp[y]);
+                               vy = static_cast<draw::pos_t>(xp[x]);
+                           }, draw::Edge::Wrap);
+        } else {
+            // RADIAL. Every cell moves along the line through the center, so the direction is the
+            // normalized offset from it and needs no field and no state: dividing dx and dy by the
+            // distance is the whole computation. The sign is what makes it a fountain or a drain.
+            //
+            // The edge is CLAMP rather than Wrap, unlike the noise flow: an outward current that
+            // wrapped would pour the rim straight back into the middle and the picture would never
+            // clear. Clamping lets it run off the edge, which is what an outward flow looks like.
+            const int32_t cx = w / 2, cy = h / 2;
+            const int32_t reach = (static_cast<int32_t>(flow) * draw::kSubOne) / 24;
+            const int32_t sign = (f == Flow::Radial) ? 1 : -1;
+            draw::advect16(dst.data(), src.data(), w, h, d,
+                           [cx, cy, reach, sign](lengthType x, lengthType y, lengthType,
+                                                 draw::pos_t& vx, draw::pos_t& vy) {
+                               const int32_t dx = static_cast<int32_t>(x) - cx;
+                               const int32_t dy = static_cast<int32_t>(y) - cy;
+                               // isqrt of the squared distance, floored at 1 so the center cell
+                               // divides by something: it is the one place the direction is
+                               // undefined, and it stays put rather than dividing by zero.
+                               const int32_t r = static_cast<int32_t>(isqrt(
+                                   static_cast<uint32_t>(dx * dx + dy * dy)));
+                               const int32_t rr = r < 1 ? 1 : r;
+                               vx = static_cast<draw::pos_t>((dx * reach * sign) / rr);
+                               vy = static_cast<draw::pos_t>((dy * reach * sign) / rr);
+                           }, draw::Edge::Clamp);
+        }
         front_ = !front_;
         ScratchBuffer<uint16_t>& moved = front_ ? plane_ : scratch_;
 
@@ -133,6 +184,7 @@ class ColorTrailsEffect : public EffectBase {
 
 private:
     static constexpr const char* kModes[4] = {"All", "Orbital", "Lissajous", "Border"};
+    static constexpr const char* kFlows[3] = {"Noise", "Radial out", "Radial in"};
 
     uint32_t halfLifeMs() const {
         return 20u + static_cast<uint32_t>(persistence) * static_cast<uint32_t>(persistence) / 16u;
@@ -148,16 +200,38 @@ class ColorTrailsEffect : public EffectBase {
         // The shear scales with the grid: a fixed pixel count is a strong flow on a 16-wide panel
         // and an invisible one on a 256-wide, which is the same reasoning `fShift` carries upstream.
         const int32_t reach = (static_cast<int32_t>(flow) * (w < h ? w : h)) / 220;
+        // BREATHING. Each axis has its own slow multiplier on the shear, so the flow swells and
+        // eases instead of shearing at one rate forever. Jeff's version runs six such channels
+        // (his FlowFields modulator bank); two is the smallest form that gets the effect, because
+        // what sells it is the axes disagreeing, not the channel count. The rates are deliberately
+        // unequal and not a ratio of each other, so the pair never returns to the same phase.
+        //
+        // The DEPTH is bounded so the flow can breathe without stalling: his `minShift` exists
+        // because a profile passing through zero collapses the picture to a plain horizontal or
+        // vertical slide, and a multiplier that reaches zero does the same thing. 40% swing around
+        // 80% keeps it between 0.4 and 1.2 of the set reach.
+        const uint32_t mPhase = (now * static_cast<uint32_t>(flowSpeed)) / 96u;
+        const int32_t xBreath = 205 + (static_cast<int32_t>(sin16(static_cast<uint16_t>(mPhase * 7u))) * 102) / 32768;
+        const int32_t yBreath = 205 + (static_cast<int32_t>(sin16(static_cast<uint16_t>(mPhase * 5u + 21845u))) * 102) / 32768;
+        const int32_t xReach = (reach * xBreath) / 256;
+        const int32_t yReach = (reach * yBreath) / 256;
+        // The axes are detuned in BOTH space and time, which is Stefan's own tuning rather than a
+        // guess: his rig's sliders sit at scale 0.33 against 0.32 and speed -1.73 against -1.72,
+        // near-equal but never equal. Equal rates let the two profiles lock into one pattern and
+        // the picture slides along a diagonal; unequal ones drift through each other, so the flow
+        // keeps rearranging itself. The ratios below are his, in integers: 32/33 and 172/173.
         const uint32_t cells = static_cast<uint32_t>(scale) * 24u;
+        const uint32_t cellsY = (cells * 32u) / 33u;
+        const uint32_t phaseY = (phase * 172u) / 173u;
         for (lengthType x = 0; x < w; x++) {
             const int32_t n = static_cast<int32_t>(inoise16(static_cast<uint32_t>(x) * cells, phase, 0)) - 32768;
-            xProf_[static_cast<size_t>(x)] = (n * reach * draw::kSubOne) / 32768 / 16;
+            xProf_[static_cast<size_t>(x)] = (n * xReach * draw::kSubOne) / 32768 / 16;
         }
         for (lengthType y = 0; y < h; y++) {
             // A different offset into the field, so the two axes are decoupled: one field read for
             // both would rise and fall together and slide the whole picture along a diagonal.
-            const int32_t n = static_cast<int32_t>(inoise16(static_cast<uint32_t>(y) * cells, phase, 32768)) - 32768;
-            yProf_[static_cast<size_t>(y)] = (n * reach * draw::kSubOne) / 32768 / 16;
+            const int32_t n = static_cast<int32_t>(inoise16(static_cast<uint32_t>(y) * cellsY, phaseY, 32768)) - 32768;
+            yProf_[static_cast<size_t>(y)] = (n * yReach * draw::kSubOne) / 32768 / 16;
         }
     }
 
diff --git a/src/light/effects/EffectBase.h b/src/light/effects/EffectBase.h
index b11fd668..566c2310 100644
--- a/src/light/effects/EffectBase.h
+++ b/src/light/effects/EffectBase.h
@@ -131,9 +131,23 @@ class EffectBase : public MoonModule {
     void setPan(nrOfLightsType index, uint8_t value);
     void setTilt(nrOfLightsType index, uint8_t value);
     void setZoom(nrOfLightsType index, uint8_t value);
+    /// The beam's own two roles, on the fixtures that carry them. `rotate` spins the gobo or the
+    /// prism; `gobo` selects the pattern, and on most heads its byte is a RANGE per slot rather
+    /// than an index, so a fixture's manual decides what a value means.
+    ///
+    /// Same contract as the aim setters above: a no-op where the channel is absent, and never
+    /// scaled by brightness. They complete the motion set the preset model already carries
+    /// (FixtureChannels holds all five), which until now had no way for an effect to reach them.
+    void setRotate(nrOfLightsType index, uint8_t value);
+    void setGobo(nrOfLightsType index, uint8_t value);
 
     /// True when the lights carry pan or tilt, so an effect can skip motion maths on a strip.
     bool movable() const;
+
+    /// True when the lights carry a gobo or rotate channel, so an effect can hide beam controls
+    /// that would do nothing on this rig. Separate from movable(): plenty of heads pan and tilt
+    /// without a gobo wheel, and a static wash can carry one without moving at all.
+    bool hasBeam() const;
 };
 
 } // namespace mm
diff --git a/src/light/effects/FixedPointEffect.h b/src/light/effects/FixedPointEffect.h
new file mode 100644
index 00000000..cd151793
--- /dev/null
+++ b/src/light/effects/FixedPointEffect.h
@@ -0,0 +1,601 @@
+#pragma once
+// Sub-pixel geometry: shapes placed between pixels rather than on them.
+//
+// The point of this effect is a demonstration of a technique, not a picture. On a 16x16 panel a
+// clock hand drawn on whole pixels jumps a full pixel at a time and reads as broken; the same hand
+// placed at a fractional position and antialiased moves smoothly, because a pixel's BRIGHTNESS
+// carries the fraction its position cannot. Everything here is built from that one idea, so a small
+// matrix gets motion a whole-pixel renderer cannot express at any framerate.
+//
+// The shapes come from draw.h's sub-pixel family (`disc`, `ring`, `strokeLine`, `line`), which work
+// in the 24.8 `pos_t` the whole draw layer speaks. Nothing here computes coverage itself.
+//
+// Concept and the original fixed-point canvas demos: Sutaburosu, in FastLED, via MoonLight
+// (E_FastLED.h, "Fixed-Point Canvas Demo").
+
+#include "core/math16.h"           // sin16, cos16, BeatPhase
+#include "light/Palette.h"         // hsvToRgb: the trail's rainbow
+#include "light/effects/EffectBase.h"
+
+namespace mm {
+
+/// Effect: sub-pixel shapes, drawn between pixels so small panels move smoothly.
+class FixedPointEffect : public EffectBase {
+public:
+    // 💫 for the origin (this came from MoonLight), 🖌️ because every shape is computed from a
+    // position rather than accumulated. The original's 🕐🆕 were MoonLight's own convention and say
+    // nothing in ours: a tag here answers what a module IS, its shape, where it came from, what it
+    // reacts to, or which power function it rides, and the UI has a tooltip for each.
+    const char* tags() const override { return "💫🖌️"; }
+    Dim dimensions() const override { return Dim::D2; }
+
+    /// Which demonstration, or `all` to cycle them. Each shows the same property from a different
+    /// angle: the clock through ROTATION, the orbits through RADIUS, and the two curve demos
+    /// through a PATH, where a trail of joined points is only smooth if its points are.
+    enum : uint8_t { kAll = 0, kClock, kOrbits, kStarWeb, kSpirograph, kLissajous,
+                     kCubeThin, kCubeThick, kWalkers, kBoids, kHypotrochoid, kTree, kDemoCount };
+    static constexpr const char* kDemoNames[] = {
+        "all", "clock", "orbits", "star web", "spirograph", "lissajous",
+        "cube thin", "cube thick", "walkers", "boids", "hypotrochoid", "tree"};
+    static constexpr uint8_t kCycled = kDemoCount - 1;   // how many `all` rotates through
+
+    uint8_t demo = kAll;
+    /// How fast the whole scene runs, in BPM like every other effect here.
+    uint8_t bpm = 20;
+    /// How much of the previous frame survives. The trails are what make the motion legible: at 255
+    /// the shapes are crisp, and lower values leave the path they swept.
+    uint8_t fade = 70;
+    /// Seconds each demo holds before `all` moves to the next.
+    uint8_t dwell = 12;
+    /// How far the whole scene drifts from the panel's center, in pixels. The original orbits its
+    /// origin rather than pinning it, which keeps a static figure from burning one spot into the
+    /// eye; 0 pins it.
+    uint8_t drift = 2;
+    /// The CAMERA, and the reason the clock swings across the screen rather than sitting still.
+    /// The original pushes in toward the second hand's tip on a 20 second sine, so the face grows
+    /// and slides off-center at the peak and settles back. 0 holds the camera still.
+    uint8_t zoom = 150;
+
+    void defineControls() override {
+        controls_.addSelect("demo", demo, kDemoNames, kDemoCount);
+        controls_.addControl("bpm", bpm, 1, 120);
+        controls_.addControl("fade", fade, 0, 255);
+        controls_.addControl("dwell", dwell, 2, 60);
+        controls_.addControl("drift", drift, 0, 8);
+        controls_.addControl("zoom", zoom, 0, 255);
+        // `dwell` only means something while the demos are cycling.
+        controls_.setHidden(controls_.count() - 2, demo != kAll);
+    }
+
+    void prepare() override {
+        phase_ = BeatPhase{};
+        trailCount_ = 0;
+        trailHead_ = 0;
+        shown_ = 0xFF;
+    }
+
+    void tick() MM_NONBLOCKING override {
+        const draw::Canvas cv = canvas();
+        const lengthType w = width(), h = height();
+        if (w == 0 || h == 0) return;
+
+        // Fade rather than fill: these shapes are thin, and a hard clear would throw away the trail
+        // that makes a sweep readable. It still OWNS its background, since fade 255 clears fully.
+        //
+        // NOT layer()->fadeToBlackBy, though every other fading effect uses it and this one should
+        // too. The two mean different things: draw::fade takes an amount applied EVERY FRAME,
+        // fadeToBlackBy a RATE per reference frame that Layer scales by elapsed time and carries.
+        // Swapping the call without retuning `fade` (default 70, tuned against the per-frame
+        // meaning) made this effect 3.1x brighter at high framerate than at low, against a 1.35x
+        // band: unit_Effects_framerate caught it. The move is right and wants its own change, with
+        // the default re-tuned and the result looked at, not a silent swap. Backlogged.
+        draw::fade(cv, fade);
+
+        const uint32_t ms = elapsed();
+        phase_.advanceTo(ms, bpm);
+        const angle16 a = static_cast<angle16>(phase_.phase(65536));
+
+        // Which demo is on screen. `all` walks them on a wall clock rather than on the phase, so
+        // the dwell is a time a user can set in seconds and does not change with bpm.
+        uint8_t active = demo;
+        if (demo == kAll) {
+            const uint32_t slot = dwell ? dwell : 1;
+            active = static_cast<uint8_t>((ms / (slot * 1000u)) % kCycled + 1);
+        }
+        // A changed demo starts from a clean trail: the curve demos share one point buffer, and
+        // carrying a spirograph's points into a lissajous draws a line between two unrelated
+        // figures across the panel.
+        if (active != shown_) {
+            trailCount_ = 0;
+            trailHead_ = 0;
+            shown_ = active;
+            variant_++;                       // a different rosette each time hypotrochoid returns
+            seedSimulations(draw::toSub(w) / 2, draw::toSub(h) / 2);
+        }
+
+        // The panel's center, and the drifting origin the scene actually uses. Its own slow circle
+        // (a third of the main rate) so the drift reads as a wander rather than as part of the
+        // figure's own motion.
+        const draw::pos_t px = draw::toSub(w) / 2;
+        const draw::pos_t py = draw::toSub(h) / 2;
+        const draw::pos_t wander = draw::toSub(drift);
+        const angle16 slow = static_cast<angle16>(a / 3);
+        const draw::pos_t cx = px + scaleAngle(cos16(slow), wander);
+        const draw::pos_t cy = py + scaleAngle(sin16(slow), wander);
+        // The radius leaves room for the drift, so a wandering figure stays on the panel.
+        const draw::pos_t r = (px < py ? px : py) - wander - draw::toSub(1);
+        if (r <= 0) return;
+
+        // THE CAMERA. The original pushes in toward the second hand's tip on a 20 second sine, and
+        // this is what makes the scene sweep across the panel rather than sit in the middle: at the
+        // peak the view is magnified AND off-center, so the figure slides out and grows. A camera
+        // that only scaled would pulse in place, which is a different and much duller thing.
+        draw::pos_t vx = cx, vy = cy, vr = r;
+        if (zoom > 0) {
+            const angle16 zp = static_cast<angle16>((static_cast<uint64_t>(ms % kZoomMs) * 65536u) / kZoomMs);
+            const int32_t zs = sin16(zp);
+            if (zs > 0) {
+                // Only the positive half of the sine pushes in, so the scene rests at normal size
+                // for half the cycle instead of oscillating continuously.
+                const int32_t amount = (zs * zoom) / 255;              // 0..32767
+                // Track the second hand's tip, which is the point the original follows.
+                const angle16 secA = static_cast<angle16>((static_cast<uint64_t>(ms % kSecMs) * 65536u) / kSecMs);
+                const draw::pos_t tipX = cx + scaleAngle(sin16(secA), r);
+                const draw::pos_t tipY = cy - scaleAngle(cos16(secA), r);
+                // Screen = center + (world - camera) * zoom, with the camera lerped toward the tip.
+                const draw::pos_t camX = cx + static_cast<draw::pos_t>((static_cast<int64_t>(tipX - cx) * amount) / 32767);
+                const draw::pos_t camY = cy + static_cast<draw::pos_t>((static_cast<int64_t>(tipY - cy) * amount) / 32767);
+                const int32_t mag = 65536 + (amount * 3);              // up to ~2.5x, as the original
+                vx = cx + static_cast<draw::pos_t>((static_cast<int64_t>(cx - camX) * mag) >> 16);
+                vy = cy + static_cast<draw::pos_t>((static_cast<int64_t>(cy - camY) * mag) >> 16);
+                vr = static_cast<draw::pos_t>((static_cast<int64_t>(r) * mag) >> 16);
+            }
+        }
+
+        switch (active) {
+            case kClock:        drawClock(cv, vx, vy, vr, ms); break;
+            case kOrbits:       drawOrbits(cv, vx, vy, vr, a); break;
+            case kStarWeb:      drawStarWeb(cv, vx, vy, vr, a); break;
+            case kSpirograph:   drawSpirograph(cv, vx, vy, vr, a); break;
+            case kLissajous:    drawLissajous(cv, vx, vy, vr, a); break;
+            case kCubeThin:     drawCube(cv, vx, vy, vr, a, true); break;
+            case kCubeThick:    drawCube(cv, vx, vy, vr, a, false); break;
+            case kWalkers:      drawWalkers(cv, vx, vy, vr); break;
+            case kBoids:        drawBoids(cv, vx, vy, vr); break;
+            case kHypotrochoid: drawHypotrochoid(cv, vx, vy, vr, a); break;
+            default:            drawTree(cv, vx, vy, vr, ms); break;
+        }
+    }
+
+private:
+    /// A clock face: a rim, twelve tick marks and three hands on real gearing.
+    ///
+    /// The hands run on FIXED PERIODS from the millisecond clock rather than from `bpm`, which is
+    /// how the original does it and the reason it reads as a clock: a second hand that sweeps once
+    /// per period is recognizable, where one geared to an arbitrary speed control is just three
+    /// rotating sticks. Accelerated 10x from a real clock so a second completes in 6 seconds, and
+    /// the 1:12:144 ratio between the three is preserved exactly.
+    void drawClock(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r,
+                   uint32_t ms) const {
+        // angle16 wraps at 65536, so a period maps onto it by plain modulo: no trigonometry needed
+        // to advance a hand, which is what keeps this integer-only.
+        const angle16 secA  = static_cast<angle16>((static_cast<uint64_t>(ms % kSecMs) * 65536u) / kSecMs);
+        const angle16 minA  = static_cast<angle16>((static_cast<uint64_t>(ms % kMinMs) * 65536u) / kMinMs);
+        const angle16 hourA = static_cast<angle16>((static_cast<uint64_t>(ms % kHourMs) * 65536u) / kHourMs);
+
+        draw::ring(cv, cx, cy, r, draw::kSubOne, RGB{40, 40, 40});
+
+        // Twelve marks, every third one longer and brighter: the hour positions a face needs to be
+        // read at a glance, and without them the ring is just a circle.
+        for (uint8_t i = 0; i < 12; i++) {
+            const angle16 ta = static_cast<angle16>(static_cast<uint32_t>(i) * 65536u / 12u);
+            const bool major = (i % 3) == 0;
+            const draw::pos_t inner = major ? (r * 72) / 100 : (r * 82) / 100;
+            const RGB c = major ? RGB{200, 200, 200} : RGB{80, 80, 80};
+            draw::line(cv, {draw::toPixel(cx + scaleAngle(sin16(ta), inner)),
+                            draw::toPixel(cy - scaleAngle(cos16(ta), inner)), 0},
+                           {draw::toPixel(cx + scaleAngle(sin16(ta), r)),
+                            draw::toPixel(cy - scaleAngle(cos16(ta), r)), 0}, c);
+        }
+
+        // Hour hand: thick and short. Minute: medium and nearly full. The lengths are the
+        // original's 0.55 / 0.80 / 1.0 of the radius, which is what makes the three readable at a
+        // glance rather than three sticks of similar size.
+        hand(cv, cx, cy, (r * 55) / 100, hourA, (draw::kSubOne * 5) / 2, RGB{200, 200, 200});
+        hand(cv, cx, cy, (r * 80) / 100, minA,  (draw::kSubOne * 3) / 2, RGB{255, 255, 255});
+        // Second hand: a thin red line with a short counterbalance tail past the hub, which is what
+        // a real sweep hand has and what makes its rotation legible at this size.
+        const draw::pos_t tail = r / 4;
+        draw::line(cv, {draw::toPixel(cx - scaleAngle(sin16(secA), tail)),
+                        draw::toPixel(cy + scaleAngle(cos16(secA), tail)), 0},
+                       {draw::toPixel(cx + scaleAngle(sin16(secA), r)),
+                        draw::toPixel(cy - scaleAngle(cos16(secA), r)), 0}, RGB{255, 40, 40});
+        draw::disc(cv, cx, cy, draw::kSubOne, RGB{220, 220, 220});   // the hub, over the pivots
+    }
+
+    /// Rings orbiting a common center, each on its own radius and rate: the second view of the same
+    /// property, where what moves smoothly is a SIZE rather than an angle.
+    void drawOrbits(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r,
+                    angle16 a) const {
+        static constexpr RGB kColors[kOrbitCount] = {
+            {255, 80, 40}, {40, 200, 255}, {180, 255, 60}, {255, 60, 200}};
+        for (uint8_t i = 0; i < kOrbitCount; i++) {
+            // Each orbit runs at its own rate and starts a quarter turn further round, so the four
+            // never bunch into one moving blob.
+            const angle16 own = static_cast<angle16>(a * (i + 1) + i * 16384);
+            const draw::pos_t dist = (r * (i + 1)) / (kOrbitCount + 1);
+            const draw::pos_t ox = cx + scaleAngle(cos16(own), dist);
+            const draw::pos_t oy = cy + scaleAngle(sin16(own), dist);
+            // The ring BREATHES: its radius is a second oscillator, which is the sub-pixel case a
+            // whole-pixel renderer cannot show at all, because a radius under one pixel is either
+            // absent or a full pixel with nothing between.
+            const draw::pos_t rad = draw::kSubOne + scaleAngle(sin16(static_cast<angle16>(own * 2)),
+                                                               draw::kSubOne);
+            draw::ring(cv, ox, oy, rad, draw::kSubOne, kColors[i]);
+        }
+    }
+
+    /// A spirograph: a pen on a wheel rolling inside a larger circle. The classic hypotrochoid, and
+    /// the figure only closes when the two rates share a small ratio, which is why 3:2 draws a
+    /// stable rosette rather than a smear.
+    void drawSpirograph(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r,
+                        angle16 a) {
+        const draw::pos_t arm = (r * 2) / 3;                    // how far the wheel's hub sits out
+        const draw::pos_t pen = r / 3;                          // the pen's reach from that hub
+        const draw::pos_t hx = cx + scaleAngle(cos16(a), arm);
+        const draw::pos_t hy = cy + scaleAngle(sin16(a), arm);
+        // 3:2 against the hub's own rotation: the ratio IS the figure, and a whole-number one keeps
+        // it closed instead of precessing away.
+        const angle16 roll = static_cast<angle16>(a * 3 / 2);
+        pushTrail(hx + scaleAngle(cos16(roll), pen), hy - scaleAngle(sin16(roll), pen));
+        drawTrail(cv, 220);
+    }
+
+    /// A Lissajous figure: two perpendicular oscillators at 3:2, with the phase drifting so the
+    /// figure morphs rather than repeating. Two sines are all it is, which is the point: the shape
+    /// comes from the RATIO, not from anything drawn.
+    void drawLissajous(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r,
+                       angle16 a) {
+        // The phase creep is what turns a fixed figure into a morphing one. Slow, because at any
+        // speed the eye can follow it stops reading as one continuous shape.
+        const angle16 creep = static_cast<angle16>(a / 16);
+        pushTrail(cx + scaleAngle(sin16(static_cast<angle16>(a * 3 + creep)), r),
+                  cy + scaleAngle(sin16(static_cast<angle16>(a * 2)), r));
+        drawTrail(cv, 230);
+    }
+
+    /// A pentagram inside two rings: five vertices, each joined to its second neighbor. The star
+    /// is what the 5-and-2 pairing draws, and the inner ring sits at the golden-ratio radius the
+    /// pentagon's own geometry produces.
+    void drawStarWeb(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r,
+                     angle16 a) const {
+        const draw::pos_t innerR = (r * 382) / 1000;      // the inner pentagon's radius
+        draw::ring(cv, cx, cy, r, draw::kSubOne * 2, RGB{0, 0, 255});
+        draw::ring(cv, cx, cy, innerR, draw::kSubOne, RGB{0, 60, 120});
+
+        draw::pos_t px[kStarPoints], py[kStarPoints];
+        for (uint8_t i = 0; i < kStarPoints; i++) {
+            const angle16 va = static_cast<angle16>(a + static_cast<uint32_t>(i) * 65536u / kStarPoints);
+            px[i] = cx + scaleAngle(cos16(va), r);
+            py[i] = cy + scaleAngle(sin16(va), r);
+        }
+        // The stroke PULSES on a third harmonic, which is what keeps a static figure alive.
+        const draw::pos_t thick = draw::kSubOne + scaleAngle(sin16(static_cast<angle16>(a * 3)),
+                                                             (draw::kSubOne * 3) / 4);
+        for (uint8_t i = 0; i < kStarPoints; i++) {
+            const uint8_t j = static_cast<uint8_t>((i + 2) % kStarPoints);   // the second neighbor
+            draw::strokeLine(cv, px[i], py[i], px[j], py[j], thick, RGB{220, 220, 180});
+            draw::line(cv, {draw::toPixel(cx), draw::toPixel(cy), 0},
+                           {draw::toPixel(px[i]), draw::toPixel(py[i]), 0}, RGB{60, 60, 60});
+        }
+        for (uint8_t i = 0; i < kStarPoints; i++)
+            draw::disc(cv, px[i], py[i], (draw::kSubOne * 3) / 2, RGB{255, 255, 0});
+        draw::disc(cv, cx, cy, draw::kSubOne * 2, RGB{255, 165, 0});
+    }
+
+    /// A wireframe cube in perspective, spun on two axes. The depth cue is BRIGHTNESS (and, when
+    /// thick, stroke width): a near edge is bright and wide, a far one dim and thin, which is what
+    /// makes eight points and twelve lines read as a solid rather than as a flat tangle.
+    void drawCube(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r,
+                  angle16 a, bool thin) const {
+        static constexpr int8_t kVerts[8][3] = {
+            {-1, -1, -1}, {1, -1, -1}, {1, 1, -1}, {-1, 1, -1},
+            {-1, -1,  1}, {1, -1,  1}, {1, 1,  1}, {-1, 1,  1}};
+        static constexpr uint8_t kEdges[12][2] = {
+            {0, 1}, {1, 2}, {2, 3}, {3, 0}, {4, 5}, {5, 6}, {6, 7}, {7, 4},
+            {0, 4}, {1, 5}, {2, 6}, {3, 7}};
+        // The thin cube is drawn larger, since a hairline needs the size to read.
+        const draw::pos_t side = thin ? (r * 11) / 13 : (r * 7) / 13;
+        const draw::pos_t eye = r * 2;             // the eye distance, which sets the perspective
+
+        // Two rates that do not divide each other, so the cube tumbles instead of rocking.
+        const int32_t cosY = cos16(a), sinY = sin16(a);
+        const int32_t cosX = cos16(static_cast<angle16>(a * 38 / 100)), sinX = sin16(static_cast<angle16>(a * 38 / 100));
+
+        draw::pos_t px[8], py[8];
+        int32_t pz[8];
+        for (uint8_t i = 0; i < 8; i++) {
+            const int64_t x = static_cast<int64_t>(kVerts[i][0]) * side;
+            const int64_t y = static_cast<int64_t>(kVerts[i][1]) * side;
+            const int64_t z = static_cast<int64_t>(kVerts[i][2]) * side;
+            const int64_t x2 = (x * cosY - z * sinY) / 32767;
+            const int64_t z2 = (x * sinY + z * cosY) / 32767;
+            const int64_t y3 = (y * cosX - z2 * sinX) / 32767;
+            const int64_t z3 = (y * sinX + z2 * cosX) / 32767;
+            // The perspective divide. Clamped so a vertex swinging toward the eye cannot divide by
+            // zero and fling the projection off the panel.
+            int64_t denom = eye - z3;
+            if (denom < draw::kSubOne) denom = draw::kSubOne;
+            px[i] = cx + static_cast<draw::pos_t>((x2 * eye) / denom);
+            py[i] = cy + static_cast<draw::pos_t>((y3 * eye) / denom);
+            pz[i] = static_cast<int32_t>(z3);
+        }
+        for (uint8_t e = 0; e < 12; e++) {
+            const uint8_t p = kEdges[e][0], q = kEdges[e][1];
+            const int32_t avgZ = (pz[p] + pz[q]) / 2;
+            int32_t br = 178 + (avgZ * 77) / (side ? side : 1);
+            if (br > 255) br = 255;
+            if (br < 0) br = 0;
+            const RGB col{static_cast<uint8_t>(br), static_cast<uint8_t>(br), static_cast<uint8_t>(br)};
+            if (thin) {
+                draw::line(cv, {draw::toPixel(px[p]), draw::toPixel(py[p]), 0},
+                               {draw::toPixel(px[q]), draw::toPixel(py[q]), 0}, col);
+            } else {
+                draw::pos_t thick = (draw::kSubOne * 9) / 5 + (avgZ * draw::kSubOne) / (side ? side : 1);
+                if (thick < draw::kSubOne / 2) thick = draw::kSubOne / 2;
+                draw::strokeLine(cv, px[p], py[p], px[q], py[q], thick, col);
+            }
+        }
+    }
+
+    /// Six walkers on a damped random walk, each pulled back by a weak spring so they wander
+    /// without escaping. The spring is what separates this from noise: without it they leave and
+    /// never return, with it they stay in a loose cloud around the middle.
+    void drawWalkers(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r) {
+        for (uint8_t i = 0; i < kWalkerCount; i++) {
+            // The kick is HASHED from a step counter, not drawn from a stream RNG: two devices on
+            // one rig must walk the same path, and a per-call RNG diverges the moment their frame
+            // counts differ (math16.h, position-addressable randomness).
+            const int32_t kx = static_cast<int32_t>(hashInt(step_, i, 1)) - 32768;
+            const int32_t ky = static_cast<int32_t>(hashInt(step_, i, 2)) - 32768;
+            const draw::pos_t ax = static_cast<draw::pos_t>((kx * draw::kSubOne) / 131072)
+                                 + static_cast<draw::pos_t>((static_cast<int64_t>(cx - wx_[i]) * 6) / 1000);
+            const draw::pos_t ay = static_cast<draw::pos_t>((ky * draw::kSubOne) / 131072)
+                                 + static_cast<draw::pos_t>((static_cast<int64_t>(cy - wy_[i]) * 6) / 1000);
+            wvx_[i] = static_cast<draw::pos_t>((static_cast<int64_t>(wvx_[i]) * 15) / 16) + ax;
+            wvy_[i] = static_cast<draw::pos_t>((static_cast<int64_t>(wvy_[i]) * 15) / 16) + ay;
+            const draw::pos_t cap = draw::kSubOne * 3;
+            if (wvx_[i] > cap) wvx_[i] = cap;
+            if (wvx_[i] < -cap) wvx_[i] = -cap;
+            if (wvy_[i] > cap) wvy_[i] = cap;
+            if (wvy_[i] < -cap) wvy_[i] = -cap;
+            wx_[i] += wvx_[i];
+            wy_[i] += wvy_[i];
+            draw::disc(cv, wx_[i], wy_[i], draw::kSubOne * 2,
+                       hsvToRgb(static_cast<uint8_t>(whue_[i]), 230, 255));
+            whue_[i]++;
+        }
+        (void)r;
+        step_++;
+    }
+
+    /// Boids: separation, alignment and cohesion, the textbook three rules, plus a soft wall force.
+    /// The flock's shape is emergent, which is the point: nothing here says "make a V".
+    void drawBoids(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r) {
+        const draw::pos_t margin = draw::kSubOne * 3;
+        for (uint8_t i = 0; i < kBoidCount; i++) {
+            draw::pos_t ax = 0, ay = 0;
+            // Soft walls: a push that grows as a boid nears the edge, rather than a bounce, so the
+            // flock turns smoothly instead of ricocheting.
+            const draw::pos_t left = bx_[i] - (cx - r), right = (cx + r) - bx_[i];
+            const draw::pos_t top = by_[i] - (cy - r), bottom = (cy + r) - by_[i];
+            if (left < margin) ax += (margin - left) / 8;
+            if (right < margin) ax -= (margin - right) / 8;
+            if (top < margin) ay += (margin - top) / 8;
+            if (bottom < margin) ay -= (margin - bottom) / 8;
+
+            draw::pos_t sepX = 0, sepY = 0, aliX = 0, aliY = 0, cohX = 0, cohY = 0;
+            uint8_t neighbors = 0;
+            for (uint8_t j = 0; j < kBoidCount; j++) {
+                if (j == i) continue;
+                const draw::pos_t dx = bx_[j] - bx_[i], dy = by_[j] - by_[i];
+                const draw::pos_t adx = dx < 0 ? -dx : dx, ady = dy < 0 ? -dy : dy;
+                if (adx < draw::kSubOne * 3 && ady < draw::kSubOne * 3) { sepX -= dx; sepY -= dy; }
+                if (adx < draw::kSubOne * 7 && ady < draw::kSubOne * 7) {
+                    aliX += bvx_[j]; aliY += bvy_[j];
+                    cohX += bx_[j];  cohY += by_[j];
+                    neighbors++;
+                }
+            }
+            ax += sepX / 16;
+            ay += sepY / 16;
+            if (neighbors > 0) {
+                ax += ((aliX / neighbors) - bvx_[i]) / 8 + ((cohX / neighbors) - bx_[i]) / 64;
+                ay += ((aliY / neighbors) - bvy_[i]) / 8 + ((cohY / neighbors) - by_[i]) / 64;
+            }
+            bvx_[i] = static_cast<draw::pos_t>((static_cast<int64_t>(bvx_[i] + ax) * 39) / 40);
+            bvy_[i] = static_cast<draw::pos_t>((static_cast<int64_t>(bvy_[i] + ay) * 39) / 40);
+            const draw::pos_t cap = draw::kSubOne * 2;
+            if (bvx_[i] > cap) bvx_[i] = cap;
+            if (bvx_[i] < -cap) bvx_[i] = -cap;
+            if (bvy_[i] > cap) bvy_[i] = cap;
+            if (bvy_[i] < -cap) bvy_[i] = -cap;
+            bx_[i] += bvx_[i];
+            by_[i] += bvy_[i];
+            // Drawn as a stroke along its own heading, so the flock shows which way it is going.
+            draw::strokeLine(cv, bx_[i] - bvx_[i] * 2, by_[i] - bvy_[i] * 2, bx_[i], by_[i],
+                             draw::kSubOne, hsvToRgb(static_cast<uint8_t>(bhue_[i]), 200, 255));
+        }
+    }
+
+    /// The general hypotrochoid: the spirograph with the wheel and pen sizes VARYING, so the figure
+    /// is a different rosette each cycle rather than the one fixed 3:2 curve.
+    void drawHypotrochoid(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r,
+                          angle16 a) {
+        // The original's table of (wheel, pen) pairs, each giving a distinct petal count.
+        static constexpr uint8_t kWheel[] = {5, 4, 6, 8, 9, 3};
+        static constexpr uint8_t kPen[]   = {8, 8, 7, 6, 6, 7};
+        static constexpr uint8_t kVariants = 6;
+        const uint8_t v = static_cast<uint8_t>((hashInt(variant_) % kVariants));
+        const draw::pos_t arm = (r * (13 - kWheel[v])) / 13;
+        const draw::pos_t pen = (r * kPen[v]) / 13;
+        const draw::pos_t hx = cx + scaleAngle(cos16(a), arm);
+        const draw::pos_t hy = cy + scaleAngle(sin16(a), arm);
+        // The wheel's own rotation is geared to how far it has rolled: (R-r)/r turns per turn.
+        const angle16 roll = static_cast<angle16>(static_cast<uint32_t>(a) * (13 - kWheel[v]) / kWheel[v]);
+        // Pre-fill on the first frame, as the original does: without it the figure spends its first
+        // second drawing itself one segment at a time, and on a short dwell it never completes.
+        if (trailCount_ == 0)
+            for (uint8_t i = 0; i < kTrailMax; i++) {
+                const angle16 back = static_cast<angle16>(a - (kTrailMax - i) * kCurveStep);
+                const angle16 br = static_cast<angle16>(static_cast<uint32_t>(back) * (13 - kWheel[v]) / kWheel[v]);
+                pushTrail(cx + scaleAngle(cos16(back), arm) + scaleAngle(cos16(br), pen),
+                          cy + scaleAngle(sin16(back), arm) - scaleAngle(sin16(br), pen));
+            }
+        pushTrail(hx + scaleAngle(cos16(roll), pen), hy - scaleAngle(sin16(roll), pen));
+        drawTrail(cv, 200);
+    }
+
+    /// A tree drawn by recursion: a trunk that forks into two shorter branches, each of which forks
+    /// again. Six levels, swaying on a wind cycle and growing on a slower one, so it is never the
+    /// same picture twice.
+    void drawTree(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t r,
+                  uint32_t ms) const {
+        // Wind on a 9 second cycle, growth on a 10 second one: two periods that do not divide, so
+        // the tree never repeats a pose exactly.
+        const angle16 windP = static_cast<angle16>((static_cast<uint64_t>(ms % 9000u) * 65536u) / 9000u);
+        const int32_t sway = (sin16(windP) * 3932) / 32767;
+        const angle16 growP = static_cast<angle16>((static_cast<uint64_t>(ms % 10000u) * 65536u) / 10000u);
+        // (1 - cos)/2 grows smoothly from nothing to full and back, with no corner at either end.
+        const int32_t grow = (32767 - cos16(growP)) / 2;
+        // The spread opens over the FIRST HALF of the growth, so the trunk rises before it forks.
+        int32_t spreadScale = grow * 2;
+        if (spreadScale > 32767) spreadScale = 32767;
+        const int32_t spread = (5100 * spreadScale) / 32767;      // up to ~28 degrees in angle16
+
+        const draw::pos_t trunkY = cy + (r * 99) / 100;
+        // A FLOOR under the growth: the cycle bottoms out at zero, and a tree of zero length is a
+        // blank panel that reads as a broken effect rather than as a seed. A quarter-height trunk
+        // is still visibly a trunk, and the growth above it is what the cycle shows.
+        const int32_t grown = 8192 + (grow * 3) / 4;      // a quarter, plus three quarters of the cycle
+        const draw::pos_t trunkLen = static_cast<draw::pos_t>((static_cast<int64_t>(r) * 55 * grown) / (100 * 32767));
+        branch(cv, cx, trunkY, 0, trunkLen, 6, sway, spread);
+    }
+
+    /// One branch, and its two children. Recursive because a tree IS the recursion: the same shape
+    /// at a smaller scale, which is why six lines of code draw sixty-three branches.
+    void branch(const draw::Canvas& cv, draw::pos_t x0, draw::pos_t y0, int32_t angle,
+                draw::pos_t len, uint8_t depth, int32_t sway, int32_t spread) const {
+        if (depth == 0 || len < draw::kSubOne / 2) return;
+        // The sway accumulates with depth, so a tip moves further than the trunk, which is what
+        // wind actually does to a tree.
+        const int32_t a = angle + sway * depth;
+        const draw::pos_t x1 = x0 + scaleAngle(sin16(static_cast<angle16>(a)), len);
+        const draw::pos_t y1 = y0 - scaleAngle(cos16(static_cast<angle16>(a)), len);
+        // Brown at the trunk to green at the tips, by depth.
+        const uint8_t g = static_cast<uint8_t>(60 + (6 - depth) * 30);
+        draw::line(cv, {draw::toPixel(x0), draw::toPixel(y0), 0},
+                       {draw::toPixel(x1), draw::toPixel(y1), 0},
+                   RGB{static_cast<uint8_t>(120 - depth * 10), g, 40});
+        const draw::pos_t childLen = (len * 7) / 10;
+        branch(cv, x1, y1, a - spread, childLen, static_cast<uint8_t>(depth - 1), sway, spread);
+        branch(cv, x1, y1, a + spread, childLen, static_cast<uint8_t>(depth - 1), sway, spread);
+    }
+
+    /// Place the walkers and boids for a fresh run. Spread by HASH rather than by a stream RNG,
+    /// for the same reason the walkers' kicks are: two devices showing one rig must agree.
+    void seedSimulations(draw::pos_t cx, draw::pos_t cy) {
+        for (uint8_t i = 0; i < kWalkerCount; i++) {
+            wx_[i] = cx; wy_[i] = cy;
+            wvx_[i] = 0; wvy_[i] = 0;
+            whue_[i] = static_cast<uint8_t>(i * 43);      // hues about 60 degrees apart
+        }
+        for (uint8_t i = 0; i < kBoidCount; i++) {
+            bx_[i] = cx + static_cast<draw::pos_t>((static_cast<int32_t>(hashInt(variant_, i, 3)) - 32768) / 8);
+            by_[i] = cy + static_cast<draw::pos_t>((static_cast<int32_t>(hashInt(variant_, i, 4)) - 32768) / 8);
+            bvx_[i] = static_cast<draw::pos_t>((static_cast<int32_t>(hashInt(variant_, i, 5)) - 32768) / 128);
+            bvy_[i] = static_cast<draw::pos_t>((static_cast<int32_t>(hashInt(variant_, i, 6)) - 32768) / 128);
+            bhue_[i] = static_cast<uint8_t>(i * 36);
+        }
+    }
+
+    /// Remember one pen position. A ring buffer, because the trail is a fixed-length window over an
+    /// endless path: the oldest point falls off as the newest arrives.
+    void pushTrail(draw::pos_t x, draw::pos_t y) {
+        trailX_[trailHead_] = x;
+        trailY_[trailHead_] = y;
+        trailHead_ = static_cast<uint8_t>((trailHead_ + 1) % kTrailMax);
+        if (trailCount_ < kTrailMax) trailCount_++;
+    }
+
+    /// Join the remembered points, oldest dark to newest bright. The gradient is what gives the
+    /// curve a direction: a uniformly lit trail reads as a static wire figure.
+    void drawTrail(const draw::Canvas& cv, uint8_t saturation) const {
+        if (trailCount_ < 2) return;
+        for (uint8_t i = 0; i + 1 < trailCount_; i++) {
+            // Walk from the OLDEST point, which is the one the head is about to overwrite.
+            const uint8_t start = static_cast<uint8_t>((trailHead_ + kTrailMax - trailCount_) % kTrailMax);
+            const uint8_t p = static_cast<uint8_t>((start + i) % kTrailMax);
+            const uint8_t q = static_cast<uint8_t>((p + 1) % kTrailMax);
+            const uint8_t br = static_cast<uint8_t>((static_cast<uint16_t>(i) * 255u) / (trailCount_ - 1));
+            // Hue and brightness both ride the age, so the trail fades out as it goes back in time
+            // and the newest segment is both brightest and furthest round the wheel.
+            draw::strokeLine(cv, trailX_[p], trailY_[p], trailX_[q], trailY_[q], draw::kSubOne,
+                             hsvToRgb(br, saturation, br));
+        }
+    }
+
+    /// One hand: a thick stroke from the hub outward at `a`. Its own function because the three
+    /// differ only in length, angle and weight, and three copies would be three places to fix.
+    void hand(const draw::Canvas& cv, draw::pos_t cx, draw::pos_t cy, draw::pos_t len, angle16 a,
+              draw::pos_t thickness, RGB c) const {
+        // Twelve o'clock is UP, and up is -y on a light grid: a hand at angle 0 must point at the
+        // top of the panel, not at the right edge, which is where the raw cos/sin pair puts it.
+        const draw::pos_t tx = cx + scaleAngle(sin16(a), len);
+        const draw::pos_t ty = cy - scaleAngle(cos16(a), len);
+        draw::strokeLine(cv, cx, cy, tx, ty, thickness, c);
+    }
+
+    /// A signed 16-bit wave scaled to a sub-pixel distance. sin16 returns -32767..32767, so this is
+    /// the one place the wave's range meets the draw layer's units.
+    static draw::pos_t scaleAngle(int32_t wave, draw::pos_t distance) {
+        return static_cast<draw::pos_t>((wave * static_cast<int64_t>(distance)) / 32767);
+    }
+
+    /// The clock's periods, accelerated 10x from a real clock so a second hand sweeps in 6
+    /// seconds: the original's kSecPeriod / kMinPeriod / kHrPeriod, in the same 1:12:144 ratio.
+    static constexpr uint32_t kZoomMs = 20000u;   ///< the camera push-in cycle
+    static constexpr uint32_t kSecMs  = 6000u;
+    static constexpr uint32_t kMinMs  = 72000u;
+    static constexpr uint32_t kHourMs = 864000u;
+
+    static constexpr uint8_t kOrbitCount = 4;
+    static constexpr uint16_t kCurveStep = 512;    ///< how far a pre-filled trail steps back per point
+    static constexpr uint8_t kStarPoints = 5;      ///< a pentagram: 5 vertices, joined 2 apart
+    static constexpr uint8_t kWalkerCount = 6;
+    static constexpr uint8_t kBoidCount = 7;
+    /// The trail window. 64 points is enough for a rosette to close visibly while costing 512 bytes
+    /// of members, which a small ESP32 can carry without a heap allocation.
+    static constexpr uint8_t kTrailMax = 64;
+
+    BeatPhase phase_;
+    draw::pos_t trailX_[kTrailMax] = {};
+    draw::pos_t trailY_[kTrailMax] = {};
+    uint8_t trailHead_ = 0;
+    uint8_t trailCount_ = 0;
+    uint8_t shown_ = 0xFF;      ///< which demo drew last, so a switch can clear the trail
+
+    /// The simulation demos keep their own state between frames, which is what makes them
+    /// simulations rather than functions of time. Seeded on a demo switch, since a walker starting
+    /// wherever the last one stopped is a visible jump.
+    draw::pos_t wx_[kWalkerCount] = {}, wy_[kWalkerCount] = {};
+    draw::pos_t wvx_[kWalkerCount] = {}, wvy_[kWalkerCount] = {};
+    uint8_t whue_[kWalkerCount] = {};
+    draw::pos_t bx_[kBoidCount] = {}, by_[kBoidCount] = {};
+    draw::pos_t bvx_[kBoidCount] = {}, bvy_[kBoidCount] = {};
+    uint8_t bhue_[kBoidCount] = {};
+    uint32_t step_ = 0;         ///< hashed for the walkers' kicks, so two devices walk alike
+    uint32_t variant_ = 0;      ///< which hypotrochoid, rolled when the demo restarts
+};
+
+} // namespace mm
diff --git a/src/light/effects/MovingHeadEffect.h b/src/light/effects/MovingHeadEffect.h
index 79c35cf7..43580d4b 100644
--- a/src/light/effects/MovingHeadEffect.h
+++ b/src/light/effects/MovingHeadEffect.h
@@ -55,6 +55,18 @@ class MovingHeadEffect : public EffectBase {
     uint8_t panCenter  = 128;
     uint8_t tiltCenter = 128;
 
+    /// The beam itself, on a head that has these wheels. Both are raw fixture bytes rather than a
+    /// count of slots: a gobo channel is a range per pattern on most heads and every model splits
+    /// it differently, so only the fixture's manual can say what a value selects. Left where they
+    /// are on a fixture without the channel, and invisible on a rig that has neither.
+    uint8_t gobo   = 0;
+    uint8_t rotate = 0;
+    /// Change gobo on a bass hit rather than holding one pattern all night, the one thing a static
+    /// value cannot do. Idea from MoonLight's Troy1 Move, which rolls a new pattern on a kick and
+    /// then refuses to roll again for a few seconds: without that hold a busy track strobes through
+    /// patterns too fast to read as anything.
+    bool goboOnBeat = false;
+
     /// Move and light with the music: the beam swings wider as the room gets louder, each head
     /// brightens on its own frequency band, and a beat kicks the whole rig. Silence holds it still,
     /// which is what makes the mode read as reactive rather than merely animated.
@@ -69,12 +81,27 @@ class MovingHeadEffect : public EffectBase {
         controls_.addControl("panCenter", panCenter, 0, 255);
         controls_.addControl("tiltCenter", tiltCenter, 0, 255);
         controls_.addControl("audioReactive", audioReactive);
+        // Offered only where a head carries the wheels: on an LED strip, or a head without them,
+        // the writes are no-ops and the sliders would be three controls that do nothing.
+        controls_.addControl("gobo", gobo, 0, 255);
+        controls_.addControl("rotate", rotate, 0, 255);
+        controls_.addControl("goboOnBeat", goboOnBeat);
+        const bool noBeam = !hasBeam();
+        const uint8_t last = controls_.count();
+        controls_.setHidden(last - 3, noBeam);   // gobo
+        controls_.setHidden(last - 2, noBeam);   // rotate
+        controls_.setHidden(last - 1, noBeam);   // goboOnBeat
     }
 
     void prepare() override {
         pan_ = BeatPhase{};
         tilt_ = BeatPhase{};
         beatDecay_ = 0;
+        // The rolled gobo starts from the slider, so a rig comes back on the pattern the user
+        // chose rather than whatever a beat left behind before the last restart.
+        goboNow_ = gobo;
+        goboHoldUntil_ = 0;
+        beatCount_ = 0;
     }
 
     void tick() MM_NONBLOCKING override {
@@ -98,15 +125,43 @@ class MovingHeadEffect : public EffectBase {
 
         // Audio is read ONCE per frame, not per head: the spectrum is the same for all of them,
         // and a per-head read would be the same work times the rig size.
-        const AudioFrame* audio = audioReactive ? AudioService::latestFrame() : nullptr;
+        // Either feature needs it: goboOnBeat detects beats from the same frame, so reading only
+        // when audioReactive is on left that control doing nothing at all with audio off.
+        const AudioFrame* audio = (audioReactive || goboOnBeat) ? AudioService::latestFrame() : nullptr;
         const bool live = audio && audio->levelSmoothed >= kSilence;
 
         // A beat widens the sweep and flares the color, then decays over ~20 frames. Without the
         // decay a kick is a single-frame flicker that no eye can follow.
-        if (live && audio->level > audio->levelSmoothed + kBeatMargin) beatDecay_ = 255;
+        const bool beat = live && audio->level > audio->levelSmoothed + kBeatMargin;
+        if (beat) beatDecay_ = 255;
         else if (beatDecay_ > kBeatDecayStep) beatDecay_ = static_cast<uint8_t>(beatDecay_ - kBeatDecayStep);
         else beatDecay_ = 0;
 
+        // A beat rolls a new gobo, but only after a HOLD: a pattern needs a few seconds on screen
+        // to read as a pattern, and a four-to-the-floor kick would otherwise change it four times a
+        // second into a flicker. `gobo` is the base the roll walks from, so the slider still says
+        // which family of patterns the rig is in.
+        if (goboOnBeat) {
+            if (beat && static_cast<int32_t>(elapsed() - goboHoldUntil_) >= 0) {
+                // hashInt of a BEAT COUNTER, not a stream RNG: two devices running the same rig
+                // must land on the same pattern, and a per-call RNG diverges forever the moment one
+                // of them renders an extra frame (math16.h, position-addressable randomness).
+                beatCount_++;
+                // Clamped, not wrapped: gobo is a user control reaching 255, and adding a slot
+                // offset of up to 224 to it wrapped a high setting round to a low wheel position.
+                const uint16_t slot = static_cast<uint16_t>(gobo) + (hashInt(beatCount_) & 0xE0);
+                goboNow_ = static_cast<uint8_t>(slot > 255 ? 255 : slot);   // 8 coarse slots
+                // A DEADLINE IN MILLISECONDS, not a frame count. 120 frames is two seconds at
+                // 60 fps and half a second at 240, so the hold shortened as the device got
+                // faster: the same rule every other timed thing here follows (elapsed(), the
+                // shared clock). Subtraction-based so it is safe across the millis() rollover.
+                goboHoldUntil_ = elapsed() + kGoboHoldMs;
+            }
+        } else {
+            goboNow_ = gobo;      // the slider IS the value when the beat roll is off
+            goboHoldUntil_ = 0;
+        }
+
         // Loud music opens the beam to its full range, quiet keeps it tight. In silence the rig
         // HOLDS its aim rather than drifting.
         const uint16_t loud = live ? audio->levelSmoothed : 0;
@@ -119,6 +174,11 @@ class MovingHeadEffect : public EffectBase {
             const Formation f = shape(hx, hy, hz, w, h, d);
 
 
+            // The beam wheels, written every frame like any other role so a value the user changes
+            // takes effect at once. Both are no-ops on a fixture without the channel.
+            setGobo(i, goboNow_);
+            setRotate(i, rotate);
+
             // A frozen rig keeps its last aim: writing from a stopped phase would snap it back.
             if (!frozen) {
                 const int32_t p = sin16(static_cast<uint16_t>(panPhase + f.phase));
@@ -159,6 +219,9 @@ class MovingHeadEffect : public EffectBase {
     static constexpr uint16_t kBeatMargin    = 8;   // raw over smoothed = a transient
     static constexpr uint8_t  kBeatDecayStep = 12;  // ~20 frames from a kick back to rest
     static constexpr uint8_t  kDimFloor      = 40;  // a quiet band still shows its head
+    /// How long a rolled gobo stays put, in frames. About two seconds at 60 fps: long enough to
+    /// read the pattern, short enough that the rig still answers the music.
+    static constexpr uint32_t kGoboHoldMs = 2000;   // the documented two seconds
 
     /// One head's place in the formation: a phase offset into the sweep, and a direction.
     struct Formation { uint16_t phase; int32_t dir; };
@@ -235,6 +298,11 @@ class MovingHeadEffect : public EffectBase {
     BeatPhase pan_;
     BeatPhase tilt_;
     uint8_t   beatDecay_ = 0;
+    /// The gobo actually written, which is the slider until a beat rolls it. Held separate so the
+    /// slider keeps saying what the user chose rather than being overwritten by the roll.
+    uint8_t   goboNow_   = 0;
+    uint32_t goboHoldUntil_ = 0;   ///< elapsed() past which a new gobo may be rolled
+    uint32_t  beatCount_ = 0;   // hashed for the roll: shared by every device on the same audio
 };
 
 } // namespace mm
diff --git a/src/light/layers/Layer.h b/src/light/layers/Layer.h
index 11cb31e7..2243befc 100644
--- a/src/light/layers/Layer.h
+++ b/src/light/layers/Layer.h
@@ -751,7 +751,23 @@ inline void EffectBase::setTilt(nrOfLightsType index, uint8_t value) {
 inline void EffectBase::setZoom(nrOfLightsType index, uint8_t value) {
     effectSetChannel(layer(), index, layer()->fixtureChannels().zoom, value);
 }
+inline void EffectBase::setRotate(nrOfLightsType index, uint8_t value) {
+    effectSetChannel(layer(), index, layer()->fixtureChannels().rotate, value);
+}
+inline void EffectBase::setGobo(nrOfLightsType index, uint8_t value) {
+    effectSetChannel(layer(), index, layer()->fixtureChannels().gobo, value);
+}
 inline bool EffectBase::movable() const { return layer()->fixtureChannels().movable(); }
+inline bool EffectBase::hasBeam() const {
+    // Null-checked, unlike the accessors above, because this one is called from defineControls():
+    // /api/types and /api/modules build a PARENTLESS probe instance to read an effect's control set
+    // (ModuleFactory::registerType), and a bare layer() there dereferences null. An unparented
+    // effect has no fixture, so it has no beam.
+    const Layer* l = layer();
+    if (!l) return false;
+    const FixtureChannels& fc = l->fixtureChannels();
+    return fc.gobo != FixtureChannels::kAbsent || fc.rotate != FixtureChannels::kAbsent;
+}
 inline nrOfLightsType EffectBase::nrOfLights() const { return layer()->buffer().count(); }
 inline uint32_t EffectBase::elapsed() const { return layer()->elapsed(); }
 inline draw::Canvas EffectBase::canvas() {
diff --git a/src/light/layouts/Rings241Layout.h b/src/light/layouts/Rings241Layout.h
index e8909548..79febe8a 100644
--- a/src/light/layouts/Rings241Layout.h
+++ b/src/light/layouts/Rings241Layout.h
@@ -45,10 +45,19 @@ class Rings241Layout : public LayoutBase {
     // Wiring order: false = light 0 at the center, rings outward (MoonLight's
     // order); true = light 0 on the outer ring, rings inward.
     bool outside_in = false;   // "outside in"
+    // Where light 0 of each ring sits, in degrees from the bottom. Named for
+    // RingLayout's control of the same meaning, NOT `rotation`: that word is
+    // taken in this family for the arc a partial ring spans, and one word with
+    // two meanings across two ring layouts is worse than a longer name. A disc
+    // is soldered with its first LED wherever the builder started, so without
+    // this the image is fixed against the hardware. 0 keeps MoonLight's
+    // placement, which is why it is the default.
+    uint16_t angleFirst = 0;
 
     void defineControls() override {
         controls_.addControl("scale", scale, 1, 10);
         controls_.addControl("outside in", outside_in);
+        controls_.addControl("angleFirst", angleFirst, 0, 359);
     }
 
     nrOfLightsType lightCount() const override {
@@ -79,10 +88,14 @@ class Rings241Layout : public LayoutBase {
                 float x = static_cast<float>(scale * leftMargin);
                 float y = static_cast<float>(scale * leftMargin);
                 if (n != 1) {
-                    // angleFirst = 0, so RingLayout's angleRad = π + 2π·i / n.
+                    // RingLayout's angleRad = π + 2π·i / n + 2π·angleFirst / 360.
                     // Formed in double (MoonLight's PI/TWO_PI are double macros),
-                    // then narrowed to float for the float sinf/cosf below.
-                    const float angleRad = static_cast<float>(kPi + (kTwoPi * static_cast<double>(i)) / static_cast<double>(n));
+                    // then narrowed to float for the float sinf/cosf below. The
+                    // angleFirst term rides in the same double expression so an
+                    // angleFirst of 0 is bit-identical to MoonLight's placement.
+                    const float angleRad = static_cast<float>(
+                        kPi + (kTwoPi * static_cast<double>(i)) / static_cast<double>(n)
+                            + (kTwoPi * static_cast<double>(angleFirst)) / 360.0);
                     x -= scale * std::sin(angleRad) * radius;
                     y += scale * std::cos(angleRad) * radius;
                 }
diff --git a/src/light/moonlive/MoonLiveBuiltins_light.h b/src/light/moonlive/MoonLiveBuiltins_light.h
index 0ed4468e..91bc6c9c 100644
--- a/src/light/moonlive/MoonLiveBuiltins_light.h
+++ b/src/light/moonlive/MoonLiveBuiltins_light.h
@@ -385,7 +385,9 @@ struct CoordSink { CoordFn fn = nullptr; void* ctx = nullptr; };
 using PalFn = void (*)(void* ctx, uint8_t index, uint8_t r, uint8_t g, uint8_t b);
 struct PalSink { PalFn fn = nullptr; void* ctx = nullptr; };
 
-enum class MotionAxis : uint8_t { Pan = 0, Tilt = 1 };
+/// The five fixture roles, in the order FixtureChannels declares them. One sink and one host
+/// function serve all of them, which is why the enum grows rather than each role adding its own.
+enum class MotionAxis : uint8_t { Pan = 0, Tilt = 1, Zoom = 2, Rotate = 3, Gobo = 4 };
 using MotionFn = void (*)(void* ctx, MotionAxis axis, uint32_t index, uint8_t value);
 struct MotionSink { MotionFn fn = nullptr; void* ctx = nullptr; };
 
@@ -997,7 +999,7 @@ extern "C" inline uint32_t mm_light_onBeat(const uintptr_t*, uint32_t, const uin
     return a->level > a->levelSmoothed + kBeatMargin ? 1 : 0;
 }
 
-/// setPan(index, value) / setTilt(index, value) → aim one moving head.
+/// setPan / setTilt / setZoom / setRotate / setGobo (index, value) → aim and shape one head.
 ///
 /// A NO-OP when the light carries no such channel, which is the property that lets one script run
 /// on a moving head and on an LED strip: the strip has no pan channel, nothing is written, and the
@@ -1008,23 +1010,32 @@ extern "C" inline uint32_t mm_light_onBeat(const uintptr_t*, uint32_t, const uin
 /// from the layer's fixture channel map, and the engine has no notion of one. Motion is written
 /// once per HEAD per frame where color is written per pixel, so the per-call cost is not on the
 /// same path as setRGB's.
-extern "C" inline uint32_t mm_light_set_pan(const uintptr_t* args, uint32_t, const uint8_t*) {
+/// The one body all five role builtins share: they differ only in which axis they name, and five
+/// copies of this would be five places for the byteArg rule below to rot.
+///
+/// byteArg, not a raw widen: a script computing an aim below zero (pan - 50 past the end)
+/// reinterprets as a huge unsigned here and clamps to 255, slamming the head to the OPPOSITE
+/// extreme. byteArg is the one home for the signed reading every other builtin uses.
+inline uint32_t motionWrite(MotionAxis axis, const uintptr_t* args) {
     const MotionSink& m = motionSink();
     if (!m.fn) return 0;
-    // byteArg, not a raw widen: a script computing an aim below zero (pan - 50 past the
-    // end) reinterprets as a huge unsigned here and clamped to 255, slamming the head to the
-    // OPPOSITE extreme. byteArg is the one home for the signed reading every other builtin uses.
-    m.fn(m.ctx, MotionAxis::Pan, uint32_t(args[0]), byteArg(args[1]));
+    m.fn(m.ctx, axis, uint32_t(args[0]), byteArg(args[1]));
     return 0;
 }
+extern "C" inline uint32_t mm_light_set_pan(const uintptr_t* args, uint32_t, const uint8_t*) {
+    return motionWrite(MotionAxis::Pan, args);
+}
 extern "C" inline uint32_t mm_light_set_tilt(const uintptr_t* args, uint32_t, const uint8_t*) {
-    const MotionSink& m = motionSink();
-    if (!m.fn) return 0;
-    // byteArg, not a raw widen: a script computing an aim below zero (pan - 50 past the
-    // end) reinterprets as a huge unsigned here and clamped to 255, slamming the head to the
-    // OPPOSITE extreme. byteArg is the one home for the signed reading every other builtin uses.
-    m.fn(m.ctx, MotionAxis::Tilt, uint32_t(args[0]), byteArg(args[1]));
-    return 0;
+    return motionWrite(MotionAxis::Tilt, args);
+}
+extern "C" inline uint32_t mm_light_set_zoom(const uintptr_t* args, uint32_t, const uint8_t*) {
+    return motionWrite(MotionAxis::Zoom, args);
+}
+extern "C" inline uint32_t mm_light_set_rotate(const uintptr_t* args, uint32_t, const uint8_t*) {
+    return motionWrite(MotionAxis::Rotate, args);
+}
+extern "C" inline uint32_t mm_light_set_gobo(const uintptr_t* args, uint32_t, const uint8_t*) {
+    return motionWrite(MotionAxis::Gobo, args);
 }
 
 /// pool(n) → size this script's particle pool to n particles, and report what it actually got.
@@ -1360,7 +1371,7 @@ inline const BuiltinTable& lightBuiltins() {
     t.add({"flowCurl", 2, false, BuiltinKind::Call, &mm_light_flowCurl, {}});
     t.add({"trailDecay", 1, false, BuiltinKind::Call, &mm_light_trailDecay, {}});
     t.add({"emitTrail", 6, false, BuiltinKind::Call, &mm_light_emitTrail, {}});
-    // setPan(index, value) / setTilt(index, value) → aim a moving head. Calls, not Inline stores:
+    // setPan / setTilt / setZoom / setRotate / setGobo → aim a head. Calls, not Inline stores:
     // the channel offset comes from the layer's fixture map, which the engine cannot see.
     // The audio vocabulary. All return 0 without audio, so a script written for a rig with a
     // microphone still runs on one without: it simply renders nothing rather than failing.
@@ -1377,6 +1388,12 @@ inline const BuiltinTable& lightBuiltins() {
     t.add({"audioBeat", 0, /*returns*/ true, BuiltinKind::Call, &mm_light_onBeat, {}});
     t.add({"setPan", 2, /*returns*/ false, BuiltinKind::Call, &mm_light_set_pan, {}});
     t.add({"setTilt", 2, /*returns*/ false, BuiltinKind::Call, &mm_light_set_tilt, {}});
+    // The rest of the fixture roles, same shape and same no-op-where-absent contract. A head that
+    // carries a zoom, a gobo wheel or a prism is aimed AND shaped from a script, which is what a
+    // moving-head look needs beyond pan and tilt.
+    t.add({"setZoom", 2, /*returns*/ false, BuiltinKind::Call, &mm_light_set_zoom, {}});
+    t.add({"setRotate", 2, /*returns*/ false, BuiltinKind::Call, &mm_light_set_rotate, {}});
+    t.add({"setGobo", 2, /*returns*/ false, BuiltinKind::Call, &mm_light_set_gobo, {}});
     // pool(n)                → size this script's particle pool, from defineControls(). Returns the
     // count actually available, 0 when the allocation failed. See mm_light_pool.
     t.add({"pool", 1, /*returns*/ true, BuiltinKind::Call, &mm_light_pool, {}});
diff --git a/src/light/moonlive/MoonLiveEffect.h b/src/light/moonlive/MoonLiveEffect.h
index 197bc7dc..c96ae5ad 100644
--- a/src/light/moonlive/MoonLiveEffect.h
+++ b/src/light/moonlive/MoonLiveEffect.h
@@ -121,15 +121,20 @@ class MoonLiveEffect : public EffectBase {
         moonlive::setFadeSink([](void* ctx, uint8_t amt) {
             if (Layer* l = static_cast<MoonLiveEffect*>(ctx)->layer()) l->fadeToBlackBy(amt);
         }, this);
-        // setPan/setTilt reach the fixture's motion channels, whose offsets live in the layer's
+        // The role setters reach the fixture's motion channels, whose offsets live in the layer's
         // channel map. Routed through EffectBase's own setters, so a script aims a head by exactly
         // the path a compiled effect does, including the no-op on a light that has no such channel.
         moonlive::setMotionSink([](void* ctx, moonlive::MotionAxis axis, uint32_t index,
                                    uint8_t value) {
             auto* self = static_cast<MoonLiveEffect*>(ctx);
             const auto i = static_cast<nrOfLightsType>(index);
-            if (axis == moonlive::MotionAxis::Pan) self->setPan(i, value);
-            else                                   self->setTilt(i, value);
+            switch (axis) {
+                case moonlive::MotionAxis::Pan:    self->setPan(i, value);    break;
+                case moonlive::MotionAxis::Tilt:   self->setTilt(i, value);   break;
+                case moonlive::MotionAxis::Zoom:   self->setZoom(i, value);   break;
+                case moonlive::MotionAxis::Rotate: self->setRotate(i, value); break;
+                case moonlive::MotionAxis::Gobo:   self->setGobo(i, value);   break;
+            }
         }, this);
         // The particle builtins reach this effect's own pool, with the frame scale the binding
         // computed: framerate independence is the system's property, not the script author's.
diff --git a/src/light/moonlive/MoonLiveScript.h b/src/light/moonlive/MoonLiveScript.h
index b354c211..5777435c 100644
--- a/src/light/moonlive/MoonLiveScript.h
+++ b/src/light/moonlive/MoonLiveScript.h
@@ -29,7 +29,17 @@ class MoonLiveScript {
     /// editor the position it marks the failing line from: the errors hardest to read were exactly
     /// the ones that lost their explanation AND their highlight. Public because a unit test pins it
     /// against the compiler's own messages, which is what stops the two drifting apart again.
-    static constexpr size_t kMaxStatus = 72;
+    /// Sized from the WORST line the code can produce, which the status-fits test recomputes from
+    /// the compiler's own diagnostics: the longest message (62), the longer of the two shadow marks
+    /// with its ": " (34), and the machine-read " @<offset>" suffix (8). At 72 the suffix was what
+    /// fell off, and the editor silently stopped marking the failing line.
+    static constexpr size_t kMaxStatus = 112;
+    /// What the status says when the user's copy is hiding a shipped one (`scriptShadowsFactory`).
+    /// One constant because the status-fits test budgets its length against kMaxStatus.
+    static constexpr const char* kShadowMark = "edited copy";
+    /// Said instead of kShadowMark when the shipped copy has moved on since the fork: the one
+    /// sentence that turns "why is my edit being used" into "the library has a newer version".
+    static constexpr const char* kStaleMark = "edited copy, shipped one updated";
 
     /// Let a binding that owns a particle pool size it from the script's defineControls(). Null for
     /// a binding with no particles, which is every binding but the effect today.
@@ -99,6 +109,12 @@ class MoonLiveScript {
             // the one budget it is closest to using up. The card's memory figure is the ALLOCATION,
             // word-rounded, which says nothing about the program itself.
             engine_.describe(statusBuf_, sizeof(statusBuf_));
+            // Name a SHADOW when there is one, on success as much as on failure: the copy that
+            // compiled is the user's, and a push to the shipped one will change nothing on screen.
+            if (shadowMark()) {
+                const size_t n = std::strlen(statusBuf_);
+                std::snprintf(statusBuf_ + n, sizeof(statusBuf_) - n, ", %s", shadowMark());
+            }
             owner.setStatus(statusBuf_, MoonModule::Severity::Status);
             compileFailed_ = false;
         } else {
@@ -107,9 +123,20 @@ class MoonLiveScript {
             // control for the number would be a field every non-scripted module carries for nothing.
             // The suffix is machine-read, so it stays a fixed shape rather than a sentence.
             if (engine_.hasErrorPos()) {
-                std::snprintf(statusBuf_, sizeof(statusBuf_), "%s @%u",
-                              err ? err : "compile failed",
-                              static_cast<unsigned>(engine_.errorPos()));
+                // The shadow marker goes in FRONT: the `@<offset>` suffix is machine-read and must
+                // stay last, and the offset only makes sense against the copy that was compiled.
+                // Suffix FIRST, message into what is left: a message too long for the buffer
+                // loses its tail, never the offset the editor parses.
+                char at[12];
+                std::snprintf(at, sizeof(at), " @%u", static_cast<unsigned>(engine_.errorPos()));
+                const size_t room = sizeof(statusBuf_) - std::strlen(at) - 1;
+                const char* mark = shadowMark();
+                int n = std::snprintf(statusBuf_, room + 1, "%s%s%s",
+                                      mark ? mark : "", mark ? ": " : "",
+                                      err ? err : "compile failed");
+                if (n < 0) n = 0;
+                if (static_cast<size_t>(n) > room) n = static_cast<int>(room);
+                std::snprintf(statusBuf_ + n, sizeof(statusBuf_) - static_cast<size_t>(n), "%s", at);
                 owner.setStatus(statusBuf_, MoonModule::Severity::Error);
             } else {
                 owner.setStatus(err, MoonModule::Severity::Error);
@@ -271,6 +298,14 @@ class MoonLiveScript {
     const char* tags_ = nullptr;
     // Backing store for the status line: MoonModule::setStatus keeps a POINTER, so the text has to
     // outlive the call. The same module-owned pattern NetworkModule uses.
+    /// Which shadow note this script's status should carry, or null when the file being compiled is
+    /// the only copy of it. Asked on every compile (a cold path), and asked ONCE per status line so
+    /// the success and failure branches cannot drift into saying different things.
+    const char* shadowMark() const {
+        if (!moonlive::scriptShadowsFactory(name_)) return nullptr;
+        return moonlive::scriptFactoryMovedOn(name_) ? kStaleMark : kShadowMark;
+    }
+
     char     statusBuf_[kMaxStatus] = {};
     // The script's FILE NAME, inside the shared script directory. Empty on a fresh card: it reports
     // "no script" until one is named, rather than every new module compiling the same default.
diff --git a/src/light/moonlive/MoonLiveScriptFile.h b/src/light/moonlive/MoonLiveScriptFile.h
index f7c3516c..646436f3 100644
--- a/src/light/moonlive/MoonLiveScriptFile.h
+++ b/src/light/moonlive/MoonLiveScriptFile.h
@@ -203,6 +203,124 @@ inline bool resolveScript(const char* name, char* out, size_t outLen) {
     return true;
 }
 
+/// LINEAGE: the hash of the shipped copy a user's edit was forked FROM, kept beside the fork.
+///
+/// The fork itself cannot carry it. A script is user-facing text shown in the device's own editor,
+/// so a provenance line in the file would be visible, editable and lost on the first paste. A
+/// sidecar is the standard answer (a `.orig` next to a patched config), and hidden here for the
+/// same reason `/.moonlive` is: the File Manager does not show dot files unless asked.
+///
+/// It answers the one question the shadow marker cannot: has the SHIPPED copy moved since the fork
+/// was made? Without it, an edit and a stale leftover look identical forever, which is what let 29
+/// pre-`void tick()` copies sit on a bench P4 failing every compile with offsets into files nobody
+/// had written that day.
+inline void scriptLineagePath(const char* name, char* out, size_t outLen) {
+    std::snprintf(out, outLen, "%s/.%s.from", kScriptDir, name);
+}
+
+/// Record that the user's copy of `name` was forked from text hashing to `hash`.
+inline bool noteScriptLineage(const char* name, uint32_t hash) {
+    if (!name || !name[0]) return false;
+    char path[128];
+    scriptLineagePath(name, path, sizeof(path));
+    char text[16];
+    const int n = std::snprintf(text, sizeof(text), "%u", static_cast<unsigned>(hash));
+    return n > 0 && platform::fsWriteAtomic(path, text, static_cast<size_t>(n));
+}
+
+/// The hash a fork was made from, or false when no lineage was recorded (an older fork, or a script
+/// the user wrote themselves). Absent lineage means "cannot say", never "unchanged".
+inline bool scriptLineage(const char* name, uint32_t& out) {
+    if (!name || !name[0]) return false;
+    char path[128];
+    scriptLineagePath(name, path, sizeof(path));
+    char text[16] = {};
+    const int got = platform::fsRead(path, text, sizeof(text));
+    if (got <= 0) return false;
+    uint32_t v = 0;
+    for (int i = 0; i < got && text[i] >= '0' && text[i] <= '9'; i++)
+        v = v * 10u + static_cast<uint32_t>(text[i] - '0');
+    out = v;
+    return true;
+}
+
+/// True when the user's copy of `name` is HIDING a shipped one: both directories hold it, so the
+/// resolver above compiles the user's and every push to the factory copy is invisible. The binding
+/// says so in its status, because from outside the two cases look identical, and a stale user copy
+/// has twice been chased as a compiler bug: once as a control that never appeared, once as an
+/// old-syntax copy failing with offsets that matched nothing in the file just written.
+/// Record lineage for a just-written file, if it is a fork: a path in the user script directory
+/// naming a script the firmware also ships. Anything else (a config file, a user's own script, a
+/// write to the factory directory) is not a fork and is left alone.
+///
+/// Takes the WRITTEN path rather than a name, so the one caller is the write hook and no caller has
+/// to work out whether a write was a fork.
+inline void noteForkedFrom(const char* path) {
+    if (!path) return;
+    char prefix[64];
+    const int plen = std::snprintf(prefix, sizeof(prefix), "%s/", kScriptDir);
+    if (plen <= 0 || std::strncmp(path, prefix, static_cast<size_t>(plen)) != 0) return;
+    const char* name = path + plen;
+    if (!name[0] || std::strchr(name, '/') || name[0] == '.') return;   // nested, or our own sidecar
+
+    // A REVERT arrives here too: applyFileChanged fires on a delete as well as a write, and the
+    // fork is already gone by then. Drop the lineage with it, or a later fork of the same name
+    // would be compared against a hash from a fork that no longer exists.
+    char user[96];
+    std::snprintf(user, sizeof(user), "%s/%s", kScriptDir, name);
+    if (platform::fsSize(user) < 0) {
+        char side[128];
+        scriptLineagePath(name, side, sizeof(side));
+        platform::fsRemove(side);
+        return;
+    }
+
+    // Only when the fork is CREATED. Re-stamping on every save would mark the fork up to date with
+    // whatever the library holds at that moment, which silently erases the very thing the record
+    // exists to show: that the shipped copy moved while the user was not looking. Lineage is the
+    // point the fork BRANCHED from, and a branch point does not move.
+    uint32_t already = 0;
+    if (scriptLineage(name, already)) return;
+
+    char factory[96];
+    std::snprintf(factory, sizeof(factory), "%s/%s", kFactoryScriptDir, name);
+    const long size = platform::fsSize(factory);
+    if (size <= 0 || size > kScriptFileMax) return;                     // nothing shipped: not a fork
+    char* text = static_cast<char*>(platform::alloc(static_cast<size_t>(size) + 1));
+    if (!text) return;
+    const int got = platform::fsRead(factory, text, static_cast<size_t>(size) + 1);
+    if (got > 0) noteScriptLineage(name, scriptHash(text, static_cast<size_t>(got)));
+    platform::free(text);
+}
+
+/// True when the SHIPPED copy has changed since the user forked it: both files exist, a lineage
+/// was recorded, and the factory copy no longer hashes to what the fork was made from.
+///
+/// False when there is no lineage. An older fork, or a script the user wrote, cannot be compared,
+/// and claiming an update on a guess would send someone to discard work for nothing.
+inline bool scriptFactoryMovedOn(const char* name) {
+    uint32_t from = 0;
+    if (!scriptLineage(name, from)) return false;
+    char path[96];
+    std::snprintf(path, sizeof(path), "%s/%s", kFactoryScriptDir, name);
+    const long size = platform::fsSize(path);
+    if (size <= 0 || size > kScriptFileMax) return false;
+    char* text = static_cast<char*>(platform::alloc(static_cast<size_t>(size) + 1));
+    if (!text) return false;
+    const int got = platform::fsRead(path, text, static_cast<size_t>(size) + 1);
+    const bool moved = got > 0 && scriptHash(text, static_cast<size_t>(got)) != from;
+    platform::free(text);
+    return moved;
+}
+
+inline bool scriptShadowsFactory(const char* name) {
+    char path[96];
+    std::snprintf(path, sizeof(path), "%s/%s", kScriptDir, name);
+    if (platform::fsSize(path) < 0) return false;
+    std::snprintf(path, sizeof(path), "%s/%s", kFactoryScriptDir, name);
+    return platform::fsSize(path) >= 0;
+}
+
 /// The hash of `name`'s CURRENT text, without compiling it.
 ///
 /// Answers "has the file changed since I compiled it" for the cost of ONE read, which is what a
diff --git a/src/light/moonlive/script_catalog.h b/src/light/moonlive/script_catalog.h
index b7dda019..f3a136ea 100644
--- a/src/light/moonlive/script_catalog.h
+++ b/src/light/moonlive/script_catalog.h
@@ -14,7 +14,6 @@ namespace mm::moonlive {
 /// Every factory effect, by file name. They live in `moonlive/effects/`
 /// upstream and in the factory script directory on the device.
 constexpr const char* kEffectCatalog[] = {
-    "aim.mle",
     "aurora.mle",
     "ballpit.mle",
     "balls.mle",
@@ -30,6 +29,11 @@ constexpr const char* kEffectCatalog[] = {
     "gradient.mle",
     "lines.mle",
     "metal.mle",
+    "mh-aim.mle",
+    "mh-ambient.mle",
+    "mh-sweep.mle",
+    "mh-troy.mle",
+    "mh-wowi.mle",
     "nebula.mle",
     "noise.mle",
     "octopus.mle",
@@ -40,14 +44,14 @@ constexpr const char* kEffectCatalog[] = {
     "ripples.mle",
     "sparkle.mle",
     "spectrum.mle",
-    "sweep.mle",
+    "stadbeest-eyes.mle",
+    "stadbeest-legs.mle",
     "trails.mle",
 };
-constexpr size_t kEffectCatalogCount = 28;
+constexpr size_t kEffectCatalogCount = 33;
 /// What each effect above declares about itself, in the same order.
 /// A dimension of 0 means the script says nothing, so the DEVICE decides the default.
 constexpr unsigned char kEffectCatalogDim[] = {
-    1,
     3,
     2,
     2,
@@ -63,6 +67,11 @@ constexpr unsigned char kEffectCatalogDim[] = {
     3,
     2,
     2,
+    1,
+    1,
+    1,
+    1,
+    1,
     3,
     2,
     2,
@@ -73,12 +82,12 @@ constexpr unsigned char kEffectCatalogDim[] = {
     2,
     3,
     2,
-    1,
+    2,
+    2,
     3,
 };
 /// The emoji each declares, "" when it declares none.
 constexpr const char* kEffectCatalogTags[] = {
-    "💫🎯",
     "💫",
     "💫✨",
     "💫",
@@ -94,6 +103,11 @@ constexpr const char* kEffectCatalogTags[] = {
     "💫",
     "💫",
     "💫🖌️",
+    "💫🎯",
+    "🗼🎶🎯",
+    "💫🎯",
+    "🗼🎶🎯",
+    "🗼🎯",
     "💫🖌️",
     "💫",
     "💫🖌️",
@@ -104,7 +118,8 @@ constexpr const char* kEffectCatalogTags[] = {
     "💫",
     "💫",
     "💫🎶",
-    "💫🎯",
+    "💫🎶",
+    "💫🎶",
     "💫🖌️",
 };
 constexpr const char* kEffectFolder = "effects";   ///< its directory upstream
@@ -115,31 +130,40 @@ constexpr const char* kLayoutCatalog[] = {
     "diagonal.mll",
     "grid.mll",
     "lattice.mll",
+    "lightcrafter16.mll",
     "reversed-row.mll",
     "ring.mll",
     "rose.mll",
+    "se16.mll",
+    "sixteen-rings.mll",
     "two-rows.mll",
 };
-constexpr size_t kLayoutCatalogCount = 7;
+constexpr size_t kLayoutCatalogCount = 10;
 /// What each layout above declares about itself, in the same order.
 /// A dimension of 0 means the script says nothing, so the DEVICE decides the default.
 constexpr unsigned char kLayoutCatalogDim[] = {
     2,
     2,
     3,
+    2,
     1,
     2,
     2,
     2,
+    2,
+    2,
 };
 /// The emoji each declares, "" when it declares none.
 constexpr const char* kLayoutCatalogTags[] = {
     "💫",
     "💫",
     "💫",
+    "🚥",
     "💫",
     "💫",
     "💫",
+    "🚥",
+    "🚥",
     "💫",
 };
 constexpr const char* kLayoutFolder = "layouts";   ///< its directory upstream
@@ -219,6 +243,6 @@ constexpr const char* kPaletteCatalogTags[] = {
 };
 constexpr const char* kPaletteFolder = "palettes";   ///< its directory upstream
 
-constexpr size_t kCatalogCount = 46;   ///< every factory script, all roles
+constexpr size_t kCatalogCount = 54;   ///< every factory script, all roles
 
 } // namespace mm::moonlive
diff --git a/src/main.cpp b/src/main.cpp
index e9791b7c..018c14fd 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -22,6 +22,7 @@
 #include "light/effects/FluidEffect.h"
 #include "light/effects/NebulaEffect.h"
 #include "light/effects/NoiseEffect.h"
+#include "light/effects/FixedPointEffect.h"
 #include "light/effects/MovingHeadEffect.h"
 #include "light/effects/PacmanEffect.h"
 #include "light/effects/PlasmaEffect.h"
@@ -36,7 +37,6 @@
 #include "light/effects/RipplesEffect.h"
 #include "light/effects/LavaLampEffect.h"
 #include "light/effects/NetworkReceiveEffect.h"
-#include "light/effects/AudioVolumeEffect.h"
 #include "light/effects/RadialSpectrumEffect.h"
 #include "light/effects/VuMetersEffect.h"
 #include "light/effects/BeatRipplesEffect.h"
@@ -211,7 +211,6 @@ static void registerModuleTypes() {
     // Effects — registered alphabetically by display name (the picker + docs also sort
     // alphabetically; keeping this list sorted makes the three orders agree at a glance).
     mm::ModuleFactory::registerType<mm::AudioSpectrumEffect>("AudioSpectrumEffect", "light/effects.md#audiospectrum");
-    mm::ModuleFactory::registerType<mm::AudioVolumeEffect>("AudioVolumeEffect", "light/effects.md#audiovolume");
     mm::ModuleFactory::registerType<mm::RadialSpectrumEffect>("RadialSpectrumEffect", "light/effects.md#radialspectrum");
     mm::ModuleFactory::registerType<mm::VuMetersEffect>("VuMetersEffect", "light/effects.md#vumeters");
     mm::ModuleFactory::registerType<mm::BeatRipplesEffect>("BeatRipplesEffect", "light/effects.md#beatripples");
@@ -260,6 +259,7 @@ static void registerModuleTypes() {
     mm::ModuleFactory::registerType<mm::FireworksEffect>("FireworksEffect", "light/effects.md#fireworks");
     mm::ModuleFactory::registerType<mm::FishTankEffect>("FishTankEffect", "light/effects.md#fishtank");
     mm::ModuleFactory::registerType<mm::PacmanEffect>("PacmanEffect", "light/effects.md#pacman");
+    mm::ModuleFactory::registerType<mm::FixedPointEffect>("FixedPointEffect", "light/effects.md#fixedpoint");
     mm::ModuleFactory::registerType<mm::MovingHeadEffect>("MovingHeadEffect", "light/effects.md#movinghead");
     mm::ModuleFactory::registerType<mm::FlyingToastersEffect>("FlyingToastersEffect", "light/effects.md#flyingtoasters");
     mm::ModuleFactory::registerType<mm::SpaceInvadersEffect>("SpaceInvadersEffect", "light/effects.md#spaceinvaders");
diff --git a/src/platform/desktop/platform_desktop.cpp b/src/platform/desktop/platform_desktop.cpp
index 2f7ff402..7d8f0501 100644
--- a/src/platform/desktop/platform_desktop.cpp
+++ b/src/platform/desktop/platform_desktop.cpp
@@ -1,4 +1,5 @@
 #include "platform/platform.h"
+#include "core/FirmwareImage.h"  // identify/moonBaseRejection: shared image vetting
 
 #include <algorithm>
 #include <chrono>
@@ -1436,6 +1437,35 @@ bool otaWriteStream(FsWriteSrc /*src*/, void* /*user*/, size_t /*contentLen*/,
 bool otaHasMoonBase() { return false; }
 bool otaBootMoonBase() { return false; }
 bool otaRunningMoonBase() { return false; }
+// No factory partition off-device, so nothing to read a version from.
+bool otaMoonBaseVersion(char*, size_t) { return false; }
+bool otaMoonBaseBuild(char*, size_t) { return false; }
+bool otaMoonBaseSize(uint32_t*, uint32_t*) { return false; }
+// No factory partition to install into off-device.
+bool otaFetchMoonBaseUrl(const char*, char* statusBuf, size_t statusBufLen,
+                         uint32_t* bytesReadOut, uint32_t* bytesTotalOut) {
+    if (statusBuf && statusBufLen > 0) std::snprintf(statusBuf, statusBufLen, "unsupported on desktop");
+    if (bytesReadOut) *bytesReadOut = 0;
+    if (bytesTotalOut) *bytesTotalOut = 0;
+    return false;
+}
+
+// Desktop has no factory partition, so this cannot install anything. It DOES run the vetting,
+// which is the part worth exercising off-device: the checks below are what stand between a
+// mistyped URL and a board with no recovery image, and they are pure byte inspection. Tests
+// drive this to prove each rejection fires; the write itself has no meaning here and the
+// function reports so, which also keeps a desktop caller from believing it worked.
+// Desktop has no factory partition, so this installs nothing. It also does not CONSUME anything:
+// an earlier version read the caller's first chunk to run the vetting, which took bytes off a
+// stream the caller still owned for a check whose real coverage is unit_FirmwareImage driving
+// mm::firmware::identify directly. Refusing without touching the source is the honest stub.
+bool otaWriteMoonBase(FsWriteSrc, void*, size_t, char* statusBuf, size_t statusBufLen,
+                      uint32_t* bytesReadOut) {
+    if (statusBuf && statusBufLen > 0) std::snprintf(statusBuf, statusBufLen, "unsupported on desktop");
+    if (bytesReadOut) *bytesReadOut = 0;
+    return false;
+}
+
 bool moonbaseStageInstallUrl(const char*) { return false; }
 void moonbaseClearStagedUrl() {}
 
diff --git a/src/platform/esp32/platform_esp32_ota.cpp b/src/platform/esp32/platform_esp32_ota.cpp
index 4f8d55ce..f134e425 100644
--- a/src/platform/esp32/platform_esp32_ota.cpp
+++ b/src/platform/esp32/platform_esp32_ota.cpp
@@ -4,13 +4,17 @@
 // file owns the OtaTaskParams + otaTask shape in an anonymous namespace;
 // the rest of the platform layer talks to it only through the public
 // mm::platform::http_fetch_to_ota symbol declared in platform.h. Move
-// was a code-organisation change with no API delta.
+// was a code-organization change with no API delta.
 
 #include "platform/platform.h"
 
+#include "core/FirmwareImage.h"  // identify/moonBaseRejection: vetting a MoonBase image
+
 #include "esp_https_ota.h"
 #include "esp_ota_ops.h"
-#include "esp_partition.h"   // esp_partition_find_first: locating MoonBase
+#include "esp_partition.h"   // esp_partition_find_first/erase_range/write: MoonBase
+#include "esp_image_format.h" // esp_image_verify + the image/segment headers
+#include "sdkconfig.h"     // CONFIG_IDF_FIRMWARE_CHIP_ID: which chip THIS build is for
 #include "esp_crt_bundle.h"
 #include "esp_http_client.h"
 #include "esp_system.h"
@@ -33,6 +37,13 @@ namespace mm::platform {
 // the size the HTTP path already streams in.
 constexpr size_t kOtaChunkBytes = 4096;
 
+// The factory partition, which holds MoonBase, or null on the dual-OTA tables. One lookup for
+// every caller below: the same find_first was written out four times as this file grew.
+const esp_partition_t* moonBasePartition() {
+    return esp_partition_find_first(ESP_PARTITION_TYPE_APP,
+                                    ESP_PARTITION_SUBTYPE_APP_FACTORY, nullptr);
+}
+
 namespace {
 
 // Heap-allocated task parameters. Task owns this and frees it on exit.
@@ -44,7 +55,22 @@ struct OtaTaskParams {
     uint32_t* bytesTotalOut;  // image size; 0 until esp_https_ota reports it
 };
 
-// Write to the status buffer with bounded length. snprintf truncates safely.
+// Write to a status buffer with bounded length. snprintf truncates safely.
+//
+// ONE writer for the file. Three call sites had grown an identical `setStatus` lambda of their
+// own, which also put the format string behind a variadic template: correct, since every call
+// passes a literal, but not PROVABLE, and CodeQL flagged it (cpp/non-constant-format). A plain
+// varargs function takes the printf format attribute, so the compiler now checks each format
+// against its arguments and a non-literal one is a build error rather than a scanner note.
+__attribute__((format(printf, 3, 4)))
+void statusf(char* buf, size_t len, const char* fmt, ...) {
+    if (!buf || len == 0) return;
+    va_list args;
+    va_start(args, fmt);
+    std::vsnprintf(buf, len, fmt, args);
+    va_end(args);
+}
+
 void otaSetStatus(OtaTaskParams* p, const char* fmt, ...) {
     if (!p->statusBuf || p->statusBufLen == 0) return;
     va_list args;
@@ -100,6 +126,25 @@ void otaTask(void* arg) {
         return;
     }
 
+    // NOT A MOONBASE IMAGE. The mirror of the check the MoonBase install runs, and it exists for
+    // the same reason: the two images sit side by side on the releases page and are one paste
+    // apart. Writing MoonBase into the APP slot is the worse direction, because both partitions
+    // then hold MoonBase and every route out resolves to the partition it is running from
+    // (ESP_ERR_OTA_PARTITION_CONFLICT, 0x1501): the device answers, serves a page, and cannot be
+    // recovered without a cable. Found on the bench by installing exactly that.
+    //
+    // Read from the incoming image before a byte is committed, so a wrong file costs nothing.
+    esp_app_desc_t incoming = {};
+    if (esp_https_ota_get_img_desc(handle, &incoming) == ESP_OK &&
+        std::strncmp(incoming.project_name, "projectMM-moonbase",
+                     sizeof(incoming.project_name)) == 0) {
+        otaSetStatus(p, "error: that is a MoonBase image, not an app");
+        esp_https_ota_abort(handle);
+        delete p;
+        vTaskDelete(nullptr);
+        return;
+    }
+
     int total = esp_https_ota_get_image_size(handle);
     if (total > 0) {
         // Publish the real total so the UI can render "X KB / Y KB".
@@ -113,6 +158,15 @@ void otaTask(void* arg) {
     while ((err = esp_https_ota_perform(handle)) == ESP_ERR_HTTPS_OTA_IN_PROGRESS) {
         int got = esp_https_ota_get_image_len_read(handle);
         if (got >= 0) *p->bytesReadOut = static_cast<uint32_t>(got);
+        // The counts ride the STATUS, the same "N of M bytes" shape MoonBase's own page reports
+        // and the MoonBase write uses. One channel, so the UI reads progress the same way
+        // whichever image is being installed: these numbers used to reach a progress CONTROL
+        // that no longer exists, so an app install showed an indeterminate sweep that never
+        // resolved, on a device where it was working perfectly.
+        if (total > 0) {
+            otaSetStatus(p, "flashing: %u of %u bytes",
+                         static_cast<unsigned>(got > 0 ? got : 0), static_cast<unsigned>(total));
+        }
     }
     if (err != ESP_OK) {
         otaSetStatus(p, "error: ota perform %s", esp_err_to_name(err));
@@ -199,9 +253,8 @@ bool http_fetch_to_ota(const char* url,
 bool otaWriteStream(FsWriteSrc src, void* user, size_t contentLen,
                     char* statusBuf, size_t statusBufLen, uint32_t* bytesReadOut) {
     if (!src || !statusBuf || statusBufLen == 0 || !bytesReadOut) return false;
-    auto setStatus = [&](const char* fmt, auto... a) {
-        std::snprintf(statusBuf, statusBufLen, fmt, a...);
-    };
+    // Names the buffer once; the formatting itself is statusf's, which the compiler format-checks.
+    auto setStatus = [&](const char* fmt, auto... a) { statusf(statusBuf, statusBufLen, fmt, a...); };
 
     const esp_partition_t* part = esp_ota_get_next_update_partition(nullptr);
     if (!part) { setStatus("error: no OTA partition"); return false; }
@@ -256,6 +309,7 @@ bool otaWriteStream(FsWriteSrc src, void* user, size_t contentLen,
         return false;
     }
     uint32_t written = 0;
+    bool vetted = false;
     for (;;) {
         bool abort = false;
         const size_t n = src(reinterpret_cast<char*>(buf), kOtaChunkBytes, user, &abort);
@@ -265,6 +319,39 @@ bool otaWriteStream(FsWriteSrc src, void* user, size_t contentLen,
             return false;
         }
         if (n == 0) break;   // clean EOF — whole body delivered
+        // NOT A MOONBASE IMAGE. The mirror of the MoonBase install's check: writing MoonBase into
+        // the APP slot leaves both partitions holding it, and every route out then resolves to the
+        // partition being run from, so the device answers and cannot be recovered without a cable.
+        //
+        // Decided on ENOUGH BYTES, not on the first chunk. A producer may deliver fewer than the
+        // descriptor needs (a slow socket hands back what it has), and identifying a short prefix
+        // reports "no description" for an image that has one: the guard would pass and the wrong
+        // image would land. So hold the prefix back until there is enough to read.
+        if (!vetted) {
+            if (written + n < firmware::kIdentifyBytes) {
+                // Not enough yet, and nothing written: keep accumulating in the OTA partition is
+                // not an option (a rejected image must leave no bytes), so refuse a body that
+                // ends before it can be identified. Any real image is far larger.
+                if (contentLen && contentLen < firmware::kIdentifyBytes) {
+                    setStatus("error: too short to be a firmware image");
+                    esp_ota_abort(handle);
+                    return false;
+                }
+            }
+            const auto info = firmware::identify(buf, n);
+            if (info.valid && !info.described && n < firmware::kIdentifyBytes) {
+                setStatus("error: could not identify the image");
+                esp_ota_abort(handle);
+                return false;
+            }
+            vetted = true;
+            if (info.described &&
+                std::strcmp(info.project, "projectMM-moonbase") == 0) {
+                setStatus("error: that is a MoonBase image, not an app");
+                esp_ota_abort(handle);
+                return false;
+            }
+        }
         err = esp_ota_write(handle, buf, n);
         if (err != ESP_OK) {
             setStatus("error: ota write %s", esp_err_to_name(err));
@@ -295,12 +382,334 @@ bool otaWriteStream(FsWriteSrc src, void* user, size_t contentLen,
     return true;
 }
 
-// Does this device's partition table carry a factory app? True on the MoonBase layout used by
-// the 4 MB boards, false on the dual-OTA tables. The caller uses it to decide whether an update
-// needs the reboot-into-MoonBase hop, and the UI to say which kind of device this is.
+// ---- Updating MOONBASE ITSELF -------------------------------------------------------------
+//
+// The app installs MoonBase, the mirror of MoonBase installing the app. Nothing else can: a
+// board cannot rewrite the partition it is executing from, so the factory slot is writable only
+// while the app is running, and the app slot only while MoonBase is. Without this path a device
+// whose recovery image is broken needs a cable, which is the one failure MoonBase exists to
+// prevent. A bench S3 hit it: its MoonBase could not complete a download, so it could not
+// install the app that would have replaced it.
+//
+// esp_ota_* CANNOT be used here. It targets OTA subtypes only and refuses a factory partition,
+// so this writes raw flash, and with that loses the validation esp_ota_end performs. The checks
+// below replace it, and their ORDER is the safety property: everything that can reject an image
+// is done from the FIRST CHUNK, before a single byte is erased. Point this at an HTML error
+// page, the wrong chip's image, or an app firmware, and the device still has its MoonBase.
+
+// Does this first chunk begin a MoonBase image for THIS chip? The parsing and the rules live in
+// core/FirmwareImage.h so a host test can drive them: this code erases a device's only recovery
+// image, and "the check was never exercised" is not a risk worth carrying for a header parse.
+bool moonBaseImageRejected(const uint8_t* buf, size_t n, char* why, size_t whyLen) {
+    const auto info = firmware::identify(buf, n);
+    const char* reason = firmware::moonBaseRejection(
+        info, static_cast<firmware::ChipId>(CONFIG_IDF_FIRMWARE_CHIP_ID));
+    if (!reason) return false;
+    std::snprintf(why, whyLen, "error: %s", reason);
+    return true;
+}
+
+bool otaWriteMoonBase(FsWriteSrc src, void* user, size_t contentLen,
+                      char* statusBuf, size_t statusBufLen, uint32_t* bytesReadOut) {
+    if (!src || !statusBuf || statusBufLen == 0 || !bytesReadOut) return false;
+    // Names the buffer once; the formatting itself is statusf's, which the compiler format-checks.
+    auto setStatus = [&](const char* fmt, auto... a) { statusf(statusBuf, statusBufLen, fmt, a...); };
+
+    const esp_partition_t* part = moonBasePartition();
+    if (!part) { setStatus("error: no MoonBase on this device"); return false; }
+    // The inverse of otaWriteStream's single-slot guard, and the reason this path is safe at all:
+    // the app runs from ota_0, so factory is never what we are executing. Running from MoonBase
+    // means the app slot is the writable one, and this is the wrong call.
+    if (part == esp_ota_get_running_partition()) {
+        setStatus("error: running from MoonBase, boot the app first");
+        return false;
+    }
+    if (contentLen && contentLen > part->size) {
+        setStatus("error: image too large (%u > %u)",
+                  static_cast<unsigned>(contentLen), static_cast<unsigned>(part->size));
+        return false;
+    }
+
+    const std::unique_ptr<uint8_t, decltype(&heap_caps_free)> owned(
+        static_cast<uint8_t*>(heap_caps_malloc(kOtaChunkBytes, MALLOC_CAP_8BIT)), &heap_caps_free);
+    uint8_t* const buf = owned.get();
+    if (!buf) { setStatus("error: out of memory for the update buffer"); return false; }
+
+    setStatus("checking");
+    // FIRST CHUNK BEFORE ANY ERASE. Everything that can reject the image is decided here, while
+    // the existing MoonBase is still intact and the worst case is a status line.
+    bool abort = false;
+    size_t first = src(reinterpret_cast<char*>(buf), kOtaChunkBytes, user, &abort);
+    if (abort || first == 0) { setStatus("error: no image received"); return false; }
+    if (moonBaseImageRejected(buf, first, statusBuf, statusBufLen)) return false;
+
+    // PAST THIS LINE THE DEVICE HAS NO RECOVERY IMAGE until the write completes. Erase and write
+    // in one pass: on a 4 MB board there is nowhere to stage 743 KB first (the app slot has
+    // ~520 KB free, the filesystem 548), so a second copy is not an option the hardware offers.
+    setStatus("erasing");
+    esp_err_t err = esp_partition_erase_range(part, 0, part->size);
+    if (err != ESP_OK) { setStatus("error: erase %s", esp_err_to_name(err)); return false; }
+
+    setStatus("writing MoonBase");
+    uint32_t written = 0;     // bytes committed to flash
+    size_t   held    = first; // bytes sitting in buf, not yet written
+    bool     eof     = false;
+    for (;;) {
+        // esp_partition_write needs a 4-byte-aligned LENGTH, which esp_ota_write used to absorb.
+        //
+        // So write only the whole 4-byte groups currently held, and KEEP the remainder in the
+        // buffer for the next read to extend. Padding a short chunk instead looks right and is
+        // not: a chunk arrives short whenever the producer has less to give, which on the URL
+        // path is any TLS read rather than only the last one. The padding then reaches flash,
+        // the offset advances by the unpadded count, and the next write lands up to 3 bytes back
+        // over it, corrupting the image at every short read. esp_image_verify catches the result,
+        // but only after the slot is erased, which is the failure this design exists to avoid.
+        //
+        // At EOF the remainder IS the image's last bytes, so it is padded to a word with 0xFF
+        // (what erased flash reads as) and written. Only there is padding correct.
+        const size_t whole = eof ? ((held + 3u) & ~size_t{3}) : (held & ~size_t{3});
+        if (whole) {
+            if (eof && whole > held) std::memset(buf + held, 0xFF, whole - held);
+            // Compared on the IMAGE bytes, not the padded write: at EOF `whole` rounds up past
+            // the image's end, and rejecting a slot-filling image for its own padding would be
+            // refusing something that fits. Unreachable at today's sizes; correct anyway.
+            if (written + (eof ? held : whole) > part->size) {
+                setStatus("error: image overruns the slot");
+                return false;
+            }
+            err = esp_partition_write(part, written, buf, whole);
+            if (err != ESP_OK) { setStatus("error: write %s", esp_err_to_name(err)); return false; }
+            // The IMAGE grew by what it held, not by the padding: a padded tail is flash the
+            // image does not occupy, and counting it would report more written than was sent.
+            written += static_cast<uint32_t>(eof ? held : whole);
+            *bytesReadOut = written;
+            // The counts ride the STATUS, the way MoonBase's own page reports them: one channel
+            // for the UI to read, and the overlay draws its bar from a string it already polls.
+            if (contentLen) {
+                setStatus("writing MoonBase: %u of %u bytes",
+                          static_cast<unsigned>(written), static_cast<unsigned>(contentLen));
+            }
+            held -= eof ? held : whole;
+        }
+        if (eof) break;
+
+        // Keep the unwritten remainder at the front, then read after it.
+        if (held) std::memmove(buf, buf + (whole ? whole : 0), held);
+        abort = false;
+        const size_t got = src(reinterpret_cast<char*>(buf) + held, kOtaChunkBytes - held,
+                               user, &abort);
+        if (abort) { setStatus("error: transfer aborted, MoonBase is incomplete"); return false; }
+        if (got == 0) eof = true;      // one more pass, to flush what is held
+        held += got;
+    }
+    if (contentLen && written < contentLen) {
+        setStatus("error: incomplete transfer (%u/%u), MoonBase is incomplete",
+                  static_cast<unsigned>(written), static_cast<unsigned>(contentLen));
+        return false;
+    }
+
+    // What esp_ota_end did on the app path: checksum the image actually on flash. A failure here
+    // is the serious one, since the slot no longer holds a working MoonBase, so it says so
+    // plainly rather than reporting a generic write error.
+    esp_partition_pos_t pos = { .offset = part->address, .size = part->size };
+    esp_image_metadata_t meta = {};
+    if (esp_image_verify(ESP_IMAGE_VERIFY, &pos, &meta) != ESP_OK) {
+        setStatus("error: MoonBase did not verify, retry before rebooting");
+        return false;
+    }
+    // No reboot and no boot-partition change: the app keeps running, and the new MoonBase is
+    // simply what the device falls back to from now on.
+    setStatus("idle");
+    return true;
+}
+
+// Pull a MoonBase image from a URL, feeding the same writer the upload path uses.
+//
+// esp_https_ota cannot serve this: it targets OTA subtypes only and picks the partition itself,
+// so the download is driven by hand and its bytes handed to otaWriteMoonBase through the same
+// producer callback an upload uses. One writer, one set of checks, two sources.
+struct UrlPull {
+    esp_http_client_handle_t client;
+    bool failed;
+};
+
+size_t urlPullChunk(char* out, size_t cap, void* user, bool* abort) {
+    auto* u = static_cast<UrlPull*>(user);
+    const int n = esp_http_client_read(u->client, out, static_cast<int>(cap));
+    if (n < 0) { u->failed = true; *abort = true; return 0; }
+    return static_cast<size_t>(n);   // 0 is a clean end of body
+}
+
+bool moonBaseFetchUrlSync(const char* url, char* statusBuf, size_t statusBufLen,
+                          uint32_t* bytesReadOut, uint32_t* bytesTotalOut) {
+    // Names the buffer once; the formatting itself is statusf's, which the compiler format-checks.
+    auto setStatus = [&](const char* fmt, auto... a) { statusf(statusBuf, statusBufLen, fmt, a...); };
+    esp_http_client_config_t cfg = {};
+    cfg.url = url;
+    // Same TLS and redirect handling the app's OTA fetch needs, and for the same reasons: a
+    // release asset 302s to objects.githubusercontent.com, whose headers overflow the 512-byte
+    // default buffer.
+    cfg.crt_bundle_attach = esp_crt_bundle_attach;
+    cfg.timeout_ms = 10000;
+    cfg.disable_auto_redirect = false;
+    cfg.max_redirection_count = 10;
+    cfg.buffer_size = 4096;
+    cfg.buffer_size_tx = 4096;
+
+    esp_http_client_handle_t client = esp_http_client_init(&cfg);
+    if (!client) { setStatus("error: cannot reach that URL"); return false; }
+    esp_err_t err = esp_http_client_open(client, 0);
+    if (err != ESP_OK) {
+        setStatus("error: cannot start the download (%s)", esp_err_to_name(err));
+        esp_http_client_cleanup(client);
+        return false;
+    }
+    const int64_t len = esp_http_client_fetch_headers(client);
+    const int status = esp_http_client_get_status_code(client);
+    if (status != 200) {
+        // A 404 page is a valid HTTP response carrying HTML, which the image checks would catch
+        // anyway; failing here says the useful thing instead of "not a firmware image".
+        setStatus("error: the server answered %d", status);
+        esp_http_client_close(client);
+        esp_http_client_cleanup(client);
+        return false;
+    }
+    if (bytesTotalOut) *bytesTotalOut = len > 0 ? static_cast<uint32_t>(len) : 0;
+
+    UrlPull pull = { client, false };
+    const bool ok = otaWriteMoonBase(&urlPullChunk, &pull, len > 0 ? static_cast<size_t>(len) : 0,
+                                     statusBuf, statusBufLen, bytesReadOut);
+    esp_http_client_close(client);
+    esp_http_client_cleanup(client);
+    if (!ok && pull.failed) setStatus("error: the download was interrupted");
+    return ok;
+}
+
+// The install runs on its own task so the HTTP request can answer 202 immediately, exactly as the
+// app's URL install does. That is not a detail: while the request is open the browser cannot poll
+// for progress, so a synchronous install can only ever report "installing" and then "installed".
+// Same task shape, same status buffer, same byte counters, so ONE progress display serves both.
+void moonBaseUrlTask(void* arg) {
+    auto* p = static_cast<OtaTaskParams*>(arg);
+    moonBaseFetchUrlSync(p->url, p->statusBuf, p->statusBufLen, p->bytesReadOut, p->bytesTotalOut);
+    // No reboot on either outcome: the app is running from the other partition and is untouched.
+    // On failure the status already says what went wrong, and it stays there for the UI to read.
+    delete p;
+    vTaskDelete(nullptr);
+}
+
+bool otaFetchMoonBaseUrl(const char* url, char* statusBuf, size_t statusBufLen,
+                         uint32_t* bytesReadOut, uint32_t* bytesTotalOut) {
+    if (!url || !statusBuf || statusBufLen == 0 || !bytesReadOut || !bytesTotalOut) return false;
+    const size_t urlLen = std::strlen(url);
+    auto* p = new (std::nothrow) OtaTaskParams{};
+    if (!p) {
+        std::snprintf(statusBuf, statusBufLen, "error: out of memory");
+        return false;
+    }
+    if (urlLen >= sizeof(p->url)) {
+        std::snprintf(statusBuf, statusBufLen, "error: url too long");
+        delete p;
+        return false;
+    }
+    std::memcpy(p->url, url, urlLen + 1);
+    p->statusBuf = statusBuf;
+    p->statusBufLen = statusBufLen;
+    p->bytesReadOut = bytesReadOut;
+    p->bytesTotalOut = bytesTotalOut;
+    *bytesReadOut = 0;
+    *bytesTotalOut = 0;
+    std::snprintf(statusBuf, statusBufLen, "starting");
+    // 8 KB against the app OTA's 12: no esp_https_ota state machine here, just an http client
+    // feeding a writer. Priority 5 and the same core assignment as urlOta.
+    if (xTaskCreate(&moonBaseUrlTask, "mbOta", 8192, p, 5, nullptr) != pdPASS) {
+        std::snprintf(statusBuf, statusBufLen, "error: task create failed");
+        delete p;
+        return false;
+    }
+    return true;
+}
+
+
+// Does this device's partition table carry a factory app? True on the MoonBase layout, false on
+// the dual-OTA tables. The caller uses it to decide whether an update needs the
+// reboot-into-MoonBase hop, and the UI to say which kind of device this is.
 bool otaHasMoonBase() {
-    return esp_partition_find_first(ESP_PARTITION_TYPE_APP,
-                                    ESP_PARTITION_SUBTYPE_APP_FACTORY, nullptr) != nullptr;
+    return moonBasePartition() != nullptr;
+}
+
+// Which MoonBase does this device carry? Read from the factory partition's app descriptor, the
+// struct IDF puts at a fixed offset in every image, so this costs one flash read and needs no
+// reboot: the app can report the recovery image's version while running normally.
+//
+// MoonBase answers the same question about ITSELF at GET /api/version (moonbase_main.cpp), which
+// is a different question and not a second copy of this one: that route reports the image it is
+// EXECUTING (esp_app_get_description, no flash read), this one reports an image it is not.
+//
+// The value is PROJECT_VER, set by build_moonbase() to the same string the app burns into
+// MM_VERSION, which is what lets the caller compare the two by equality.
+bool otaMoonBaseVersion(char* out, size_t len) {
+    if (!out || len == 0) return false;
+    out[0] = 0;
+    const esp_partition_t* part = moonBasePartition();
+    if (!part) return false;
+    esp_app_desc_t desc = {};
+    if (esp_ota_get_partition_description(part, &desc) != ESP_OK) return false;
+    std::snprintf(out, len, "%.*s", static_cast<int>(sizeof(desc.version)), desc.version);
+    return out[0] != 0;
+}
+
+// When MoonBase was built, from the same descriptor. The UI shows the app's build stamp beside its
+// version, and shows the same pair for MoonBase, so this is the other half of that.
+bool otaMoonBaseBuild(char* out, size_t len) {
+    if (!out || len == 0) return false;
+    out[0] = 0;
+    const esp_partition_t* part = moonBasePartition();
+    if (!part) return false;
+    esp_app_desc_t desc = {};
+    if (esp_ota_get_partition_description(part, &desc) != ESP_OK) return false;
+    std::snprintf(out, len, "%.*s %.*s",
+                  static_cast<int>(sizeof(desc.date)), desc.date,
+                  static_cast<int>(sizeof(desc.time)), desc.time);
+    return out[0] != 0;
+}
+
+// The factory slot's size, for the UI to show beside the app's partition figure.
+//
+// The slot rather than the image: esp_image_get_metadata reads through the bootloader's flash
+// mapping, which is arranged for the RUNNING partition, and on the bench it simply errored for
+// the factory one, leaving the row absent. The image's own length is not worth a second mechanism
+// to obtain, since what a user wants from this row is whether the slot has room, and the
+// descriptor read above already proves an image is there.
+bool otaMoonBaseSize(uint32_t* used, uint32_t* total) {
+    const esp_partition_t* part = moonBasePartition();
+    if (!part) return false;
+    if (total) *total = part->size;
+    if (used) {
+        // Read the image length straight out of the header, which is a plain partition read and
+        // needs no flash mapping: the first bytes of a valid image are its header, and its
+        // segments follow. esp_partition_read is the same call the vetting path uses.
+        esp_image_header_t hdr = {};
+        *used = 0;
+        if (esp_partition_read(part, 0, &hdr, sizeof(hdr)) == ESP_OK &&
+            hdr.magic == ESP_IMAGE_HEADER_MAGIC) {
+            // Walk the segment table to the end of the last segment: that is the image length.
+            uint32_t off = sizeof(esp_image_header_t);
+            for (uint8_t i = 0; i < hdr.segment_count && off < part->size; i++) {
+                esp_image_segment_header_t seg = {};
+                if (esp_partition_read(part, off, &seg, sizeof(seg)) != ESP_OK) { off = 0; break; }
+                if (seg.data_len > part->size) { off = 0; break; }   // a corrupt length
+                off += sizeof(seg) + seg.data_len;
+            }
+            // The segments only: the padding, 1-byte checksum and 32-byte hash the image ends
+            // with are not counted, so this reads ~48 bytes under the file on disk. That is
+            // deliberate rather than missed. This figure answers "how full is the slot", where
+            // 48 bytes in 896 KB is invisible, and reproducing the bootloader's own padding
+            // rules here would be a second copy of them to keep in step for no gain.
+            if (off) *used = off < part->size ? off : part->size;
+        }
+    }
+    return true;
 }
 
 // Point the bootloader at MoonBase and report whether it took. Returns false when the table has
@@ -309,8 +718,7 @@ bool otaHasMoonBase() {
 // sequence number: that is what makes a power cut mid-update land back in MoonBase rather than in
 // a half-written app.
 bool otaBootMoonBase() {
-    const esp_partition_t* part = esp_partition_find_first(
-        ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_APP_FACTORY, nullptr);
+    const esp_partition_t* part = moonBasePartition();
     if (!part) return false;
     return esp_ota_set_boot_partition(part) == ESP_OK;
 }
diff --git a/src/platform/platform.h b/src/platform/platform.h
index 57d4870e..8eac7f09 100644
--- a/src/platform/platform.h
+++ b/src/platform/platform.h
@@ -768,15 +768,44 @@ bool http_fetch_to_ota(const char* url,
 bool otaWriteStream(FsWriteSrc src, void* user, size_t contentLen,
                     char* statusBuf, size_t statusBufLen, uint32_t* bytesReadOut);
 
-// MOONBASE, the second boot image, present only on tables that carry a factory app (the 4 MB
-// boards): a small, rarely changing firmware that owns the device when the application is not
-// running or cannot be trusted. Its first job is installing firmware into the one large app slot,
+// MOONBASE, the second boot image, present only on tables that carry a factory app (forced on a
+// 4 MB board, chosen on the larger ones): a small, rarely changing firmware that owns the device
+// when the application is not running or cannot be trusted. Its first job is installing firmware into the one large app slot,
 // since a board cannot rewrite the partition it is executing from, so an update there is two
 // stages: otaBootMoonBase() + reboot, then install from MoonBase.
 // All of these are false / no-ops on a dual-OTA table and on desktop.
 bool otaHasMoonBase();      // does this table carry MoonBase?
 bool otaBootMoonBase();     // point the bootloader at it; false when there is none
 bool otaRunningMoonBase();  // are we executing from it right now?
+// Which MoonBase is installed, read from the factory partition's app descriptor without booting
+// it. False when there is no MoonBase or the image carries no readable descriptor. The string is
+// comparable with mm::kVersion: both come from the same computed version.
+bool otaMoonBaseVersion(char* out, size_t len);
+// The rest of the same descriptor, so the UI can show MoonBase's identity the way it shows the
+// app's: when it was built, and how much of its slot it fills.
+bool otaMoonBaseBuild(char* out, size_t len);
+bool otaMoonBaseSize(uint32_t* used, uint32_t* total);
+// Install a new MOONBASE, the inverse of MoonBase installing the app: the factory partition is
+// writable only while the app is running, exactly as the app slot is only while MoonBase runs.
+// Without this a device whose recovery image is broken needs a cable.
+//
+// Same producer-callback shape as otaWriteStream, and the same status vocabulary, with two
+// differences that matter. It VETS the first chunk (magic, chip id, and that the image really is
+// MoonBase) before erasing anything, so a wrong URL costs nothing. And it does NOT reboot: the
+// running app is untouched, and the new image is simply what the device falls back to next.
+//
+// SYNCHRONOUS, and it blocks the caller for the whole erase and write: no-reboot does not mean
+// non-blocking. Called from an HTTP handler on the render task, so the lights hold still for the
+// duration, the same as the app's own upload path. False on desktop, which has no factory slot.
+bool otaWriteMoonBase(FsWriteSrc src, void* user, size_t contentLen,
+                      char* statusBuf, size_t statusBufLen, uint32_t* bytesReadOut);
+// The same install from a URL rather than an upload: the device fetches the image itself, which
+// is what lets it take a release asset straight from GitHub. Runs on its OWN TASK and returns at
+// once, like the app's URL install: while the request is open the browser cannot poll, so a
+// synchronous install could only ever report "installing" and then "installed", with no progress
+// in between. Nothing reboots, so the caller answers 202 and the UI follows the status.
+bool otaFetchMoonBaseUrl(const char* url, char* statusBuf, size_t statusBufLen,
+                         uint32_t* bytesReadOut, uint32_t* bytesTotalOut);
 // Stage an install URL for MoonBase to pick up on its next boot (NVS namespace "moonbase",
 // key "url", at most 255 bytes: MoonBase reads it into a 256-byte buffer and the HTTP route
 // rejects anything longer). This is what makes a URL install unattended: the app stages the URL, reboots into
diff --git a/src/ui/app.js b/src/ui/app.js
index c10e0c45..32fd7f4f 100644
--- a/src/ui/app.js
+++ b/src/ui/app.js
@@ -144,7 +144,12 @@ function lsRead(key, defaultVal) {
     return v !== null ? v : defaultVal;
 }
 
-let timingMode = lsRead(LS_TIMING, "fps");
+// MEASURED time by default, not derived rate. A module's tickTimeUs is what it actually cost;
+// the fps beside it is that number inverted, which reads as a frame rate the device could hit if
+// this module were the only thing running. On a card that is a claim about the whole pipeline made
+// from one part of it, so the honest default is the microseconds. The toggle still cycles to fps
+// for anyone comparing against a target rate.
+let timingMode = lsRead(LS_TIMING, "ms");
 let theme      = lsRead(LS_THEME, "dark");
 
 // ---------------------------------------------------------------------------
@@ -541,6 +546,13 @@ async function sendControl(moduleName, controlName, value) {
         if (!res.ok) {
             console.warn(`[control] POST ${moduleName}.${controlName} failed (status=${res.status})`);
         }
+        // The Firmware card's `image` picks WHICH PARTITION every other control describes, so the
+        // device rebinds version/build/firmware/partition to the other image and the card has to
+        // be redrawn from the new values. Refetched AFTER the POST rather than re-rendered before
+        // it (the expertMode case above), because the new values only exist once the device has
+        // switched. The routine WS push cannot carry it: renderCards is suppressed while the user
+        // is interacting, and operating this select is exactly that.
+        else if (moduleName === "Firmware" && controlName === "image") refetchState();
     } catch (e) {
         console.warn(`[control] POST ${moduleName}.${controlName} failed (error=${e && e.message ? e.message : e})`);
     }
@@ -1213,14 +1225,205 @@ function renderChildTabs(mod, childrenEl, depth) {
 }
 
 // ---- MoonBase update flow ----
-// On a MoonBase device (FirmwareUpdate exposes a `moonbase` control) the app cannot flash itself:
-// one app slot, and it is running from it. Instead it reboots into the MoonBase factory image,
-// which installs into the app slot and reboots back: same IP throughout (same MAC, same DHCP
-// lease). The whole cycle runs behind one full-screen overlay, shown BEFORE the reboot so there
-// is no dead gap. GET /moonbase is the identity probe: MoonBase answers it with its live install
-// status; the app 404s it: so "404 again after an install ran" means the new firmware is up.
+// On a MoonBase device the app cannot flash itself: one app slot, and it is running from it.
+// Instead it reboots into the MoonBase factory image, which installs into the app slot and reboots
+// back: same IP throughout (same MAC, same DHCP lease). The whole cycle runs behind one
+// full-screen overlay, shown BEFORE the reboot so there is no dead gap. GET /moonbase is the
+// identity probe: MoonBase answers it with its live install status; the app 404s it: so "404 again
+// after an install ran" means the new firmware is up.
+//
+// The marker is the `image` control, which the module publishes only where there are two images to
+// choose between. It was the `moonbase` control until that one was folded into the generic set as
+// `version`, which left this testing for a name nothing emits: the card silently lost its tab
+// strip AND its way into MoonBase, on a device that has one.
 function deviceHasMoonBase(mod) {
-    return (mod.controls || []).some(c => c.name === "moonbase");
+    return (mod.controls || []).some(c => c.name === "image");
+}
+
+// Ask before installing a MoonBase, in the app's own chrome rather than the browser's.
+//
+// A native confirm() is the one box in this UI that cannot be styled, and it looked it: a white
+// system panel over a dark card. This is the same native <dialog> the file editor uses, so Esc and
+// the backdrop close it for free. Resolves true to install, false to abandon.
+function askMoonBaseInstall() {
+    return new Promise((resolve) => {
+        const dlg = document.createElement("dialog");
+        dlg.className = "mb-ask";
+        const h = document.createElement("h3");
+        h.textContent = "Install a new MoonBase?";
+        const p1 = document.createElement("p");
+        // What is actually at stake, rather than a bare "are you sure": the device has no recovery
+        // image for the few seconds this takes.
+        p1.textContent = "MoonBase is the recovery image. While it is being written the device "
+                       + "has no recovery image, so do not power it off until this finishes.";
+        const p2 = document.createElement("p");
+        p2.className = "mb-ask-calm";
+        p2.textContent = "The device checks the image first and refuses anything that is not a "
+                       + "MoonBase image for this board, so a wrong file costs nothing.";
+        const row = document.createElement("div");
+        row.className = "mb-ask-row";
+        const cancel = document.createElement("button");
+        cancel.className = "fm-tool";
+        cancel.textContent = "Cancel";
+        const go = document.createElement("button");
+        go.className = "fm-tool mb-ask-go";
+        go.textContent = "Install";
+
+        const close = (value) => { dlg.close(); dlg.remove(); resolve(value); };
+        cancel.addEventListener("click", () => close(false));
+        go.addEventListener("click", () => close(true));
+        // Esc and the backdrop both reach here, so a dismissed dialog never leaves the promise
+        // pending and never installs anything.
+        dlg.addEventListener("close", () => { dlg.remove(); resolve(false); }, { once: true });
+
+        row.append(cancel, go);
+        dlg.append(h, p1, p2, row);
+        document.body.appendChild(dlg);
+        dlg.showModal();
+        go.focus();
+    });
+}
+
+// Byte counts out of a device status line, or null when it carries none.
+//
+// ONE PARSER for one wire shape. Every image writer reports progress as "<phase>: N of M bytes",
+// and the phase word differs by writer (`flashing`, `writing MoonBase`, MoonBase's own
+// `downloading`), so matching the numbers rather than the phrase is what lets one reader serve
+// them all. Two hand-written regexes had already drifted apart on whether `bytes` was required.
+//
+// An ERROR line can carry the same shape ("upload ended early (12 of 34 bytes)"), so it is
+// rejected here rather than left to the caller's check order.
+function installProgress(text) {
+    if (!text || text.startsWith("error")) return null;
+    const m = /(\d+) of (\d+) bytes/.exec(text);
+    if (!m) return null;
+    const read = parseInt(m[1], 10), total = parseInt(m[2], 10);
+    return total > 0 ? { read, total } : null;
+}
+
+// Raise the overlay over an install the DEVICE is performing, and follow it to the end.
+//
+// Every in-place install (a URL or a release, either image) answers 202 and then works on its own
+// task, so the only way to know how far it has got is to ask. The device puts its byte counts in
+// its status line, which is where both the text and the bar come from: one watcher, whichever
+// image is being written.
+//
+// TWO ENDINGS, because the two installs end differently and getting this wrong is what made an
+// overlay hang on a board where the install had actually succeeded:
+//   MoonBase   leaves the app running, so the status falls back to rest and the card is redrawn.
+//   the app    reboots into the image just written, so the device goes SILENT and comes back on
+//              the same address. Silence after work is therefore success, not a stall.
+//
+// Polls the device rather than the cached `state`: across a reboot the WebSocket is down and the
+// cache is frozen at the last frame before it went, which reads as an install that stopped.
+//
+// Not to be confused with moonbaseUpdateFlow, which carries an install across TWO reboots (into
+// MoonBase and back) and has its own retry and handoff handling.
+function watchInstall(kind) {
+    const ui = showUpdateOverlay();
+    ui.status(`Installing ${kind.label.toLowerCase()}\u2026`);
+    const deadline = Date.now() + 300000;
+    // Only treat an ending as SUCCESS once work was actually seen: the first poll can land before
+    // the install task has written anything, and rest or silence then means "not started yet".
+    let sawWork = false;
+    let silent = 0;
+
+    // The device's own Firmware status, or null when it is not answering.
+    const probe = async () => {
+        const ctl = new AbortController();
+        const timer = setTimeout(() => ctl.abort(), 2500);
+        try {
+            const r = await fetch("/api/modules/Firmware", { cache: "no-store", signal: ctl.signal });
+            if (!r.ok) return null;
+            const mod = await r.json();
+            return (mod && mod.status) || "";
+        } catch (_) {
+            return null;
+        } finally {
+            clearTimeout(timer);
+        }
+    };
+
+    const tick = async () => {
+        if (Date.now() > deadline) { ui.fail("Install timed out."); return; }
+        const text = await probe();
+
+        if (text === null) {
+            // Not answering. During a rebooting install that is the reboot itself.
+            silent++;
+            if (kind.reboots && sawWork) {
+                ui.status("Rebooting\u2026");
+                if (silent > 90) { ui.fail(MOONBASE_SILENT_MSG); return; }
+            } else if (silent >= 4) {
+                ui.status("The device is not answering\u2026");
+            }
+        } else {
+            if (text.startsWith("error")) { ui.fail(text); return; }
+            const p = installProgress(text);
+            if (p) {
+                ui.status(`Installing ${fmSize(p.total)}\u2026`);
+                ui.progress(p.read, p.total);
+                sawWork = true;
+            } else if (text && text !== "idle") {
+                // A WORKING PHASE counts as work even with no byte counts. The device reports
+                // counts only when it knows the content length, and a chunked response (any
+                // proxy, or a server that does not send Content-Length) leaves it with none: the
+                // status then walks checking -> erasing -> writing -> idle without ever matching,
+                // so an install that SUCCEEDED sat behind the overlay until the five-minute
+                // timeout. The bar stays indeterminate there, which is honest: the total is
+                // genuinely unknown.
+                ui.status(`Installing ${kind.label.toLowerCase()}\u2026`);
+                sawWork = true;
+            }
+            // ANSWERING AGAIN AFTER SILENCE is the rebooting install's success: the image it
+            // wrote is the one now running.
+            if (kind.reboots && sawWork && silent > 0) {
+                ui.status(`${kind.label} installed`);
+                await fwSleep(1200);
+                location.reload();
+                return;
+            }
+            // Back to rest with no error is the non-rebooting install's success.
+            if (!kind.reboots && sawWork && (text === "" || text === "idle")) {
+                ui.status(`${kind.label} installed`);
+                await fwSleep(1200);
+                location.reload();
+                return;
+            }
+            silent = 0;
+        }
+        await fwSleep(1000);
+        tick();
+    };
+    tick();
+}
+
+// POST a file and paint a REAL progress bar while it uploads.
+//
+// fetch() cannot report upload progress at all (its streaming request bodies are not available
+// here), so this is the one place an XMLHttpRequest earns its keep: xhr.upload.onprogress is the
+// only way to know how far a browser-pushed install has got. The device-fetched installs report
+// through the byte counts in their status line instead, so every install has a bar.
+function uploadWithProgress(route, file, ui) {
+    return new Promise((resolve, reject) => {
+        const xhr = new XMLHttpRequest();
+        xhr.open("POST", route);
+        xhr.setRequestHeader("Content-Type", "application/octet-stream");
+        xhr.upload.addEventListener("progress", (e) => {
+            if (e.lengthComputable) ui.progress(e.loaded, e.total);
+        });
+        xhr.addEventListener("load", () => {
+            // The device answers before it reboots, so a 2xx is the real success signal. Anything
+            // else carries the device's own reason in the JSON body.
+            if (xhr.status >= 200 && xhr.status < 300) { resolve(); return; }
+            let msg = `HTTP ${xhr.status}`;
+            try { msg = JSON.parse(xhr.responseText).error || msg; } catch (_) {}
+            reject(new Error(msg));
+        });
+        xhr.addEventListener("error", () => reject(new Error("the connection dropped")));
+        xhr.addEventListener("abort", () => reject(new Error("canceled")));
+        xhr.send(file);
+    });
 }
 
 function showUpdateOverlay() {
@@ -1398,11 +1601,10 @@ async function moonbaseUpdateFlow(opts) {
                 if (probe.text.startsWith("error")) throw new Error(probe.text);
                 // The unattended install reports "downloading: N of M bytes"; render it the
                 // way the file path reads, with a real bar.
-                const dl = probe.text.match(/downloading: (\d+) of (\d+) bytes/);
+                const dl = installProgress(probe.text);
                 if (dl) {
-                    const read = parseInt(dl[1], 10), total = parseInt(dl[2], 10);
-                    ui.status(`Installing ${fmSize(total || read)}\u2026`);
-                    ui.progress(read, total);
+                    ui.status(`Installing ${fmSize(dl.total || dl.read)}\u2026`);
+                    ui.progress(dl.read, dl.total);
                 } else {
                     // "idle" is MoonBase's quiescent state; mid-cycle it means the install
                     // has not started yet, which deserves better words than "Idle".
@@ -1735,120 +1937,232 @@ function createCard(mod, depth) {
     // device fetches the binary via /api/firmware/url: no browser CORS in
     // the data path. See docs/architecture.md § Firmware vs board.
     if (mod.type === "FirmwareUpdateModule") {
-        // Opening the Firmware card forces a fresh update check (the badge otherwise refreshes
-        // only on the 1 h cache cadence): so the badge agrees with the picker the user is about
-        // to use. Fire-and-forget; best-effort.
+        // TWO IMAGES, ONE PANEL. A device installs the app it runs and MoonBase the recovery
+        // image, described by the same four controls and installed the same three ways (a
+        // release, a URL, a file). The device's `image` control says which, and everything here
+        // reads it: one implementation, so the two cannot drift apart.
+        //
+        // The release row is install-picker's, the SAME component the web installer renders, so
+        // the release list, the compatible-firmware filtering, the remembered selection and the
+        // "2 weeks ago" labels have one home. The URL, File and image rows ride its
+        // installRowExtras seam, which exists for exactly this.
         checkFirmwareUpdate(true);
-        const ownFirmwareKey = (() => {
-            // The `firmware` variant key is this module's own control now (moved here from
-            // SystemModule), so read it straight off mod: no cross-module lookup.
-            const fwCtrl = (mod.controls || []).find(c => c.name === "firmware");
-            return fwCtrl && fwCtrl.value ? fwCtrl.value : null;
-        })();
-        const mount = document.createElement("div");
-        mount.className = "install-picker-host";
-        controlsHost.appendChild(mount);
-        installPicker.init({
-            container: mount,
-            ownFirmwareKey,
-            // Device already knows its deviceModel (SystemModule): picker is for
-            // releases + firmware compatibility only. Showing a board picker
-            // here would invite the user to mis-narrow the firmware list.
-            enableBoardPicker: false,
-            onInstall: async (_firmware, _manifestUrl, binaryUrl, entry) => {
-                // A desktop build has no OTA: it updates by downloading a new release and being
-                // replaced by hand. So hand the browser the file and let it do what it does with a
-                // download, rather than POSTing to a route that would 501 here.
-                if (entry && entry.isDesktop) {
-                    const a = document.createElement("a");
-                    a.href = binaryUrl;
-                    a.rel = "noopener";
-                    a.target = "_blank";
-                    document.body.appendChild(a);
-                    a.click();
-                    a.remove();
-                    return;
-                }
-                if (deviceHasMoonBase(mod)) {
-                    // MoonBase device: the whole install runs unattended behind the overlay.
-                    moonbaseUpdateFlow({ url: binaryUrl });
-                    return;
-                }
-                const res = await fetch("/api/firmware/url", {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({ url: binaryUrl }),
-                });
-                if (!res.ok) throw new Error(await errorMessage(res));
+        const ctrlValue = (name) => {
+            const c = (mod.controls || []).find(x => x.name === name);
+            return c ? c.value : null;
+        };
+        const hasMoonBase = deviceHasMoonBase(mod);
+        const kind = (hasMoonBase && ctrlValue("image") === 1) ? "moonbase" : "app";
+        const KINDS = {
+            app: {
+                label: "App",
+                urlRoute: "/api/firmware/url",
+                uploadRoute: "/api/firmware/upload",
+                confirm: null,
+                reboots: true,
             },
+            moonbase: {
+                label: "MoonBase",
+                urlRoute: "/api/firmware/moonbase-update-url",
+                uploadRoute: "/api/firmware/moonbase-update",
+                confirm: askMoonBaseInstall,
+                reboots: false,
+            },
+        };
+        const k = KINDS[kind];
+
+        // WHICH IMAGE, as a tab strip: the control chooses what every row is about, which reads
+        // as a tab rather than as one setting among the settings it governs. The device holds the
+        // selection (the control is marked hidden there), so this renders a fact rather than
+        // owning one. Inserted after the card's title, ahead of the rows it governs.
+        if (hasMoonBase) {
+            const strip = document.createElement("div");
+            strip.className = "tab-strip";
+            strip.setAttribute("role", "tablist");
+            ["app", "moonbase"].forEach((tabKind, i) => {
+                const tab = document.createElement("button");
+                tab.type = "button";
+                tab.className = tabKind === kind ? "tab tab-active" : "tab";
+                tab.setAttribute("role", "tab");
+                tab.setAttribute("aria-selected", tabKind === kind ? "true" : "false");
+                tab.textContent = KINDS[tabKind].label;
+                tab.addEventListener("click", () => {
+                    if (tabKind !== kind) sendControl(mod.name, "image", i);
+                });
+                strip.appendChild(tab);
+            });
+            const titleRow = controlsHost.querySelector(":scope > .card-title");
+            controlsHost.insertBefore(strip, titleRow ? titleRow.nextSibling : controlsHost.firstChild);
+        }
+
+        const status = document.createElement("span");
+        status.className = "fw-upload-status";
+        const say = (t) => { status.textContent = t; };
+
+        // Hand a URL to the device. Every install route answers 202 and works on its own task, so
+        // the overlay reports progress rather than this response.
+        const installUrl = async (url) => {
+            if (kind === "app" && hasMoonBase) {
+                // The app is written FROM MoonBase, so this reboots twice and moonbaseUpdateFlow
+                // carries it across the handover.
+                moonbaseUpdateFlow({ url });
+                return;
+            }
+            const res = await fetch(k.urlRoute, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ url }),
+            });
+            if (!res.ok) throw new Error(await errorMessage(res));
+            watchInstall(k);
+        };
+
+        // -- the rows that ride the picker's seam ---------------------------------------
+        const extras = document.createElement("div");
+
+        const urlRow = document.createElement("div");
+        urlRow.className = "control-row fw-upload-row";
+        const urlLabel = document.createElement("span");
+        urlLabel.className = "control-label";
+        urlLabel.textContent = "URL";
+        const urlField = document.createElement("input");
+        urlField.type = "url";
+        urlField.className = "fw-url-field";
+        urlField.placeholder = kind === "moonbase"
+            ? "http://…/shared-moonbase-<chip>.bin" : "http://…/firmware.bin";
+        const urlBtn = document.createElement("button");
+        urlBtn.className = "fm-tool";
+        urlBtn.textContent = "Install";
+        urlBtn.addEventListener("click", async () => {
+            const url = urlField.value.trim();
+            if (!url) return;
+            if (k.confirm && !await k.confirm()) return;
+            urlBtn.disabled = true;
+            say("installing…");
+            try {
+                await installUrl(url);
+            } catch (err) {
+                say("install failed: " + err.message);
+            } finally {
+                urlBtn.disabled = false;
+            }
         });
+        urlRow.append(urlLabel, urlField, urlBtn);
+        extras.appendChild(urlRow);
 
-        // Install-from-file: pick a locally-built .bin and stream its bytes to /api/firmware/upload,
-        // which feeds platform::otaWriteStream (esp_ota_write). Complements the release picker above -
-        // the release path has the device fetch a URL; this path has the browser push the body, so a
-        // dev build that isn't a published release can be flashed straight over the network. The device
-        // reboots on success (no response body), so a completed POST that closes mid-flight is success.
         const fileRow = document.createElement("div");
-        fileRow.className = "fw-upload-row";
+        fileRow.className = "control-row fw-upload-row";
+        const fileLabel = document.createElement("span");
+        fileLabel.className = "control-label";
+        fileLabel.textContent = "File";
         const upBtn = document.createElement("button");
         upBtn.className = "fm-tool fm-tool--icon";
-        upBtn.textContent = "↥";   // same upload glyph as the file-manager toolbar
-        upBtn.title = "Install from file: flash a firmware .bin from your computer over the network (OTA)";
-        const upStatus = document.createElement("span");
-        upStatus.className = "fw-upload-status";
+        upBtn.textContent = "↥";
+        upBtn.title = `Install ${k.label.toLowerCase()} from a file on your computer`;
         const upInput = document.createElement("input");
         upInput.type = "file";
         upInput.accept = ".bin,application/octet-stream";
         upInput.style.display = "none";
         upInput.addEventListener("change", async () => {
             const file = (upInput.files || [])[0];
-            upInput.value = "";                   // reset so re-picking the same file re-fires change
+            upInput.value = "";                   // re-picking the same file re-fires change
             if (!file) return;
-            if (deviceHasMoonBase(mod)) {
-                // MoonBase device: reboot into MoonBase, then the browser pushes this file to it.
+            if (k.confirm && !await k.confirm()) return;
+            if (kind === "app" && hasMoonBase) {
+                // The app cannot flash itself: the browser pushes this file to MoonBase.
                 moonbaseUpdateFlow({ file });
                 return;
             }
             upBtn.disabled = true;
-            upStatus.textContent = `uploading ${fmSize(file.size)}…`;
+            // The overlay, like every other install. This is the one whose progress the DEVICE
+            // cannot report (the request stays open for the transfer), so the bar is driven from
+            // the upload itself, but a user should not have to know which install they picked to
+            // know where the progress appears.
+            const ui = showUpdateOverlay();
+            ui.status(`Installing ${fmSize(file.size)}…`);
             try {
-                const res = await fetch("/api/firmware/upload", {
-                    method: "POST", headers: { "Content-Type": "application/octet-stream" }, body: file,
-                });
-                // The device sends a 200 once the image is committed, THEN reboots: so res.ok is the
-                // real success signal. A 4xx/5xx carries the device's ota error in the JSON body.
-                if (res.ok) upStatus.textContent = "flashed: device rebooting";
-                else throw new Error(await errorMessage(res));
+                await uploadWithProgress(k.uploadRoute, file, ui);
+                if (k.reboots) {
+                    ui.status("Rebooting…");
+                    await fwSleep(4000);
+                } else {
+                    ui.status(`${k.label} installed`);
+                    await fwSleep(1200);
+                }
+                location.reload();
             } catch (err) {
-                // A network error mid-upload is a genuine failure now (the device answers before it
-                // reboots), so surface it as such rather than assuming a reboot.
-                upStatus.textContent = "upload failed: " + err.message;
+                ui.fail("Install failed: " + err.message);
             } finally {
                 upBtn.disabled = false;
             }
         });
         upBtn.addEventListener("click", () => upInput.click());
-        fileRow.appendChild(upBtn);
-        fileRow.appendChild(upStatus);
-        fileRow.appendChild(upInput);
-        // MoonBase devices: open the maintenance image directly: reboot into MoonBase and land
-        // on its page (same address, so a reload gets there once it answers). The way back is
-        // MoonBase's own "Boot the app" button.
-        if (deviceHasMoonBase(mod)) {
+        fileRow.append(fileLabel, upBtn, upInput);
+        extras.appendChild(fileRow);
+        extras.appendChild(status);
+
+        // -- the shared picker ----------------------------------------------------------
+        const mount = document.createElement("div");
+        mount.className = "install-picker-host";
+        controlsHost.appendChild(mount);
+        installPicker.init({
+            container: mount,
+            // MoonBase ships ONE image per chip rather than one per variant, so on that tab the
+            // picker offers the shared-moonbase assets and matches on the CHIP the device
+            // reports. Same component, same release list, a different asset family.
+            moonbaseOnly: kind === "moonbase",
+            // Both tabs read the SAME control: the device sets `firmware` to the variant on the
+            // app tab and to the chip on the MoonBase tab, precisely because that is what names
+            // the release asset in each case. Re-deriving the chip from SystemModule here was a
+            // second mechanism for a job the device had already done, with a JS transform
+            // ("ESP32-S3" -> "esp32s3") that merely coincided with the build system's naming.
+            ownFirmwareKey: moonbaseAssetKeyFrom(ctrlValue("firmware")),
+            // Device already knows its deviceModel (SystemModule): picker is for releases +
+            // firmware compatibility only. A board picker here would invite the user to
+            // mis-narrow the firmware list.
+            enableBoardPicker: false,
+            installRowExtras: extras,
+            // After the Install button, not before: these are other ways to install, so putting
+            // them above would separate that button from the two dropdowns it acts on.
+            extrasAfterInstall: true,
+            onInstall: async (_firmware, _manifestUrl, binaryUrl, entry) => {
+                // A desktop build has no OTA: it updates by downloading a new release and being
+                // replaced by hand. So hand the browser the file rather than POSTing to a route
+                // that would 501 here.
+                if (entry && entry.isDesktop) {
+                    const a = document.createElement("a");
+                    a.href = binaryUrl;
+                    a.rel = "noopener";
+                    a.target = "_blank";
+                    document.body.appendChild(a);
+                    a.click();
+                    a.remove();
+                    return;
+                }
+                if (k.confirm && !await k.confirm()) return;
+                await installUrl(binaryUrl);
+            },
+        });
+
+        // BELOW everything, because it belongs to neither image: rebooting into MoonBase is not
+        // an install, it is how a user reaches the recovery image to work there by hand.
+        if (hasMoonBase) {
+            const mbRow = document.createElement("div");
+            mbRow.className = "control-row fw-upload-row";
             const mbBtn = document.createElement("button");
             mbBtn.className = "fm-tool";
-            mbBtn.textContent = "MoonBase";
-            mbBtn.title = "Reboot into MoonBase, the maintenance image, install firmware, then boot back";
+            mbBtn.textContent = "Restart in MoonBase";
+            mbBtn.title = "Reboot into MoonBase, the maintenance image; its own page has the way back";
             mbBtn.addEventListener("click", async () => {
                 const ui = showUpdateOverlay();
-                ui.status("Restarting into MoonBase\u2026");
+                ui.status("Restarting into MoonBase…");
                 try { await fetch("/api/firmware/moonbase", { method: "POST" }); } catch (_) {}
                 if (await waitForMoonBase(Date.now() + 120000)) { location.reload(); return; }
                 ui.fail(MOONBASE_SILENT_MSG);
             });
-            fileRow.appendChild(mbBtn);
+            mbRow.appendChild(mbBtn);
+            controlsHost.appendChild(mbRow);
         }
-        controlsHost.appendChild(fileRow);
     }
 
     // -- Children block + footer --
@@ -1963,6 +2277,18 @@ function formatStats(mod) {
     return head + statusChip;
 }
 function formatStatsTitle(mod) {
+    // The tooltip carries the OTHER unit, so both readings are available without clicking: the
+    // card shows one, hovering says what it is in the other. A per-module fps is named as what it
+    // is, a rate this module alone could sustain, because read as a frame rate it is a claim about
+    // the whole pipeline made from one part of it.
+    const us = (mod.tickTimeUs !== undefined) ? mod.tickTimeUs : 0;
+    if (us > 0) {
+        const fps = Math.round(1_000_000 / us);
+        const other = timingMode === "fps"
+            ? (us < 1000 ? us + " µs" : (us / 1000).toFixed(2) + " ms") + " per tick"
+            : fps.toLocaleString() + " fps if this module ran alone";
+        return other + "  ·  click to toggle";
+    }
     return "Click to toggle fps/ms";
 }
 
@@ -3163,34 +3489,27 @@ function createControl(moduleName, moduleType, ctrl) {
                                 alert("could not download " + file + ": " + (e && e.message ? e.message : e));
                                 return;
                             }
-                            // The device re-lists its .mlp files on the next state fetch, so the
-                            // palette now HAS an index. Find it by name and select it, which is
-                            // what the user asked for by picking it.
+                            // The write itself republishes the option list: POST /api/file ends in
+                            // applyFileChanged() -> requestPrepareTree() -> Drivers::prepare(), which
+                            // re-lists the `.mlp` files. So one fetch after the download sees the new
+                            // palette and it selects in a single click, like every other script role.
                             mlCatalog = null;               // it is local now: drop the cached list
-                            const want = file.replace(/\.mlp$/, "");
-                            // The device only re-lists its .mlp files when its controls rebuild, which
-                            // can land a beat after the state fetch. So look, and if the new palette
-                            // is not there yet, fetch once more before giving up: without the retry a
-                            // download that worked ended in nothing happening and no message.
+                            // Match on the FILENAME, extension included: the device publishes each
+                            // scripted palette under its file name (`spectrum.mlp`), and only the
+                            // picker's displayName drops the extension. Comparing the stripped form
+                            // never matched, so a download that worked ended in an error.
                             const findCtrl = () => {
                                 const mod = allModules().find(m => m.name === moduleName);
                                 return mod && Array.isArray(mod.controls)
                                      && mod.controls.find(x => x.name === ctrl.name);
                             };
-                            const findIdx = () => ((findCtrl() || {}).options || [])
-                                                   .findIndex(o => o.name === want);
                             await refetchState();
-                            let idx = findIdx();
-                            if (idx < 0) {
-                                await new Promise(r => setTimeout(r, 600));
-                                await refetchState();
-                                idx = findIdx();
-                            }
+                            const idx = ((findCtrl() || {}).options || [])
+                                          .findIndex(o => o.name === file);
                             if (idx < 0) {
-                                // Downloaded, but the device has not published it. Say so: the file IS
-                                // on the device, so re-opening the picker will offer it.
-                                alert(want + " was downloaded but is not in the palette list yet - "
-                                      + "reopen the picker to select it.");
+                                // Only reachable if the device accepted the write and then did not
+                                // list the file, which is a device-side fault rather than a wait.
+                                alert("could not select " + file + ": the device saved it but does not list it");
                                 return;
                             }
                             const fresh = document.querySelector(
@@ -4773,6 +5092,21 @@ function syncVisibleControls(mod) {
     // other's rows in a loop: tearing down (and closing) any open <select>.
     const host = card.querySelector(":scope > .card-controls-collapse") || card;
 
+    // THE FIRMWARE CARD'S IMAGE TABS, which this patch path would otherwise never touch. The strip
+    // is built in createCard, and so are the install routes it implies: `kind` is captured in the
+    // handlers' closures. So a stale strip is not merely a wrong highlight, it is a card whose
+    // buttons write the OTHER partition than the one it names. Rebuild rather than repaint the
+    // highlight: the closures cannot be patched.
+    //
+    // The UI has two render paths and a rule must live in both (see renderChildTabs' updateTabDot,
+    // written for the other tab strip for exactly this reason).
+    const strip = card.querySelector(":scope > .tab-strip");
+    if (strip) {
+        const sel = (mod.controls.find(c => c.name === "image") || {}).value;
+        const shown = [...strip.children].findIndex(t => t.classList.contains("tab-active"));
+        if (sel !== undefined && shown >= 0 && shown !== sel) { renderCards(); return true; }
+    }
+
     const wantNames = mod.controls.filter(c => controlRendersGenerically(mod, c)).map(c => c.name);
     const haveRows = [...host.querySelectorAll(":scope > .control-row[data-key]")];
     const haveNames = haveRows.map(r => r.dataset.key);
@@ -5075,7 +5409,7 @@ function updateModuleControls(mod) {
 }
 
 // Per-type equality for reset-button highlighting. bool→boolish, ipv4/text→
-// string compare, everything else → numeric. Centralised so the rules can't
+// string compare, everything else → numeric. Centralized so the rules cannot
 // drift between createControl and updateModuleControls.
 function controlValuesEqual(ctrl, def) {
     if (ctrl.type === "bool") return !!ctrl.value === !!def;
@@ -5891,10 +6225,18 @@ function updateStatusBar() {
     const uptimeCtrl = ctrls.find(c => c.name === "uptime");
     const heapCtrl = ctrls.find(c => c.name === "heap");
     const blockCtrl = ctrls.find(c => c.name === "maxBlock");
+    const fpsCtrl = ctrls.find(c => c.name === "fps");
     const statsEl = document.getElementById("sys-stats");
     if (statsEl) {
         const parts = [];
         if (uptimeCtrl) parts.push(uptimeCtrl.value);
+        // The WHOLE pipeline's rate, which is the one place fps is the honest unit: the device
+        // really does complete this many frames a second, where a per-module fps is one part's
+        // cost inverted. Before the memory badges because it is the number that moves.
+        if (fpsCtrl && fpsCtrl.value) {
+            const f = Number(fpsCtrl.value);
+            parts.push("🕒 " + (f >= 1000 ? Math.round(f / 1000) + "K fps" : f + " fps"));
+        }
         if (heapCtrl && heapCtrl.value !== undefined && heapCtrl.total) {
             const freeKb = Math.round((heapCtrl.total - heapCtrl.value) / 1024);
             parts.push("🧠 " + freeKb + "K");
@@ -6035,6 +6377,13 @@ function deviceFirmwareInfo() {
     const fw = findModule("Firmware") || (state.modules.find(m => m.type === "FirmwareUpdateModule"));
     if (!fw) return null;
     const ctrls = fw.controls || [];
+    // ONLY WHILE THE CARD DESCRIBES THE APP. `image` rebinds version/build/firmware/partition to
+    // whichever partition is selected, so on the MoonBase tab these read MoonBase: the badge would
+    // then compare a recovery image's version against app releases and look for a firmware asset
+    // named after a chip. The badge is global chrome, so it would stay wrong for as long as the
+    // user left that tab selected.
+    const image = (ctrls.find(c => c.name === "image") || {}).value;
+    if (image === 1) return null;
     const version = (ctrls.find(c => c.name === "version") || {}).value;
     const firmware = (ctrls.find(c => c.name === "firmware") || {}).value;
     // "unknown" is what a desktop build reports: no ESP32 variant to name.
@@ -6059,6 +6408,18 @@ function showUpdateBadge(badge, tag, label, isDesktop) {
     badge.hidden = false;
 }
 
+// The key that names a release asset, from the device's own `firmware` control. On the app tab
+// that is already the variant ("esp32s3-n16r8"); on the MoonBase tab the device reports the chip
+// ("ESP32-S3"), which the asset spells "esp32s3" after the build directory's IDF target.
+//
+// Null when the control has not arrived: the picker treats that as "offer everything" rather than
+// as a key nothing matches, which is the difference between a full list and a silently empty one.
+function moonbaseAssetKeyFrom(fw) {
+    if (!fw) return null;
+    return /^ESP32/.test(fw) ? fw.toLowerCase().replace(/-/g, "") : fw;
+}
+
+
 // Is there a newer STABLE release than the device's version, with a compatible .bin?
 // Returns the stable tag (e.g. "v2.1.0") or null. /latest excludes prereleases.
 async function stableUpdate(dev, force) {
@@ -7118,6 +7479,8 @@ function fmMountEditor(host, relPath, opts = {}) {
     // the check while the first request is still in flight. Saves are serialized rather than
     // dropped, because the second trigger may carry newer keystrokes than the first.
     let saving = null;
+    /// The file's text as it was LOADED, for the no-op fork check in save().
+    let loadedText = null;
     const save = () => {
         if (body.readOnly || !dirty || !path) return Promise.resolve();
         saving = (saving || Promise.resolve()).then(async () => {
@@ -7125,6 +7488,17 @@ function fmMountEditor(host, relPath, opts = {}) {
             const saved = body.value;                       // what THIS request writes
             status.textContent = "saving…";
             const dest = savePath ? savePath(path) : path;
+            // A FORK THAT CHANGES NOTHING IS NOT A FORK. When the destination differs from the file
+            // that was read, saving creates a user copy that shadows the shipped one forever: every
+            // later library update becomes invisible behind it. If the text is byte-identical to
+            // what was read, there is nothing to shadow it WITH, so write nothing and let the
+            // shipped copy keep winning. Opening a script and pressing Save is otherwise enough to
+            // pin it at today's version, which is the trap this whole mechanism exists to avoid.
+            if (dest !== path && loadedText !== null && saved === loadedText) {
+                status.textContent = "unchanged";
+                setDirty(false);
+                return;
+            }
             const r = await fmSaveFrom(body, dest);
             status.textContent = r.message;
             // A failed write (no space, a vanished path) must not be silent. The modal shows it on
@@ -7135,9 +7509,15 @@ function fmMountEditor(host, relPath, opts = {}) {
             // request means there are newer bytes on screen that nobody has saved yet.
             if (r.ok && body.value === saved) {
                 setDirty(false);
+                // The fork EXISTS now, so this pane is editing it rather than the file it came
+                // from. Without this the no-op guard above keeps comparing against the shipped
+                // copy: editing back to the original text would report "unchanged" and skip the
+                // write, leaving the user's file holding the previous edit.
+                path = dest;
+                loadedText = saved;
                 // Report where it LANDED, not where it came from: a caller that refreshes a listing
                 // needs to know a new file now exists in the user's directory.
-                if (onSaved) onSaved(savePath ? savePath(path) : path);
+                if (onSaved) onSaved(dest);
             }
         });
         return saving;
@@ -7185,6 +7565,9 @@ function fmMountEditor(host, relPath, opts = {}) {
         }
         const r = await fmLoadInto(body, path, size, ac.signal);
         if (r.aborted || ac !== loadAbort) return;   // a newer load started: that one owns the pane
+        // What arrived, so save() can tell a real edit from an untouched file. Only used when the
+        // save destination differs from the read path (a factory script being forked).
+        loadedText = body.value;
         body.readOnly = r.readOnly;
         saveBtn.disabled = r.readOnly;
         paintHighlight();          // the file just arrived: paint what it says
diff --git a/src/ui/install-picker.js b/src/ui/install-picker.js
index 51338562..21d8f7f8 100644
--- a/src/ui/install-picker.js
+++ b/src/ui/install-picker.js
@@ -88,6 +88,8 @@ function makeState() {
         // the node on every render(), so the same instance survives the
         // re-renders triggered by release-list reloads.
         installRowExtras: null,
+        extrasAfterInstall: false,
+        moonbaseOnly: false,
         releases: [],          // normalised release records from the API
         sortedReleases: [],    // releases sorted newest-first; render() fills this
         releaseIdx: 0,         // index into sortedReleases
@@ -176,7 +178,7 @@ async function loadReleases({ bypassCache = false } = {}) {
 // firmware-<firmware>-v<ver>(.bin|-bootloader.bin|-partition-table.bin|-ota-data.bin).
 // The picker needs: per-firmware → {manifestUrl, binaryUrl}. Manifest URL drives
 // ESP Web Tools (web installer); binary URL drives /api/firmware/url (device OTA).
-function parseFirmwaresFromAssets(assets, tag) {
+function parseFirmwaresFromAssets(assets, tag, moonbaseOnly = false) {
     if (!assets) return [];
     const firmwares = new Map();
     const manifestRe = /^manifest-(.+)\.json$/;
@@ -223,11 +225,27 @@ function parseFirmwaresFromAssets(assets, tag) {
     }
 
     for (const a of assets) {
-        // Reject the part-suffixed .bins (bootloader / partition-table / ota-data /
-        // moonbase): they're install fragments, not the main image. The OTA path needs
-        // the app image only. The shared-moonbase asset is doubly excluded (the `shared-`
-        // prefix already fails binaryRe): offering MoonBase as an OTA target would replace
-        // a device's app with an image that can only install, not run the show.
+        // MoonBase, when the caller asked for it. `shared-moonbase-<chip>.bin` is one image per
+        // CHIP rather than per variant, and it has no manifest of its own, so it is admitted here
+        // and exempted from the manifest requirement below.
+        //
+        // Only the ON-DEVICE card asks. The web installer writes MoonBase already, and always
+        // has: a serial flash applies the whole manifest, which stages this same asset at the
+        // factory offset (generate_manifest.py). What is new is installing it OVER THE NETWORK,
+        // into a device whose recovery image is broken and which therefore cannot be reached the
+        // usual way without a cable. So this mode is off by default and the installer is
+        // unaffected: it was excluded outright while the only network route wrote the APP slot,
+        // where an image that can install but not run the show would have been a brick.
+        if (moonbaseOnly) {
+            const mb = /^shared-moonbase-(.+)\.bin$/.exec(a.name);
+            if (mb) {
+                firmwares.set(mb[1], { firmware: mb[1], manifestUrl: null,
+                                       binaryUrl: a.browser_download_url, isMoonBase: true });
+            }
+            continue;
+        }
+        // Reject the part-suffixed .bins (bootloader / partition-table / ota-data / moonbase):
+        // they're install fragments, not the main image. The OTA path needs the app image only.
         if (/(?:-(?:bootloader|partition-table|ota-data)|moonbase[^/]*|-slot0)\.bin$/.test(a.name)) continue;
         const m = binaryRe.exec(a.name);
         if (m) {
@@ -241,7 +259,7 @@ function parseFirmwaresFromAssets(assets, tag) {
     // mid-release-publish race) shouldn't appear in the dropdown. A desktop archive has no
     // manifest by nature (there is nothing to flash), so it qualifies on its download alone.
     return Array.from(firmwares.values())
-        .filter(f => f.binaryUrl && (f.manifestUrl || f.isDesktop));
+        .filter(f => f.binaryUrl && (f.manifestUrl || f.isDesktop || f.isMoonBase));
 }
 
 // Merge a release's published firmwares with locally-staged extras (preview only).
@@ -423,7 +441,13 @@ function render(state) {
     // keep firing across renders.
     if (state.installRowExtras) {
         const installRow = state.container.querySelector("#rp-install-row");
-        state.container.insertBefore(state.installRowExtras, installRow);
+        // BEFORE the Install row by default, which is where an option that MODIFIES the install
+        // belongs (the web installer's erase checkbox). `extrasAfterInstall` puts them after
+        // instead, for rows that are alternative ways to install rather than options on this one:
+        // the device card's URL and File rows, which otherwise pushed the Install button away
+        // from the two dropdowns it acts on.
+        if (state.extrasAfterInstall) installRow.after(state.installRowExtras);
+        else state.container.insertBefore(state.installRowExtras, installRow);
     }
 
     const boardEl = state.container.querySelector("#rp-board");
@@ -515,7 +539,12 @@ function render(state) {
         const wantDesktop = state.ownFirmwareKey === "unknown";
         let compatible = (r.firmwares || [])
             .filter(f => !!f.isDesktop === wantDesktop)
-            .filter(f => isCompatible(state.ownFirmwareKey, f.firmware));
+            // A MoonBase key is a CHIP ("esp32s3"), not a firmware variant, so the variant rule
+            // (which strips -eth and compares) does not apply: an exact chip match is the whole
+            // question, and offering another chip's image is what the device's own header check
+            // exists to refuse.
+            .filter(f => state.moonbaseOnly ? f.firmware === state.ownFirmwareKey
+                                            : isCompatible(state.ownFirmwareKey, f.firmware));
         // Narrow by selected board (web installer only — selectedBoard stays
         // null on the on-device picker since the board <select> isn't rendered).
         // Defensive: a board the user picked that isn't in the catalog (e.g.
@@ -824,6 +853,7 @@ export const installPicker = {
      */
     async init({ container, ownFirmwareKey, onInstall, onDetect = null,
                  enableBoardPicker = true, installRowExtras = null, hasPort = null,
+                 moonbaseOnly = false, extrasAfterInstall = false,
                  boardSupport = null, extraFirmwaresByTag = null }) {
         const state = makeState();
         state.container = container;
@@ -832,6 +862,10 @@ export const installPicker = {
         state.onDetect = onDetect;
         state.enableBoardPicker = enableBoardPicker;
         state.installRowExtras = installRowExtras;
+        state.extrasAfterInstall = extrasAfterInstall;
+        // Offer the MOONBASE image instead of the app firmwares: one per chip, unversioned, and
+        // installed into the factory slot. The on-device card sets this from its image selector.
+        state.moonbaseOnly = moonbaseOnly;
         state.hasPort = hasPort;
         state.boardSupport = boardSupport;
 
@@ -874,7 +908,7 @@ export const installPicker = {
             published_at: r.published_at || r.created_at,
             html_url: r.html_url,
             firmwares: mergeFirmwares(
-                parseFirmwaresFromAssets(r.assets, r.tag_name),
+                parseFirmwaresFromAssets(r.assets, r.tag_name, state.moonbaseOnly),
                 extraFirmwaresByTag && extraFirmwaresByTag[r.tag_name]),
         }))
         // Drop releases with zero usable firmwares (no firmware-* / manifest-* assets).
diff --git a/src/ui/style.css b/src/ui/style.css
index 7bb06044..22052d16 100644
--- a/src/ui/style.css
+++ b/src/ui/style.css
@@ -1711,11 +1711,20 @@ body.cards-resizing {
 .fm-bar {
     display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin-bottom: 8px;
 }
-/* Install-from-file row under the Firmware card: the .bin picker button + its live status. */
+/* The URL and File rows under the Firmware card. They carry .control-row too, so their labels sit
+   in the same 100px column as the picker's Release and Firmware rows above them: one column
+   definition rather than two numbers kept in step by hand. */
 .fw-upload-row {
-    display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin-top: 8px;
+    flex-wrap: wrap; gap: 8px;
 }
-.fw-upload-status { color: var(--muted); font-size: 0.85em; }
+.fw-upload-status { color: var(--fg-muted); font-size: 0.85em; }
+/* The URL a device should fetch. Grows to fill the row so a long release URL stays readable. */
+.fw-url-field {
+    flex: 1 1 12em; min-width: 0; padding: 4px 8px;
+    border: 1px solid var(--border); border-radius: 6px;
+    background: var(--bg-0); color: var(--fg); font: inherit; font-size: 0.85em;
+}
+
 .fm-crumb {
     background: none; border: none; color: var(--accent); cursor: pointer;
     padding: 2px 4px; border-radius: 4px; font: inherit;
@@ -1788,6 +1797,23 @@ body.cards-resizing {
 .fm-usage progress { flex: 1 1 auto; height: 8px; }
 .fm-usage-label { flex: 0 0 auto; font-variant-numeric: tabular-nums; }
 
+/* Asking before a MoonBase install: the app's own chrome, not the browser's. A native confirm()
+   is the one box in this UI that cannot be styled, and it showed as a white system panel over a
+   dark card. Same <dialog> element the editor uses, so Esc and the backdrop work unaided. */
+.mb-ask {
+    width: min(420px, 92vw); padding: 16px 18px;
+    border: 1px solid var(--border); border-radius: 10px;
+    background: var(--card-bg-0); color: var(--fg);
+}
+.mb-ask::backdrop { background: rgba(0,0,0,0.5); }
+.mb-ask h3 { margin: 0 0 10px; font-size: 1rem; }
+.mb-ask p { margin: 0 0 10px; font-size: 0.9em; line-height: 1.45; }
+/* The reassurance reads quieter than the warning above it: the point is that a mistake is cheap,
+   which should not compete with the sentence saying what is at stake. */
+.mb-ask-calm { color: var(--fg-muted); }
+.mb-ask-row { display: flex; justify-content: flex-end; gap: 8px; }
+.mb-ask-go { background: var(--accent); color: var(--bg-0); }
+
 /* Inline editor — native <dialog>, sized to a comfortable text pane. */
 .fm-editor {
     width: min(720px, 92vw); max-height: 82vh; padding: 0;
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
index 9ee9487e..a41f97bf 100644
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -41,6 +41,7 @@ add_executable(mm_tests
     unit/core/unit_ControlModule.cpp
     unit/core/unit_FilesystemModule_subtree.cpp
     unit/core/unit_FirmwareUpdateModule.cpp
+    unit/core/unit_FirmwareImage.cpp
     unit/core/unit_HttpServerModule_apply.cpp
     unit/core/unit_ImprovFrame.cpp
     unit/core/unit_ImprovOpReassembler.cpp
@@ -88,6 +89,7 @@ add_executable(mm_tests
     unit/light/unit_WledAudioSyncPacket.cpp
     unit/light/unit_BlendMap.cpp
     unit/light/unit_BeatRipples.cpp
+    unit/light/unit_ColorTrailsEffect.cpp
     unit/light/unit_fluid.cpp
     unit/light/unit_draw.cpp
     unit/light/unit_GameOfLifeEffect.cpp
@@ -116,7 +118,9 @@ add_executable(mm_tests
     unit/light/unit_DistortionWavesEffect.cpp
     unit/light/unit_Correction.cpp
     unit/light/unit_MovingHeadEffect.cpp
+    unit/light/unit_FixedPointEffect.cpp
     unit/light/unit_Drivers_container.cpp
+    unit/light/unit_Drivers_livePalettes.cpp
     unit/light/unit_Drivers_rendersplit.cpp
     unit/light/unit_LightPresetsModule.cpp
     unit/light/unit_Drivers_firstOutputRgb.cpp
diff --git a/test/js/ui-picker-scripts.test.mjs b/test/js/ui-picker-scripts.test.mjs
index df0c52d3..52ab58ea 100644
--- a/test/js/ui-picker-scripts.test.mjs
+++ b/test/js/ui-picker-scripts.test.mjs
@@ -22,7 +22,10 @@ function fnSource(name) {
     const at = src.indexOf(`function ${name}(`);
     assert.notEqual(at, -1, `${name} not found in app.js`);
     const from = src.startsWith("async ", at - 6) ? at - 6 : at;
-    const open = src.indexOf("{", at);
+    // The BODY's brace, not the first one after the name: a defaulted object parameter
+    // (`opts = {}`) puts a brace inside the parameter list, and matching from there returned the
+    // signature alone. Skip past the closing parenthesis first.
+    const open = src.indexOf("{", src.indexOf(")", src.indexOf("(", at)) );
     let depth = 0;
     for (let i = open; i < src.length; i++) {
         if (src[i] === "{") depth++;
@@ -169,3 +172,32 @@ test("a replaced card is found by POSITION, so a name collision still reaches th
     assert.match(body.slice(replaceAt), /children\[index\]/,
                  "afterwards the slot is read at that index, not by a name that may not be its own");
 });
+
+// A FORK THAT CHANGES NOTHING IS NOT A FORK.
+//
+// Opening a shipped script and pressing Save (or clicking away, which also saves) used to write a
+// user copy byte-identical to the shipped one. That copy then shadows the library forever: every
+// later update is invisible behind a "change" the user never made. The editor therefore compares
+// what is on screen against what it loaded, and writes nothing when they match.
+//
+// Pinned on the SOURCE rather than through a DOM harness for the reason at the top of this file:
+// the guard lives inside fmMountEditor's closure, and what matters is that all three of its parts
+// are present, in the right order, against the right variable.
+test("saving an unmodified factory script does not create a shadowing copy", () => {
+    const editor = fnSource("fmMountEditor");
+
+    // The text as loaded is remembered, so an untouched file can be recognized.
+    assert.match(editor, /loadedText = body\.value/,
+                 "fmMountEditor must remember the text it loaded");
+
+    // The guard: only when the write goes somewhere other than the read (a fork), and only when
+    // nothing changed. Both conditions, or it would suppress a real save.
+    const guard = /dest !== path && loadedText !== null && saved === loadedText/;
+    assert.match(editor, guard, "the no-op fork guard must test destination AND content");
+
+    // It must sit BEFORE the write, or the file is created and the check is decoration.
+    const guardAt = editor.search(guard);
+    const writeAt = editor.indexOf("fmSaveFrom(body, dest)");
+    assert.ok(guardAt > -1 && writeAt > -1 && guardAt < writeAt,
+              "the guard must run before the write it prevents");
+});
diff --git a/test/scenario_runner.cpp b/test/scenario_runner.cpp
index 746da23a..673c2438 100644
--- a/test/scenario_runner.cpp
+++ b/test/scenario_runner.cpp
@@ -42,7 +42,6 @@
 #include "light/drivers/PreviewDriver.h"
 #include "core/SystemModule.h"
 #include "core/AudioService.h"
-#include "light/effects/AudioVolumeEffect.h"
 #include "light/effects/RadialSpectrumEffect.h"
 #include "light/effects/VuMetersEffect.h"
 #include "light/effects/BeatRipplesEffect.h"
@@ -248,7 +247,6 @@ static void registerScenarioTypes() {
     mm::ModuleFactory::registerType<mm::PreviewDriver>("PreviewDriver");
     mm::ModuleFactory::registerType<mm::SystemModule>("SystemModule");
     mm::ModuleFactory::registerType<mm::AudioService>("AudioService");
-    mm::ModuleFactory::registerType<mm::AudioVolumeEffect>("AudioVolumeEffect");
     mm::ModuleFactory::registerType<mm::RadialSpectrumEffect>("RadialSpectrumEffect");
     mm::ModuleFactory::registerType<mm::VuMetersEffect>("VuMetersEffect");
     mm::ModuleFactory::registerType<mm::BeatRipplesEffect>("BeatRipplesEffect");
diff --git a/test/scenarios/core/scenario_MoonModule_control_change.json b/test/scenarios/core/scenario_MoonModule_control_change.json
index 5de41c53..70c525b1 100644
--- a/test/scenarios/core/scenario_MoonModule_control_change.json
+++ b/test/scenarios/core/scenario_MoonModule_control_change.json
@@ -117,14 +117,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 144,
+            "p50": 143,
             "p95": 248,
             "min": 117,
             "max": 302,
             "n": 32,
-            "samples": [203, 129, 133, 243, 248, 246, 127, 204, 143, 150, 150, 175, 205, 179, 191, 127, 202, 119, 121, 118, 120, 199, 193, 117, 144, 302, 129, 118, 246, 120, 133, 122]
+            "samples": [243, 248, 246, 127, 204, 143, 150, 150, 175, 205, 179, 191, 127, 202, 119, 121, 118, 120, 199, 193, 117, 144, 302, 129, 118, 246, 120, 133, 122, 121, 122, 126]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "tick_us": {
@@ -299,14 +299,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 134,
+            "p50": 133,
             "p95": 247,
             "min": 117,
             "max": 260,
             "n": 32,
-            "samples": [205, 130, 134, 238, 247, 238, 126, 196, 146, 147, 159, 171, 203, 182, 135, 128, 132, 119, 120, 118, 118, 131, 134, 117, 133, 135, 146, 121, 260, 123, 118, 120]
+            "samples": [238, 247, 238, 126, 196, 146, 147, 159, 171, 203, 182, 135, 128, 132, 119, 120, 118, 118, 131, 134, 117, 133, 135, 146, 121, 260, 123, 118, 120, 124, 123, 137]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "tick_us": {
@@ -486,9 +486,9 @@
             "min": 116,
             "max": 240,
             "n": 32,
-            "samples": [204, 130, 133, 240, 239, 238, 126, 186, 147, 148, 158, 173, 206, 180, 126, 128, 118, 121, 121, 118, 116, 116, 122, 117, 122, 129, 122, 121, 152, 122, 120, 120]
+            "samples": [240, 239, 238, 126, 186, 147, 148, 158, 173, 206, 180, 126, 128, 118, 121, 121, 118, 116, 116, 122, 117, 122, 129, 122, 121, 152, 122, 120, 120, 126, 123, 128]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "tick_us": {
@@ -671,14 +671,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 127,
+            "p50": 124,
             "p95": 247,
             "min": 117,
             "max": 261,
             "n": 32,
-            "samples": [205, 129, 131, 261, 247, 241, 127, 186, 148, 148, 157, 174, 192, 182, 127, 128, 120, 119, 120, 118, 118, 120, 123, 117, 122, 141, 124, 121, 151, 122, 119, 121]
+            "samples": [261, 247, 241, 127, 186, 148, 148, 157, 174, 192, 182, 127, 128, 120, 119, 120, 118, 118, 120, 123, 117, 122, 141, 124, 121, 151, 122, 119, 121, 123, 121, 129]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_Audio_mutation.json b/test/scenarios/light/scenario_Audio_mutation.json
index 9c67b2ac..d7d6ddb7 100644
--- a/test/scenarios/light/scenario_Audio_mutation.json
+++ b/test/scenarios/light/scenario_Audio_mutation.json
@@ -9,7 +9,6 @@
     "GridLayout",
     "Layer",
     "RainbowEffect",
-    "AudioVolumeEffect",
     "AudioSpectrumEffect",
     "Drivers",
     "PreviewDriver"
@@ -110,9 +109,9 @@
             "min": 16,
             "max": 48,
             "n": 32,
-            "samples": [21, 35, 21, 21, 21, 32, 24, 38, 46, 48, 27, 25, 16, 20, 16, 20, 20, 17, 17, 16, 16, 17, 17, 17, 19, 26, 16, 17, 25, 19, 20, 20]
+            "samples": [21, 21, 32, 24, 38, 46, 48, 27, 25, 16, 20, 16, 20, 20, 17, 17, 16, 16, 17, 17, 17, 19, 26, 16, 17, 25, 19, 20, 20, 17, 20, 22]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -207,9 +206,9 @@
             "min": 17,
             "max": 137,
             "n": 32,
-            "samples": [25, 35, 34, 70, 30, 33, 26, 53, 66, 59, 35, 38, 18, 22, 17, 17, 19, 28, 27, 22, 17, 19, 20, 37, 22, 28, 24, 137, 27, 17, 20, 19]
+            "samples": [70, 30, 33, 26, 53, 66, 59, 35, 38, 18, 22, 17, 17, 19, 28, 27, 22, 17, 19, 20, 37, 22, 28, 24, 137, 27, 17, 20, 19, 39, 20, 31]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -321,9 +320,9 @@
             "min": 17,
             "max": 66,
             "n": 32,
-            "samples": [18, 32, 40, 66, 28, 33, 28, 57, 60, 63, 45, 44, 37, 20, 17, 18, 20, 19, 25, 18, 18, 19, 19, 21, 26, 28, 30, 40, 32, 26, 18, 20]
+            "samples": [66, 28, 33, 28, 57, 60, 63, 45, 44, 37, 20, 17, 18, 20, 19, 25, 18, 18, 19, 19, 21, 26, 28, 30, 40, 32, 26, 18, 20, 36, 21, 25]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -394,10 +393,10 @@
     },
     {
       "name": "add-audio-consumer",
-      "description": "Add an AudioVolumeEffect consumer under the Layer. It reads the mic via the static accessor; with the mic present it gets the live (silent, on host) frame.",
+      "description": "Add an AudioSpectrumEffect consumer under the Layer. It reads the mic via the static accessor; with the mic present it gets the live (silent, on host) frame.",
       "op": "add_module",
       "id": "Vol",
-      "type": "AudioVolumeEffect",
+      "type": "AudioSpectrumEffect",
       "parent_id": "Layer"
     },
     {
@@ -418,9 +417,9 @@
             "min": 19,
             "max": 75,
             "n": 32,
-            "samples": [20, 38, 27, 66, 26, 36, 30, 62, 75, 68, 45, 45, 20, 23, 20, 21, 20, 21, 31, 20, 20, 21, 19, 22, 24, 28, 31, 44, 29, 29, 21, 24]
+            "samples": [66, 26, 36, 30, 62, 75, 68, 45, 45, 20, 23, 20, 21, 20, 21, 31, 20, 20, 21, 19, 22, 24, 28, 31, 44, 29, 29, 21, 24, 30, 24, 30]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -508,14 +507,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 23,
+            "p50": 22,
             "p95": 69,
             "min": 19,
             "max": 80,
             "n": 32,
-            "samples": [21, 32, 33, 69, 25, 37, 28, 65, 67, 62, 41, 80, 19, 21, 21, 21, 20, 22, 27, 20, 21, 19, 19, 21, 30, 28, 22, 29, 36, 19, 21, 23]
+            "samples": [69, 25, 37, 28, 65, 67, 62, 41, 80, 19, 21, 21, 21, 20, 22, 27, 20, 21, 19, 19, 21, 30, 28, 22, 29, 36, 19, 21, 23, 25, 21, 21]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -608,9 +607,9 @@
             "min": 16,
             "max": 87,
             "n": 32,
-            "samples": [26, 29, 38, 87, 23, 32, 25, 52, 79, 57, 29, 33, 18, 26, 20, 19, 19, 17, 17, 17, 16, 17, 17, 21, 17, 25, 17, 20, 24, 19, 17, 20]
+            "samples": [87, 23, 32, 25, 52, 79, 57, 29, 33, 18, 26, 20, 19, 19, 17, 17, 17, 16, 17, 17, 21, 17, 25, 17, 20, 24, 19, 17, 20, 22, 21, 19]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_Aurora_fps.json b/test/scenarios/light/scenario_Aurora_fps.json
index b848e2a8..9bafe0ed 100644
--- a/test/scenarios/light/scenario_Aurora_fps.json
+++ b/test/scenarios/light/scenario_Aurora_fps.json
@@ -84,14 +84,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 855,
+            "p50": 856,
             "p95": 1391,
             "min": 474,
             "max": 1527,
-            "n": 23,
-            "samples": [478, 474, 650, 786, 803, 855, 835, 843, 890, 827, 841, 871, 845, 856, 1391, 863, 858, 885, 1527, 1317, 853, 859, 861]
+            "n": 26,
+            "samples": [478, 474, 650, 786, 803, 855, 835, 843, 890, 827, 841, 871, 845, 856, 1391, 863, 858, 885, 1527, 1317, 853, 859, 861, 1047, 962, 1024]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -118,10 +118,10 @@
             "p95": 449,
             "min": 207,
             "max": 495,
-            "n": 23,
-            "samples": [207, 207, 208, 307, 311, 320, 316, 318, 317, 317, 321, 334, 312, 322, 355, 335, 322, 495, 395, 449, 317, 318, 317]
+            "n": 26,
+            "samples": [207, 207, 208, 307, 311, 320, 316, 318, 317, 317, 321, 334, 312, 322, 355, 335, 322, 495, 395, 449, 317, 318, 317, 431, 362, 359]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -148,10 +148,10 @@
             "p95": 245,
             "min": 127,
             "max": 254,
-            "n": 23,
-            "samples": [127, 127, 128, 185, 183, 189, 187, 192, 186, 185, 188, 196, 187, 187, 254, 187, 188, 222, 232, 245, 186, 188, 185]
+            "n": 26,
+            "samples": [127, 127, 128, 185, 183, 189, 187, 192, 186, 185, 188, 196, 187, 187, 254, 187, 188, 222, 232, 245, 186, 188, 185, 201, 205, 212]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -178,10 +178,10 @@
             "p95": 702,
             "min": 303,
             "max": 720,
-            "n": 23,
-            "samples": [304, 303, 306, 530, 532, 554, 540, 544, 551, 551, 554, 581, 543, 554, 560, 550, 553, 567, 702, 720, 550, 545, 552]
+            "n": 26,
+            "samples": [304, 303, 306, 530, 532, 554, 540, 544, 551, 551, 554, 581, 543, 554, 560, 550, 553, 567, 702, 720, 550, 545, 552, 583, 570, 599]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -204,14 +204,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 950,
+            "p50": 952,
             "p95": 1158,
             "min": 474,
             "max": 1236,
-            "n": 23,
-            "samples": [474, 474, 480, 921, 919, 974, 933, 936, 938, 945, 964, 997, 937, 956, 1236, 950, 953, 952, 1158, 1152, 946, 1029, 970]
+            "n": 26,
+            "samples": [474, 474, 480, 921, 919, 974, 933, 936, 938, 945, 964, 997, 937, 956, 1236, 950, 953, 952, 1158, 1152, 946, 1029, 970, 1026, 955, 1046]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -234,14 +234,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 1472,
+            "p50": 1473,
             "p95": 1871,
             "min": 785,
             "max": 2116,
-            "n": 22,
-            "samples": [937, 785, 1419, 1423, 1465, 1430, 1562, 1455, 1458, 1483, 2116, 1446, 1497, 1493, 1472, 1467, 1490, 1853, 1666, 1473, 1474, 1871]
+            "n": 25,
+            "samples": [937, 785, 1419, 1423, 1465, 1430, 1562, 1455, 1458, 1483, 2116, 1446, 1497, 1493, 1472, 1467, 1490, 1853, 1666, 1473, 1474, 1871, 1512, 1472, 1672]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -264,14 +264,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 1514,
+            "p50": 1518,
             "p95": 1828,
             "min": 507,
             "max": 1920,
-            "n": 23,
-            "samples": [507, 814, 821, 1496, 1511, 1506, 1491, 1494, 1498, 1506, 1574, 1920, 1494, 1564, 1543, 1622, 1526, 1556, 1761, 1695, 1534, 1514, 1828]
+            "n": 26,
+            "samples": [507, 814, 821, 1496, 1511, 1506, 1491, 1494, 1498, 1506, 1574, 1920, 1494, 1564, 1543, 1622, 1526, 1556, 1761, 1695, 1534, 1514, 1828, 1601, 1518, 1642]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -294,14 +294,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 1117,
+            "p50": 1118,
             "p95": 1211,
             "min": 333,
             "max": 1303,
-            "n": 23,
-            "samples": [333, 643, 658, 1103, 1079, 1108, 1092, 1096, 1104, 1118, 1165, 1211, 1103, 1135, 1128, 1137, 1120, 1131, 1303, 1210, 1117, 1118, 1105]
+            "n": 26,
+            "samples": [333, 643, 658, 1103, 1079, 1108, 1092, 1096, 1104, 1118, 1165, 1211, 1103, 1135, 1128, 1137, 1120, 1131, 1303, 1210, 1117, 1118, 1105, 1167, 1161, 1167]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     }
diff --git a/test/scenarios/light/scenario_Driver_mutation.json b/test/scenarios/light/scenario_Driver_mutation.json
index 61617d88..e6bc91b8 100644
--- a/test/scenarios/light/scenario_Driver_mutation.json
+++ b/test/scenarios/light/scenario_Driver_mutation.json
@@ -77,13 +77,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 20,
-            "p95": 99,
+            "p95": 88,
             "min": 16,
             "max": 147,
             "n": 32,
-            "samples": [56, 18, 99, 32, 36, 147, 25, 37, 25, 51, 73, 88, 61, 43, 17, 21, 17, 20, 20, 17, 19, 20, 19, 18, 21, 16, 19, 19, 17, 19, 18, 20]
+            "samples": [32, 36, 147, 25, 37, 25, 51, 73, 88, 61, 43, 17, 21, 17, 20, 20, 17, 19, 20, 19, 18, 21, 16, 19, 19, 17, 19, 18, 20, 18, 17, 17]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -174,13 +174,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 20,
-            "p95": 68,
+            "p95": 65,
             "min": 16,
             "max": 73,
             "n": 32,
-            "samples": [68, 19, 25, 37, 51, 73, 26, 32, 25, 47, 65, 59, 59, 45, 17, 22, 17, 20, 20, 17, 27, 20, 20, 20, 23, 16, 20, 20, 18, 20, 20, 20]
+            "samples": [37, 51, 73, 26, 32, 25, 47, 65, 59, 59, 45, 17, 22, 17, 20, 20, 17, 27, 20, 20, 20, 23, 16, 20, 20, 18, 20, 20, 20, 23, 17, 17]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -270,14 +270,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 21,
-            "p95": 64,
+            "p50": 20,
+            "p95": 63,
             "min": 16,
-            "max": 67,
+            "max": 64,
             "n": 32,
-            "samples": [67, 25, 24, 36, 37, 61, 25, 32, 25, 48, 64, 63, 52, 46, 21, 18, 20, 20, 20, 20, 24, 20, 20, 21, 17, 16, 20, 19, 17, 20, 20, 20]
+            "samples": [36, 37, 61, 25, 32, 25, 48, 64, 63, 52, 46, 21, 18, 20, 20, 20, 20, 24, 20, 20, 21, 17, 16, 20, 19, 17, 20, 20, 20, 21, 18, 17]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -366,13 +366,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 20,
-            "p95": 83,
+            "p95": 76,
             "min": 17,
             "max": 173,
             "n": 32,
-            "samples": [83, 20, 25, 33, 25, 49, 31, 38, 27, 55, 173, 76, 54, 47, 20, 24, 20, 20, 20, 17, 19, 20, 20, 17, 19, 20, 20, 19, 21, 19, 20, 20]
+            "samples": [33, 25, 49, 31, 38, 27, 55, 173, 76, 54, 47, 20, 24, 20, 20, 20, 17, 19, 20, 20, 17, 19, 20, 20, 19, 21, 19, 20, 20, 20, 20, 17]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -465,9 +465,9 @@
             "min": 17,
             "max": 316,
             "n": 32,
-            "samples": [50, 20, 20, 32, 29, 62, 28, 35, 26, 59, 316, 66, 36, 52, 21, 21, 20, 20, 20, 17, 23, 20, 20, 19, 20, 20, 20, 19, 17, 19, 19, 19]
+            "samples": [32, 29, 62, 28, 35, 26, 59, 316, 66, 36, 52, 21, 21, 20, 20, 20, 17, 23, 20, 20, 19, 20, 20, 20, 19, 17, 19, 19, 19, 21, 20, 17]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_Effects_composition.json b/test/scenarios/light/scenario_Effects_composition.json
index d9ecc176..55d1c943 100644
--- a/test/scenarios/light/scenario_Effects_composition.json
+++ b/test/scenarios/light/scenario_Effects_composition.json
@@ -106,14 +106,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 169,
+            "p50": 148,
             "p95": 768,
             "min": 142,
             "max": 1044,
             "n": 32,
-            "samples": [646, 253, 263, 426, 343, 1044, 366, 485, 370, 731, 711, 768, 496, 497, 248, 248, 146, 142, 146, 152, 145, 146, 148, 144, 145, 147, 148, 164, 169, 144, 147, 144]
+            "samples": [343, 1044, 366, 485, 370, 731, 711, 768, 496, 497, 248, 248, 146, 142, 146, 152, 145, 146, 148, 144, 145, 147, 148, 164, 169, 144, 147, 144, 147, 146, 143, 152]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_Fields_polar_lut.json b/test/scenarios/light/scenario_Fields_polar_lut.json
index 610c6cab..f3c1a329 100644
--- a/test/scenarios/light/scenario_Fields_polar_lut.json
+++ b/test/scenarios/light/scenario_Fields_polar_lut.json
@@ -85,14 +85,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 290,
-            "p95": 384,
+            "p50": 292,
+            "p95": 387,
             "min": 189,
-            "max": 387,
-            "n": 24,
-            "samples": [289, 189, 281, 384, 274, 387, 283, 278, 281, 289, 325, 292, 302, 291, 286, 293, 285, 287, 294, 337, 332, 293, 290, 300]
+            "max": 421,
+            "n": 27,
+            "samples": [289, 189, 281, 384, 274, 387, 283, 278, 281, 289, 325, 292, 302, 291, 286, 293, 285, 287, 294, 337, 332, 293, 290, 300, 301, 421, 298]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -115,14 +115,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 285,
+            "p50": 287,
             "p95": 320,
             "min": 183,
             "max": 340,
-            "n": 24,
-            "samples": [183, 189, 194, 279, 273, 275, 284, 281, 281, 313, 297, 290, 297, 283, 288, 291, 285, 290, 293, 340, 320, 284, 287, 285]
+            "n": 27,
+            "samples": [183, 189, 194, 279, 273, 275, 284, 281, 281, 313, 297, 290, 297, 283, 288, 291, 285, 290, 293, 340, 320, 284, 287, 285, 289, 295, 295]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -149,10 +149,10 @@
             "p95": 317,
             "min": 168,
             "max": 337,
-            "n": 24,
-            "samples": [168, 180, 177, 279, 274, 274, 282, 281, 282, 288, 289, 289, 303, 284, 286, 289, 284, 309, 284, 337, 317, 285, 283, 284]
+            "n": 27,
+            "samples": [168, 180, 177, 279, 274, 274, 282, 281, 282, 288, 289, 289, 303, 284, 286, 289, 284, 309, 284, 337, 317, 285, 283, 284, 289, 296, 287]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -175,14 +175,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 284,
+            "p50": 285,
             "p95": 339,
             "min": 168,
             "max": 347,
-            "n": 24,
-            "samples": [168, 175, 179, 278, 274, 273, 284, 277, 282, 285, 286, 286, 301, 281, 287, 290, 288, 347, 283, 339, 306, 284, 293, 285]
+            "n": 27,
+            "samples": [168, 175, 179, 278, 274, 273, 284, 277, 282, 285, 286, 286, 301, 281, 287, 290, 288, 347, 283, 339, 306, 284, 293, 285, 295, 284, 289]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -209,10 +209,10 @@
             "p95": 155,
             "min": 83,
             "max": 166,
-            "n": 24,
-            "samples": [83, 86, 88, 138, 137, 137, 142, 140, 138, 144, 141, 144, 147, 141, 144, 143, 143, 155, 141, 166, 153, 141, 140, 140]
+            "n": 27,
+            "samples": [83, 86, 88, 138, 137, 137, 142, 140, 138, 144, 141, 144, 147, 141, 144, 143, 143, 155, 141, 166, 153, 141, 140, 140, 146, 144, 147]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -235,14 +235,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 422,
+            "p50": 425,
             "p95": 503,
             "min": 250,
             "max": 512,
-            "n": 24,
-            "samples": [250, 257, 264, 422, 413, 410, 501, 413, 417, 422, 421, 428, 444, 420, 451, 442, 503, 433, 512, 502, 461, 424, 421, 425]
+            "n": 27,
+            "samples": [250, 257, 264, 422, 413, 410, 501, 413, 417, 422, 421, 428, 444, 420, 451, 442, 503, 433, 512, 502, 461, 424, 421, 425, 443, 431, 448]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -271,14 +271,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 1234,
-            "p95": 1402,
+            "p50": 1239,
+            "p95": 1686,
             "min": 960,
             "max": 1892,
-            "n": 24,
-            "samples": [960, 970, 981, 1200, 1187, 1206, 1234, 1239, 1206, 1218, 1228, 1239, 1298, 1269, 1240, 1311, 1232, 1236, 1892, 1402, 1341, 1261, 1229, 1250]
+            "n": 27,
+            "samples": [960, 970, 981, 1200, 1187, 1206, 1234, 1239, 1206, 1218, 1228, 1239, 1298, 1269, 1240, 1311, 1232, 1236, 1892, 1402, 1341, 1261, 1229, 1250, 1339, 1271, 1686]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -301,14 +301,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 480,
-            "p95": 590,
+            "p50": 482,
+            "p95": 604,
             "min": 460,
-            "max": 604,
-            "n": 24,
-            "samples": [560, 561, 561, 479, 460, 590, 474, 479, 476, 472, 473, 480, 506, 482, 604, 488, 475, 481, 491, 538, 530, 477, 475, 477]
+            "max": 1469,
+            "n": 27,
+            "samples": [560, 561, 561, 479, 460, 590, 474, 479, 476, 472, 473, 480, 506, 482, 604, 488, 475, 481, 491, 538, 530, 477, 475, 477, 1469, 496, 528]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     }
diff --git a/test/scenarios/light/scenario_Fluid_solver.json b/test/scenarios/light/scenario_Fluid_solver.json
index 16ea02bd..21baef97 100644
--- a/test/scenarios/light/scenario_Fluid_solver.json
+++ b/test/scenarios/light/scenario_Fluid_solver.json
@@ -79,13 +79,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 30,
-            "p95": 73,
+            "p95": 56,
             "min": 29,
             "max": 73,
-            "n": 18,
-            "samples": [30, 30, 30, 31, 30, 31, 29, 31, 73, 30, 29, 29, 30, 33, 32, 29, 29, 29]
+            "n": 21,
+            "samples": [30, 30, 30, 31, 30, 31, 29, 31, 73, 30, 29, 29, 30, 33, 32, 29, 29, 29, 56, 30, 33]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -103,11 +103,11 @@
             "p50": 19,
             "p95": 37,
             "min": 19,
-            "max": 37,
-            "n": 18,
-            "samples": [20, 20, 20, 19, 19, 19, 20, 19, 37, 19, 19, 19, 20, 21, 21, 19, 19, 19]
+            "max": 44,
+            "n": 21,
+            "samples": [20, 20, 20, 19, 19, 19, 20, 19, 37, 19, 19, 19, 20, 21, 21, 19, 19, 19, 44, 19, 21]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -125,11 +125,11 @@
             "p50": 68,
             "p95": 101,
             "min": 66,
-            "max": 101,
-            "n": 18,
-            "samples": [69, 69, 68, 70, 68, 68, 66, 68, 101, 68, 67, 67, 70, 76, 75, 67, 67, 67]
+            "max": 115,
+            "n": 21,
+            "samples": [69, 69, 68, 70, 68, 68, 66, 68, 101, 68, 67, 67, 70, 76, 75, 67, 67, 67, 115, 70, 76]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -147,11 +147,11 @@
             "p50": 29,
             "p95": 37,
             "min": 29,
-            "max": 37,
-            "n": 18,
-            "samples": [30, 31, 30, 30, 29, 29, 29, 29, 37, 29, 29, 29, 30, 33, 33, 29, 29, 29]
+            "max": 71,
+            "n": 21,
+            "samples": [30, 31, 30, 30, 29, 29, 29, 29, 37, 29, 29, 29, 30, 33, 33, 29, 29, 29, 71, 29, 33]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -166,14 +166,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 64,
+            "p50": 65,
             "p95": 74,
             "min": 62,
-            "max": 74,
-            "n": 18,
-            "samples": [64, 65, 65, 66, 66, 64, 64, 63, 74, 66, 63, 62, 66, 71, 70, 63, 62, 62]
+            "max": 95,
+            "n": 21,
+            "samples": [64, 65, 65, 66, 66, 64, 64, 63, 74, 66, 63, 62, 66, 71, 70, 63, 62, 62, 95, 67, 72]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -187,14 +187,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 132,
-            "p95": 145,
+            "p50": 133,
+            "p95": 176,
             "min": 127,
-            "max": 145,
-            "n": 18,
-            "samples": [133, 134, 138, 136, 134, 131, 130, 132, 133, 134, 129, 128, 131, 145, 145, 131, 127, 129]
+            "max": 208,
+            "n": 21,
+            "samples": [133, 134, 138, 136, 134, 131, 130, 132, 133, 134, 129, 128, 131, 145, 145, 131, 127, 129, 176, 208, 154]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       },
       "description": "And the height, making it 64x64: four times the cells of the 32x32 the pair started from. Reallocating on each axis separately is the shape a UI resize actually takes."
@@ -210,14 +210,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 132,
-            "p95": 145,
+            "p50": 134,
+            "p95": 161,
             "min": 129,
-            "max": 145,
-            "n": 18,
-            "samples": [133, 140, 137, 136, 135, 131, 132, 131, 131, 134, 130, 138, 129, 145, 145, 131, 129, 132]
+            "max": 264,
+            "n": 21,
+            "samples": [133, 140, 137, 136, 135, 131, 132, 131, 131, 134, 130, 138, 129, 145, 145, 131, 129, 132, 264, 150, 161]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -232,14 +232,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 131,
-            "p95": 147,
+            "p50": 134,
+            "p95": 158,
             "min": 127,
-            "max": 147,
-            "n": 18,
-            "samples": [134, 141, 138, 135, 147, 134, 130, 131, 129, 135, 129, 129, 129, 146, 145, 129, 128, 127]
+            "max": 296,
+            "n": 21,
+            "samples": [134, 141, 138, 135, 147, 134, 130, 131, 129, 135, 129, 129, 129, 146, 145, 129, 128, 127, 296, 138, 158]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -255,13 +255,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 36,
-            "p95": 40,
+            "p95": 42,
             "min": 35,
-            "max": 40,
-            "n": 17,
-            "samples": [39, 38, 36, 40, 36, 35, 36, 35, 37, 35, 35, 35, 40, 40, 35, 35, 35]
+            "max": 106,
+            "n": 20,
+            "samples": [39, 38, 36, 40, 36, 35, 36, 35, 37, 35, 35, 35, 40, 40, 35, 35, 35, 106, 37, 42]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -276,13 +276,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 11,
-            "p95": 12,
+            "p95": 13,
             "min": 10,
-            "max": 12,
-            "n": 17,
-            "samples": [12, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 12, 12, 11, 11, 10]
+            "max": 80,
+            "n": 20,
+            "samples": [12, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 12, 12, 11, 11, 10, 80, 11, 13]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -296,14 +296,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 220,
-            "p95": 249,
+            "p50": 222,
+            "p95": 259,
             "min": 215,
-            "max": 249,
-            "n": 17,
-            "samples": [249, 232, 229, 220, 220, 220, 222, 219, 227, 217, 226, 219, 249, 247, 217, 218, 215]
+            "max": 326,
+            "n": 20,
+            "samples": [249, 232, 229, 220, 220, 220, 222, 219, 227, 217, 226, 219, 249, 247, 217, 218, 215, 326, 222, 259]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -321,11 +321,11 @@
             "p50": 11,
             "p95": 12,
             "min": 10,
-            "max": 12,
-            "n": 17,
-            "samples": [12, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 10, 12, 12, 11, 11, 11]
+            "max": 13,
+            "n": 20,
+            "samples": [12, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 10, 12, 12, 11, 11, 11, 12, 12, 13]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -341,13 +341,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 9,
-            "p95": 29,
+            "p95": 10,
             "min": 8,
             "max": 29,
-            "n": 18,
-            "samples": [29, 9, 9, 9, 8, 8, 8, 8, 8, 9, 8, 9, 8, 9, 10, 8, 9, 9]
+            "n": 21,
+            "samples": [29, 9, 9, 9, 8, 8, 8, 8, 8, 9, 8, 9, 8, 9, 10, 8, 9, 9, 10, 9, 10]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -365,10 +365,10 @@
             "p95": 8,
             "min": 6,
             "max": 8,
-            "n": 18,
-            "samples": [7, 7, 7, 7, 6, 7, 6, 7, 8, 8, 7, 7, 6, 8, 7, 6, 7, 7]
+            "n": 21,
+            "samples": [7, 7, 7, 7, 6, 7, 6, 7, 8, 8, 7, 7, 6, 8, 7, 6, 7, 7, 8, 7, 8]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     }
diff --git a/test/scenarios/light/scenario_GridBlacks_blackpixel.json b/test/scenarios/light/scenario_GridBlacks_blackpixel.json
index 6d0258b9..84b13721 100644
--- a/test/scenarios/light/scenario_GridBlacks_blackpixel.json
+++ b/test/scenarios/light/scenario_GridBlacks_blackpixel.json
@@ -90,14 +90,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 2,
+            "p50": 1,
             "p95": 12,
             "min": 1,
             "max": 27,
             "n": 32,
-            "samples": [8, 6, 7, 27, 12, 6, 3, 11, 4, 5, 7, 7, 5, 5, 2, 2, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [27, 12, 6, 3, 11, 4, 5, 7, 7, 5, 5, 2, 2, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -198,9 +198,9 @@
             "min": 2,
             "max": 25,
             "n": 32,
-            "samples": [10, 8, 10, 15, 16, 8, 5, 25, 5, 5, 10, 10, 7, 7, 3, 3, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2]
+            "samples": [15, 16, 8, 5, 25, 5, 5, 10, 10, 7, 7, 3, 3, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 3]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_GridLayout_resize.json b/test/scenarios/light/scenario_GridLayout_resize.json
index f3d197ac..1eee602c 100644
--- a/test/scenarios/light/scenario_GridLayout_resize.json
+++ b/test/scenarios/light/scenario_GridLayout_resize.json
@@ -122,9 +122,9 @@
             "min": 117,
             "max": 316,
             "n": 32,
-            "samples": [157, 244, 128, 127, 241, 280, 306, 311, 167, 316, 183, 292, 249, 240, 128, 126, 120, 118, 120, 128, 117, 119, 122, 117, 121, 120, 124, 125, 126, 119, 189, 124]
+            "samples": [127, 241, 280, 306, 311, 167, 316, 183, 292, 249, 240, 128, 126, 120, 118, 120, 128, 117, 119, 122, 117, 121, 120, 124, 125, 126, 119, 189, 124, 141, 131, 143]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "tick_us": {
@@ -300,13 +300,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 66,
-            "p95": 145,
+            "p95": 151,
             "min": 59,
             "max": 161,
             "n": 32,
-            "samples": [74, 135, 66, 63, 132, 145, 118, 161, 84, 144, 90, 126, 125, 118, 68, 68, 65, 66, 64, 61, 59, 64, 65, 59, 65, 65, 66, 62, 63, 64, 60, 64]
+            "samples": [63, 132, 145, 118, 161, 84, 144, 90, 126, 125, 118, 68, 68, 65, 66, 64, 61, 59, 64, 65, 59, 65, 65, 66, 62, 63, 64, 60, 64, 67, 151, 69]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "tick_us": {
@@ -482,13 +482,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 126,
-            "p95": 298,
+            "p95": 283,
             "min": 116,
-            "max": 309,
+            "max": 298,
             "n": 32,
-            "samples": [149, 309, 129, 125, 247, 283, 243, 298, 166, 249, 182, 209, 247, 240, 126, 127, 120, 123, 121, 123, 116, 120, 122, 119, 121, 120, 122, 126, 127, 120, 120, 142]
+            "samples": [125, 247, 283, 243, 298, 166, 249, 182, 209, 247, 240, 126, 127, 120, 123, 121, 123, 116, 120, 122, 119, 121, 120, 122, 126, 127, 120, 120, 142, 190, 142, 142]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth-wifi": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_Layer_base_pipeline.json b/test/scenarios/light/scenario_Layer_base_pipeline.json
index dd486fe4..1532dbfe 100644
--- a/test/scenarios/light/scenario_Layer_base_pipeline.json
+++ b/test/scenarios/light/scenario_Layer_base_pipeline.json
@@ -84,13 +84,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 71,
-            "p95": 179,
+            "p95": 197,
             "min": 64,
-            "max": 197,
+            "max": 241,
             "n": 32,
-            "samples": [143, 73, 68, 131, 86, 123, 94, 122, 107, 179, 178, 197, 123, 125, 71, 65, 72, 70, 69, 66, 64, 66, 66, 64, 71, 70, 70, 68, 69, 70, 67, 139]
+            "samples": [131, 86, 123, 94, 122, 107, 179, 178, 197, 123, 125, 71, 65, 72, 70, 69, 66, 64, 66, 66, 64, 71, 70, 70, 68, 69, 70, 67, 139, 241, 77, 77]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_Layer_memory_1to1.json b/test/scenarios/light/scenario_Layer_memory_1to1.json
index 2c8f4130..d5220420 100644
--- a/test/scenarios/light/scenario_Layer_memory_1to1.json
+++ b/test/scenarios/light/scenario_Layer_memory_1to1.json
@@ -85,9 +85,9 @@
             "min": 5,
             "max": 41,
             "n": 32,
-            "samples": [18, 11, 11, 10, 40, 14, 7, 10, 7, 9, 41, 27, 10, 11, 5, 5, 5, 5, 5, 5, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6]
+            "samples": [10, 40, 14, 7, 10, 7, 9, 41, 27, 10, 11, 5, 5, 5, 5, 5, 5, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 24, 5, 7]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_Layouts_mutation.json b/test/scenarios/light/scenario_Layouts_mutation.json
index ca7be306..b1a8e8fc 100644
--- a/test/scenarios/light/scenario_Layouts_mutation.json
+++ b/test/scenarios/light/scenario_Layouts_mutation.json
@@ -79,13 +79,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 17,
-            "p95": 50,
+            "p95": 61,
             "min": 16,
-            "max": 61,
+            "max": 83,
             "n": 32,
-            "samples": [38, 17, 17, 33, 23, 35, 25, 32, 29, 48, 50, 61, 32, 32, 16, 16, 17, 17, 16, 17, 17, 16, 16, 17, 16, 16, 17, 18, 18, 16, 17, 16]
+            "samples": [33, 23, 35, 25, 32, 29, 48, 50, 61, 32, 32, 16, 16, 17, 17, 16, 17, 17, 16, 16, 17, 16, 16, 17, 18, 18, 16, 17, 16, 83, 17, 20]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -209,11 +209,11 @@
             "p50": 49,
             "p95": 126,
             "min": 43,
-            "max": 126,
+            "max": 174,
             "n": 32,
-            "samples": [105, 51, 71, 90, 61, 103, 70, 87, 75, 123, 126, 126, 86, 86, 48, 47, 48, 44, 46, 49, 45, 43, 48, 44, 48, 49, 48, 46, 49, 46, 50, 48]
+            "samples": [90, 61, 103, 70, 87, 75, 123, 126, 126, 86, 86, 48, 47, 48, 44, 46, 49, 45, 43, 48, 44, 48, 49, 48, 46, 49, 46, 50, 48, 174, 50, 72]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -329,14 +329,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 96,
+            "p50": 97,
             "p95": 248,
             "min": 88,
             "max": 248,
             "n": 32,
-            "samples": [200, 96, 100, 167, 119, 174, 130, 171, 138, 245, 248, 248, 170, 169, 92, 93, 156, 93, 93, 97, 88, 92, 94, 88, 121, 93, 93, 96, 95, 93, 95, 96]
+            "samples": [167, 119, 174, 130, 171, 138, 245, 248, 248, 170, 169, 92, 93, 156, 93, 93, 97, 88, 92, 94, 88, 121, 93, 93, 96, 95, 93, 95, 96, 211, 97, 114]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -453,12 +453,12 @@
           "tick_us": {
             "p50": 20,
             "p95": 47,
-            "min": 16,
+            "min": 17,
             "max": 48,
             "n": 32,
-            "samples": [38, 21, 16, 31, 27, 36, 24, 32, 25, 47, 47, 48, 33, 31, 20, 20, 17, 20, 20, 21, 17, 20, 20, 17, 20, 20, 18, 18, 18, 20, 20, 20]
+            "samples": [31, 27, 36, 24, 32, 25, 47, 47, 48, 33, 31, 20, 20, 17, 20, 20, 21, 17, 20, 20, 17, 20, 20, 18, 18, 18, 20, 20, 20, 29, 22, 26]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_MoonLiveEffect_controls.json b/test/scenarios/light/scenario_MoonLiveEffect_controls.json
index 5e93653f..99af4282 100644
--- a/test/scenarios/light/scenario_MoonLiveEffect_controls.json
+++ b/test/scenarios/light/scenario_MoonLiveEffect_controls.json
@@ -323,10 +323,10 @@
             "p95": 10,
             "min": 1,
             "max": 10,
-            "n": 5,
-            "samples": [1, 3, 1, 10, 1]
+            "n": 6,
+            "samples": [1, 3, 1, 10, 1, 1]
           },
-          "last_updated": "2026-08-31"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -406,10 +406,10 @@
             "p95": 3,
             "min": 1,
             "max": 3,
-            "n": 3,
-            "samples": [1, 3, 1]
+            "n": 4,
+            "samples": [1, 3, 1, 1]
           },
-          "last_updated": "2026-08-31"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -569,13 +569,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 1,
-            "p95": 10,
+            "p95": 6,
             "min": 1,
             "max": 10,
-            "n": 19,
-            "samples": [2, 1, 3, 1, 10, 1, 1, 6, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1]
+            "n": 20,
+            "samples": [2, 1, 3, 1, 10, 1, 1, 6, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-03"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -727,13 +727,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 1,
-            "p95": 7,
+            "p95": 5,
             "min": 1,
             "max": 7,
-            "n": 19,
-            "samples": [1, 2, 3, 5, 1, 1, 7, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "n": 20,
+            "samples": [1, 2, 3, 5, 1, 1, 7, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-03"
+          "last_updated": "2026-09-07"
         },
         "esp32": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_MoonLiveEffect_livescript.json b/test/scenarios/light/scenario_MoonLiveEffect_livescript.json
index 9d527e71..f1ea25ab 100644
--- a/test/scenarios/light/scenario_MoonLiveEffect_livescript.json
+++ b/test/scenarios/light/scenario_MoonLiveEffect_livescript.json
@@ -88,14 +88,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 6,
-            "p95": 22,
+            "p50": 5,
+            "p95": 18,
             "min": 5,
             "max": 28,
             "n": 32,
-            "samples": [12, 22, 11, 15, 8, 12, 9, 14, 28, 18, 10, 10, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 5, 6, 6, 5, 5, 6, 5, 6, 5]
+            "samples": [12, 9, 14, 28, 18, 10, 10, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 5, 6, 6, 5, 5, 6, 5, 6, 5, 14, 15, 7, 5, 12]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -207,13 +207,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 24,
+            "p95": 17,
             "min": 5,
-            "max": 34,
+            "max": 24,
             "n": 32,
-            "samples": [14, 34, 13, 18, 9, 12, 9, 16, 24, 17, 11, 10, 5, 5, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 10, 5, 5, 5, 6, 5, 5, 5]
+            "samples": [12, 9, 16, 24, 17, 11, 10, 5, 5, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 10, 5, 5, 5, 6, 5, 5, 5, 9, 7, 6, 6, 10]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -317,13 +317,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 19,
+            "p95": 17,
             "min": 5,
             "max": 28,
             "n": 32,
-            "samples": [19, 18, 15, 19, 9, 10, 9, 17, 28, 17, 11, 10, 5, 5, 5, 5, 5, 5, 5, 5, 6, 5, 5, 6, 15, 5, 5, 5, 6, 5, 5, 5]
+            "samples": [10, 9, 17, 28, 17, 11, 10, 5, 5, 5, 5, 5, 5, 5, 5, 6, 5, 5, 6, 15, 5, 5, 5, 6, 5, 5, 5, 12, 5, 6, 6, 10]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -427,13 +427,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 21,
+            "p95": 19,
             "min": 4,
             "max": 29,
             "n": 32,
-            "samples": [21, 15, 15, 14, 9, 10, 15, 15, 29, 19, 16, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 4, 5, 5, 5, 5, 5, 5]
+            "samples": [10, 15, 15, 29, 19, 16, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 4, 5, 5, 5, 5, 5, 5, 6, 5, 7, 6, 10]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -534,9 +534,9 @@
             "min": 5,
             "max": 26,
             "n": 32,
-            "samples": [11, 20, 12, 14, 8, 11, 12, 14, 26, 20, 11, 13, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 7, 5, 5, 5, 5, 5, 5, 5]
+            "samples": [11, 12, 14, 26, 20, 11, 13, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 7, 5, 5, 5, 5, 5, 5, 5, 10, 5, 7, 6, 9]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -633,13 +633,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 24,
+            "p95": 18,
             "min": 5,
             "max": 26,
             "n": 32,
-            "samples": [15, 24, 11, 22, 7, 10, 12, 16, 26, 18, 11, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 7, 5, 5, 8, 5, 5, 5, 6, 5, 5, 5]
+            "samples": [10, 12, 16, 26, 18, 11, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 7, 5, 5, 8, 5, 5, 5, 6, 5, 5, 5, 14, 5, 7, 6, 6]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -736,13 +736,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 8,
+            "p95": 10,
             "min": 5,
-            "max": 8,
-            "n": 11,
-            "samples": [5, 5, 5, 8, 5, 5, 7, 5, 5, 5, 5]
+            "max": 10,
+            "n": 16,
+            "samples": [5, 5, 5, 8, 5, 5, 7, 5, 5, 5, 5, 10, 6, 7, 6, 7]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         }
       }
     },
@@ -758,13 +758,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 6,
+            "p95": 12,
             "min": 5,
-            "max": 6,
-            "n": 11,
-            "samples": [5, 5, 5, 6, 5, 5, 6, 6, 5, 5, 5]
+            "max": 12,
+            "n": 16,
+            "samples": [5, 5, 5, 6, 5, 5, 6, 6, 5, 5, 5, 6, 12, 6, 6, 9]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         }
       }
     },
@@ -779,14 +779,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 5,
-            "p95": 6,
+            "p50": 6,
+            "p95": 8,
             "min": 5,
-            "max": 6,
-            "n": 11,
-            "samples": [5, 5, 5, 6, 5, 6, 6, 6, 5, 6, 5]
+            "max": 8,
+            "n": 16,
+            "samples": [5, 5, 5, 6, 5, 6, 6, 6, 5, 6, 5, 7, 6, 6, 6, 8]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         }
       }
     },
@@ -800,13 +800,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 21,
+            "p95": 18,
             "min": 5,
-            "max": 22,
+            "max": 21,
             "n": 32,
-            "samples": [12, 20, 17, 22, 7, 11, 14, 18, 21, 18, 11, 13, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 5, 5, 6, 5, 5, 5, 5]
+            "samples": [11, 14, 18, 21, 18, 11, 13, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 5, 5, 6, 5, 5, 5, 5, 9, 6, 6, 6, 6]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -903,13 +903,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 29,
+            "p95": 18,
             "min": 5,
-            "max": 32,
+            "max": 29,
             "n": 32,
-            "samples": [12, 32, 13, 24, 8, 10, 15, 15, 29, 18, 10, 13, 5, 5, 6, 5, 5, 5, 5, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5]
+            "samples": [10, 15, 15, 29, 18, 10, 13, 5, 5, 6, 5, 5, 5, 5, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 9, 6, 6, 7]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1006,13 +1006,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 31,
+            "p95": 21,
             "min": 5,
-            "max": 37,
+            "max": 22,
             "n": 32,
-            "samples": [16, 37, 10, 31, 7, 9, 15, 14, 21, 22, 12, 10, 5, 6, 5, 5, 6, 5, 6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5]
+            "samples": [9, 15, 14, 21, 22, 12, 10, 5, 6, 5, 5, 6, 5, 6, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 7, 7, 6, 6, 8]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-08"
         },
         "esp32": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_MoonLive_pipeline.json b/test/scenarios/light/scenario_MoonLive_pipeline.json
index b3c5d08a..46eb9000 100644
--- a/test/scenarios/light/scenario_MoonLive_pipeline.json
+++ b/test/scenarios/light/scenario_MoonLive_pipeline.json
@@ -375,13 +375,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 5,
-            "p95": 47,
+            "p95": 30,
             "min": 5,
-            "max": 54,
+            "max": 47,
             "n": 32,
-            "samples": [54, 25, 10, 25, 19, 20, 13, 30, 7, 12, 47, 17, 14, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 5, 5, 6, 5, 5, 5, 5]
+            "samples": [25, 19, 20, 13, 30, 7, 12, 47, 17, 14, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 5, 5, 6, 5, 5, 5, 5, 6, 7, 6]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -536,9 +536,9 @@
             "min": 5,
             "max": 32,
             "n": 32,
-            "samples": [18, 19, 11, 19, 20, 15, 12, 32, 7, 9, 14, 21, 10, 9, 5, 5, 5, 5, 5, 5, 6, 5, 5, 5, 5, 5, 5, 6, 6, 5, 5, 5]
+            "samples": [19, 20, 15, 12, 32, 7, 9, 14, 21, 10, 9, 5, 5, 5, 5, 5, 5, 6, 5, 5, 5, 5, 5, 5, 6, 6, 5, 5, 5, 6, 6, 7]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -687,9 +687,9 @@
             "min": 5,
             "max": 21,
             "n": 32,
-            "samples": [13, 11, 12, 12, 21, 19, 20, 17, 8, 8, 17, 18, 10, 10, 5, 6, 5, 6, 5, 5, 6, 5, 5, 5, 6, 5, 6, 5, 5, 5, 6, 8]
+            "samples": [12, 21, 19, 20, 17, 8, 8, 17, 18, 10, 10, 5, 6, 5, 6, 5, 5, 6, 5, 5, 5, 6, 5, 6, 5, 5, 5, 6, 8, 11, 6, 7]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -989,9 +989,9 @@
             "min": 5,
             "max": 25,
             "n": 32,
-            "samples": [8, 20, 13, 18, 20, 21, 24, 25, 8, 10, 10, 18, 10, 10, 5, 5, 5, 5, 5, 5, 6, 5, 5, 5, 5, 5, 5, 5, 6, 5, 5, 5]
+            "samples": [18, 20, 21, 24, 25, 8, 10, 10, 18, 10, 10, 5, 5, 5, 5, 5, 5, 6, 5, 5, 5, 5, 5, 5, 5, 6, 5, 5, 5, 5, 6, 7]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1129,11 +1129,11 @@
             "p50": 5,
             "p95": 24,
             "min": 5,
-            "max": 397,
+            "max": 24,
             "n": 32,
-            "samples": [22, 397, 12, 17, 18, 22, 24, 11, 8, 9, 13, 24, 10, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 6, 5, 5, 5]
+            "samples": [17, 18, 22, 24, 11, 8, 9, 13, 24, 10, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 6, 5, 5, 5, 6, 5, 7]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_MultiplyModifier_memory_lut.json b/test/scenarios/light/scenario_MultiplyModifier_memory_lut.json
index fafbd037..6e06bbb4 100644
--- a/test/scenarios/light/scenario_MultiplyModifier_memory_lut.json
+++ b/test/scenarios/light/scenario_MultiplyModifier_memory_lut.json
@@ -90,13 +90,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 3,
-            "p95": 21,
+            "p95": 19,
             "min": 2,
-            "max": 241,
+            "max": 21,
             "n": 32,
-            "samples": [241, 7, 8, 18, 17, 13, 4, 19, 4, 5, 21, 14, 6, 6, 3, 3, 3, 2, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3]
+            "samples": [18, 17, 13, 4, 19, 4, 5, 21, 14, 6, 6, 3, 3, 3, 2, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 2, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_MultiplyModifier_pipeline.json b/test/scenarios/light/scenario_MultiplyModifier_pipeline.json
index d3d25541..9c02b9ba 100644
--- a/test/scenarios/light/scenario_MultiplyModifier_pipeline.json
+++ b/test/scenarios/light/scenario_MultiplyModifier_pipeline.json
@@ -94,9 +94,9 @@
             "min": 117,
             "max": 302,
             "n": 32,
-            "samples": [126, 125, 150, 127, 128, 238, 283, 277, 174, 302, 182, 214, 235, 240, 127, 126, 118, 119, 117, 121, 117, 119, 119, 118, 122, 119, 121, 127, 129, 119, 121, 119]
+            "samples": [127, 128, 238, 283, 277, 174, 302, 182, 214, 235, 240, 127, 126, 118, 119, 117, 121, 117, 119, 119, 118, 122, 119, 121, 127, 129, 119, 121, 119, 172, 126, 146]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_Trails_ladder.json b/test/scenarios/light/scenario_Trails_ladder.json
index a1c85024..bf060dd0 100644
--- a/test/scenarios/light/scenario_Trails_ladder.json
+++ b/test/scenarios/light/scenario_Trails_ladder.json
@@ -87,13 +87,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 11,
-            "p95": 13,
+            "p95": 14,
             "min": 10,
-            "max": 13,
-            "n": 18,
-            "samples": [11, 10, 10, 10, 11, 11, 11, 11, 11, 13, 12, 11, 11, 13, 13, 11, 12, 11]
+            "max": 15,
+            "n": 21,
+            "samples": [11, 10, 10, 10, 11, 11, 11, 11, 11, 13, 12, 11, 11, 13, 13, 11, 12, 11, 15, 11, 14]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -123,14 +123,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 45,
+            "p50": 46,
             "p95": 57,
             "min": 40,
-            "max": 57,
-            "n": 18,
-            "samples": [57, 40, 42, 41, 45, 45, 45, 45, 45, 47, 46, 46, 49, 50, 53, 45, 44, 46]
+            "max": 60,
+            "n": 21,
+            "samples": [57, 40, 42, 41, 45, 45, 45, 45, 45, 47, 46, 46, 49, 50, 53, 45, 44, 46, 49, 60, 56]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -160,14 +160,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 180,
-            "p95": 208,
+            "p50": 182,
+            "p95": 222,
             "min": 160,
-            "max": 208,
-            "n": 18,
-            "samples": [208, 160, 166, 165, 182, 178, 180, 184, 180, 183, 186, 179, 187, 200, 202, 178, 178, 178]
+            "max": 233,
+            "n": 21,
+            "samples": [208, 160, 166, 165, 182, 178, 180, 184, 180, 183, 186, 179, 187, 200, 202, 178, 178, 178, 233, 191, 222]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -204,14 +204,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 349,
+            "p50": 352,
             "p95": 396,
             "min": 313,
-            "max": 396,
-            "n": 18,
-            "samples": [323, 313, 331, 324, 358, 348, 353, 357, 352, 357, 361, 351, 349, 396, 395, 347, 349, 348]
+            "max": 437,
+            "n": 21,
+            "samples": [323, 313, 331, 324, 358, 348, 353, 357, 352, 357, 361, 351, 349, 396, 395, 347, 349, 348, 394, 372, 437]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -234,14 +234,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 355,
-            "p95": 608,
+            "p50": 360,
+            "p95": 442,
             "min": 312,
             "max": 608,
-            "n": 18,
-            "samples": [321, 312, 334, 332, 442, 353, 358, 354, 351, 608, 364, 362, 373, 423, 414, 354, 360, 355]
+            "n": 21,
+            "samples": [321, 312, 334, 332, 442, 353, 358, 354, 351, 608, 364, 362, 373, 423, 414, 354, 360, 355, 373, 384, 433]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -264,14 +264,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 351,
-            "p95": 451,
+            "p50": 354,
+            "p95": 434,
             "min": 312,
             "max": 451,
-            "n": 18,
-            "samples": [319, 312, 336, 350, 359, 351, 354, 354, 365, 370, 365, 351, 348, 451, 413, 350, 350, 349]
+            "n": 21,
+            "samples": [319, 312, 336, 350, 359, 351, 354, 354, 365, 370, 365, 351, 348, 451, 413, 350, 350, 349, 373, 412, 434]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     },
@@ -308,14 +308,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 180,
-            "p95": 250,
+            "p50": 182,
+            "p95": 221,
             "min": 164,
             "max": 250,
-            "n": 18,
-            "samples": [164, 169, 169, 166, 183, 178, 180, 182, 189, 186, 185, 180, 183, 250, 210, 177, 177, 181]
+            "n": 21,
+            "samples": [164, 169, 169, 166, 183, 178, 180, 182, 189, 186, 185, 180, 183, 250, 210, 177, 177, 181, 203, 210, 221]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         }
       }
     }
diff --git a/test/scenarios/light/scenario_modifier_chain.json b/test/scenarios/light/scenario_modifier_chain.json
index c0275ae3..9c911f8f 100644
--- a/test/scenarios/light/scenario_modifier_chain.json
+++ b/test/scenarios/light/scenario_modifier_chain.json
@@ -11,7 +11,7 @@
     "Layouts",
     "GridLayout",
     "Drivers",
-    "NetworkSendDriver"
+    "PreviewDriver"
   ],
   "description": "Stack TWO modifiers on one Layer (Region then Multiply) and verify the chain composes live end-to-end — the capability the old single-modifier engine couldn't do. Prepares its own canvas: Layout(Grid 32x32) + Layer + NoiseEffect + Region(0..50) + Multiply(2x), measures the composite, then adds a third (Checkerboard mask) and measures again, then removes the middle modifier and measures — exercising add/remove on a multi-modifier chain. A broken fold (null buffer, wrong light count, crash on a disabled/removed stage) shows up as a failed measure. The fold composition + order semantics are pinned by unit_Layer_modifier_chain; this is the live end-to-end gate.",
   "fixture": [
@@ -88,9 +88,10 @@
     {
       "name": "fix-artnet",
       "op": "add_module",
-      "id": "ArtNet",
-      "type": "NetworkSendDriver",
-      "parent_id": "Drivers"
+      "id": "Preview",
+      "type": "PreviewDriver",
+      "parent_id": "Drivers",
+      "description": "An in-process sink, not a network one: this scenario is about how a modifier CHAIN folds, and routing it through NetworkSendDriver pulled socket behavior into a test that is not about the network (CodeRabbit #29). PreviewDriver consumes the composite in memory."
     }
   ],
   "steps": [
@@ -106,9 +107,9 @@
             "min": 8,
             "max": 43,
             "n": 32,
-            "samples": [31, 8, 9, 16, 14, 17, 12, 18, 15, 24, 32, 43, 17, 16, 8, 8, 8, 8, 8, 10, 9, 8, 9, 8, 12, 10, 10, 24, 10, 8, 10, 10]
+            "samples": [14, 17, 12, 18, 15, 24, 32, 43, 17, 16, 8, 8, 8, 8, 8, 10, 9, 8, 9, 8, 12, 10, 10, 24, 10, 8, 10, 10, 13, 11, 9, 10]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -162,13 +163,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 9,
-            "p95": 36,
+            "p95": 26,
             "min": 6,
             "max": 56,
             "n": 32,
-            "samples": [36, 7, 7, 14, 10, 21, 11, 15, 13, 22, 23, 26, 14, 14, 7, 7, 6, 7, 7, 9, 7, 6, 9, 7, 7, 9, 9, 56, 8, 9, 9, 9]
+            "samples": [10, 21, 11, 15, 13, 22, 23, 26, 14, 14, 7, 7, 6, 7, 7, 9, 7, 6, 9, 7, 7, 9, 9, 56, 8, 9, 9, 9, 10, 10, 8, 8]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -219,14 +220,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 26,
-            "p95": 72,
+            "p50": 25,
+            "p95": 69,
             "min": 21,
-            "max": 74,
+            "max": 72,
             "n": 32,
-            "samples": [74, 27, 23, 48, 30, 65, 33, 48, 41, 63, 72, 69, 43, 46, 26, 22, 24, 22, 22, 28, 21, 21, 24, 21, 27, 24, 25, 26, 24, 24, 24, 25]
+            "samples": [30, 65, 33, 48, 41, 63, 72, 69, 43, 46, 26, 22, 24, 22, 22, 28, 21, 21, 24, 21, 27, 24, 25, 26, 24, 24, 24, 25, 28, 25, 23, 24]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -252,14 +253,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 47,
-            "p95": 123,
+            "p50": 44,
+            "p95": 112,
             "min": 37,
             "max": 138,
             "n": 32,
-            "samples": [123, 47, 47, 72, 52, 88, 55, 77, 73, 112, 110, 138, 77, 83, 47, 47, 43, 43, 44, 41, 42, 40, 44, 37, 39, 44, 43, 48, 43, 45, 44, 44]
+            "samples": [52, 88, 55, 77, 73, 112, 110, 138, 77, 83, 47, 47, 43, 43, 44, 41, 42, 40, 44, 37, 39, 44, 43, 48, 43, 45, 44, 44, 50, 44, 40, 45]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_modifier_swap.json b/test/scenarios/light/scenario_modifier_swap.json
index 7da7562a..00e23ab8 100644
--- a/test/scenarios/light/scenario_modifier_swap.json
+++ b/test/scenarios/light/scenario_modifier_swap.json
@@ -156,9 +156,9 @@
             "min": 8,
             "max": 246,
             "n": 32,
-            "samples": [26, 9, 8, 17, 11, 33, 12, 17, 49, 25, 246, 71, 16, 35, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 12, 9, 9, 10, 8]
+            "samples": [17, 11, 33, 12, 17, 49, 25, 246, 71, 16, 35, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 12, 9, 9, 10, 8, 8, 9, 10]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth": {
           "tick_us": {
@@ -300,9 +300,9 @@
             "min": 20,
             "max": 160,
             "n": 32,
-            "samples": [64, 24, 22, 42, 31, 46, 33, 43, 61, 65, 160, 87, 45, 74, 25, 25, 21, 21, 20, 21, 21, 20, 22, 21, 22, 20, 21, 31, 24, 24, 24, 20]
+            "samples": [42, 31, 46, 33, 43, 61, 65, 160, 87, 45, 74, 25, 25, 21, 21, 20, 21, 21, 20, 22, 21, 22, 20, 21, 31, 24, 24, 24, 20, 24, 23, 24]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth": {
           "tick_us": {
@@ -444,9 +444,9 @@
             "min": 8,
             "max": 106,
             "n": 32,
-            "samples": [30, 11, 10, 16, 11, 36, 12, 16, 29, 25, 47, 49, 18, 39, 10, 10, 10, 9, 10, 8, 9, 11, 10, 8, 9, 9, 8, 106, 9, 10, 10, 10]
+            "samples": [16, 11, 36, 12, 16, 29, 25, 47, 49, 18, 39, 10, 10, 10, 9, 10, 8, 9, 11, 10, 8, 9, 9, 8, 106, 9, 10, 10, 10, 11, 12, 10]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32-eth": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_perf_full.json b/test/scenarios/light/scenario_perf_full.json
index 8c8d6481..af8b761c 100644
--- a/test/scenarios/light/scenario_perf_full.json
+++ b/test/scenarios/light/scenario_perf_full.json
@@ -90,9 +90,9 @@
             "min": 1,
             "max": 9,
             "n": 32,
-            "samples": [7, 2, 2, 4, 3, 5, 3, 5, 4, 8, 9, 9, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [4, 3, 5, 3, 5, 4, 8, 9, 9, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -210,9 +210,9 @@
             "min": 1,
             "max": 14,
             "n": 32,
-            "samples": [7, 2, 2, 4, 4, 5, 4, 5, 5, 7, 7, 14, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [4, 4, 5, 4, 5, 5, 7, 7, 14, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -330,9 +330,9 @@
             "min": 1,
             "max": 12,
             "n": 32,
-            "samples": [7, 2, 2, 4, 3, 5, 3, 5, 4, 7, 8, 12, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [4, 3, 5, 3, 5, 4, 7, 8, 12, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -573,9 +573,9 @@
             "min": 1,
             "max": 31,
             "n": 32,
-            "samples": [7, 2, 2, 4, 3, 7, 3, 5, 4, 7, 8, 31, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [4, 3, 7, 3, 5, 4, 7, 8, 31, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -686,14 +686,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 2,
+            "p50": 1,
             "p95": 9,
             "min": 1,
             "max": 26,
             "n": 32,
-            "samples": [7, 2, 2, 4, 3, 6, 3, 5, 4, 7, 26, 9, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1]
+            "samples": [4, 3, 6, 3, 5, 4, 7, 26, 9, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -820,9 +820,9 @@
             "min": 1,
             "max": 13,
             "n": 32,
-            "samples": [7, 2, 2, 4, 3, 13, 3, 5, 4, 7, 7, 8, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [4, 3, 13, 3, 5, 4, 7, 7, 8, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -953,9 +953,9 @@
             "min": 1,
             "max": 11,
             "n": 32,
-            "samples": [7, 2, 2, 4, 3, 7, 3, 5, 4, 7, 11, 8, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [4, 3, 7, 3, 5, 4, 7, 11, 8, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1060,9 +1060,9 @@
             "min": 1,
             "max": 21,
             "n": 32,
-            "samples": [7, 2, 2, 4, 3, 6, 3, 5, 4, 7, 12, 21, 5, 6, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [4, 3, 6, 3, 5, 4, 7, 12, 21, 5, 6, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32p4rev1-eth": {
           "tick_us": {
@@ -1173,9 +1173,9 @@
             "min": 1,
             "max": 11,
             "n": 32,
-            "samples": [7, 2, 2, 4, 3, 5, 3, 5, 4, 7, 9, 11, 9, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+            "samples": [4, 3, 5, 3, 5, 4, 7, 9, 11, 9, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1292,14 +1292,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 6,
+            "p50": 5,
             "p95": 35,
             "min": 4,
             "max": 38,
             "n": 32,
-            "samples": [27, 10, 9, 16, 13, 20, 15, 19, 19, 29, 27, 38, 35, 19, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 5, 4, 4, 4]
+            "samples": [16, 13, 20, 15, 19, 19, 29, 27, 38, 35, 19, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 5, 4, 4, 4, 5, 5, 5]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1416,14 +1416,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 23,
+            "p50": 20,
             "p95": 174,
             "min": 17,
             "max": 255,
             "n": 32,
-            "samples": [102, 41, 41, 73, 58, 137, 62, 82, 74, 123, 255, 174, 113, 82, 41, 40, 17, 17, 17, 18, 18, 17, 18, 18, 18, 18, 18, 23, 21, 18, 18, 18]
+            "samples": [73, 58, 137, 62, 82, 74, 123, 255, 174, 113, 82, 41, 40, 17, 17, 17, 18, 18, 17, 18, 18, 18, 18, 18, 23, 21, 18, 18, 18, 20, 20, 21]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1540,14 +1540,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 113,
+            "p50": 80,
             "p95": 1023,
             "min": 70,
             "max": 2016,
             "n": 32,
-            "samples": [408, 178, 175, 303, 237, 529, 276, 354, 308, 542, 2016, 1023, 414, 368, 174, 173, 71, 70, 70, 74, 74, 71, 70, 73, 75, 72, 74, 113, 86, 71, 71, 70]
+            "samples": [303, 237, 529, 276, 354, 308, 542, 2016, 1023, 414, 368, 174, 173, 71, 70, 70, 74, 74, 71, 70, 73, 75, 72, 74, 113, 86, 71, 71, 70, 76, 80, 88]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1673,13 +1673,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 4,
-            "p95": 15,
+            "p95": 14,
             "min": 4,
-            "max": 16,
+            "max": 15,
             "n": 32,
-            "samples": [16, 4, 4, 7, 6, 15, 7, 9, 8, 14, 13, 14, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 4, 4, 4, 4]
+            "samples": [7, 6, 15, 7, 9, 8, 14, 13, 14, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 4, 4, 4, 4, 4, 4, 5]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1801,9 +1801,9 @@
             "min": 15,
             "max": 92,
             "n": 32,
-            "samples": [44, 18, 17, 30, 23, 39, 27, 35, 30, 59, 72, 57, 35, 37, 17, 17, 15, 15, 15, 16, 16, 16, 16, 16, 17, 15, 16, 92, 19, 16, 16, 16]
+            "samples": [30, 23, 39, 27, 35, 30, 59, 72, 57, 35, 37, 17, 17, 15, 15, 15, 16, 16, 16, 16, 16, 17, 15, 16, 92, 19, 16, 16, 16, 16, 19, 19]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -1925,9 +1925,9 @@
             "min": 61,
             "max": 574,
             "n": 32,
-            "samples": [203, 71, 71, 122, 92, 191, 107, 140, 120, 298, 360, 297, 144, 165, 69, 69, 62, 62, 61, 66, 65, 64, 63, 64, 64, 63, 67, 574, 74, 64, 62, 63]
+            "samples": [122, 92, 191, 107, 140, 120, 298, 360, 297, 144, 165, 69, 69, 62, 62, 61, 66, 65, 64, 63, 64, 64, 63, 67, 574, 74, 64, 62, 63, 82, 72, 74]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -2049,9 +2049,9 @@
             "min": 247,
             "max": 12932,
             "n": 32,
-            "samples": [717, 285, 279, 489, 371, 879, 429, 558, 499, 1114, 12932, 1097, 562, 589, 278, 279, 252, 249, 247, 256, 265, 251, 255, 259, 267, 257, 264, 402, 298, 250, 259, 252]
+            "samples": [489, 371, 879, 429, 558, 499, 1114, 12932, 1097, 562, 589, 278, 279, 252, 249, 247, 256, 265, 251, 255, 259, 267, 257, 264, 402, 298, 250, 259, 252, 285, 294, 301]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -2208,9 +2208,9 @@
             "min": 1,
             "max": 13,
             "n": 32,
-            "samples": [3, 1, 1, 2, 1, 8, 2, 2, 2, 5, 13, 4, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1]
+            "samples": [2, 1, 8, 2, 2, 2, 5, 13, 4, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32": {
           "tick_us": {
@@ -2332,9 +2332,9 @@
             "min": 4,
             "max": 20,
             "n": 32,
-            "samples": [11, 5, 4, 8, 6, 20, 7, 9, 7, 19, 18, 13, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 7, 5, 4, 4, 4]
+            "samples": [8, 6, 20, 7, 9, 7, 19, 18, 13, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 7, 5, 4, 4, 4, 4, 4, 5]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32": {
           "tick_us": {
@@ -2451,14 +2451,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 18,
+            "p50": 17,
             "p95": 74,
             "min": 15,
             "max": 113,
             "n": 32,
-            "samples": [41, 19, 18, 31, 24, 65, 27, 35, 30, 74, 113, 52, 35, 35, 18, 17, 16, 15, 15, 16, 16, 15, 16, 16, 16, 16, 16, 27, 18, 15, 15, 15]
+            "samples": [31, 24, 65, 27, 35, 30, 74, 113, 52, 35, 35, 18, 17, 16, 15, 15, 16, 16, 15, 16, 16, 16, 16, 16, 27, 18, 15, 15, 15, 17, 18, 18]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32": {
           "tick_us": {
@@ -2580,9 +2580,9 @@
             "min": 62,
             "max": 574,
             "n": 32,
-            "samples": [164, 74, 75, 178, 92, 245, 109, 139, 120, 370, 574, 268, 151, 141, 70, 70, 63, 63, 62, 66, 66, 63, 64, 65, 65, 63, 67, 103, 74, 63, 63, 63]
+            "samples": [178, 92, 245, 109, 139, 120, 370, 574, 268, 151, 141, 70, 70, 63, 63, 62, 66, 66, 63, 64, 65, 65, 63, 67, 103, 74, 63, 63, 63, 68, 71, 79]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_perf_light.json b/test/scenarios/light/scenario_perf_light.json
index 30cd3289..fce72376 100644
--- a/test/scenarios/light/scenario_perf_light.json
+++ b/test/scenarios/light/scenario_perf_light.json
@@ -101,14 +101,14 @@
       "observed": {
         "desktop-macos": {
           "tick_us": {
-            "p50": 2,
+            "p50": 1,
             "p95": 9,
             "min": 1,
             "max": 10,
             "n": 32,
-            "samples": [5, 2, 2, 4, 3, 9, 3, 5, 4, 7, 7, 10, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1]
+            "samples": [4, 3, 9, 3, 5, 4, 7, 7, 10, 5, 5, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -454,9 +454,9 @@
             "min": 1,
             "max": 4,
             "n": 32,
-            "samples": [3, 1, 1, 2, 1, 3, 2, 2, 2, 4, 4, 4, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1]
+            "samples": [2, 1, 3, 2, 2, 2, 4, 4, 4, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -578,9 +578,9 @@
             "min": 4,
             "max": 49,
             "n": 32,
-            "samples": [10, 4, 4, 7, 6, 10, 7, 9, 7, 14, 49, 14, 9, 10, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 4, 4, 4, 4]
+            "samples": [7, 6, 10, 7, 9, 7, 14, 49, 14, 9, 10, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 4, 4, 4, 4, 4, 4, 5]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
@@ -702,9 +702,9 @@
             "min": 15,
             "max": 78,
             "n": 32,
-            "samples": [41, 18, 17, 30, 23, 61, 27, 35, 30, 52, 78, 54, 36, 35, 17, 17, 15, 15, 15, 16, 16, 15, 15, 17, 20, 16, 16, 24, 18, 15, 16, 15]
+            "samples": [30, 23, 61, 27, 35, 30, 52, 78, 54, 36, 35, 17, 17, 15, 15, 15, 16, 16, 15, 15, 17, 20, 16, 16, 24, 18, 15, 16, 15, 16, 18, 19]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32s3-n16r8": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_peripheral_grid_sweep.json b/test/scenarios/light/scenario_peripheral_grid_sweep.json
index efac865c..fd6d8093 100644
--- a/test/scenarios/light/scenario_peripheral_grid_sweep.json
+++ b/test/scenarios/light/scenario_peripheral_grid_sweep.json
@@ -178,9 +178,9 @@
             "min": 4,
             "max": 14,
             "n": 32,
-            "samples": [10, 4, 4, 7, 6, 11, 7, 9, 8, 13, 14, 14, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 4, 4, 6, 5, 4, 4, 4]
+            "samples": [7, 6, 11, 7, 9, 8, 13, 14, 14, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 4, 4, 6, 5, 4, 4, 4, 4, 4, 5]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -300,14 +300,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 18,
+            "p50": 17,
             "p95": 84,
             "min": 15,
             "max": 88,
             "n": 32,
-            "samples": [41, 18, 18, 31, 23, 59, 27, 36, 31, 56, 88, 55, 36, 35, 17, 17, 15, 15, 15, 18, 17, 16, 16, 16, 84, 17, 16, 37, 19, 16, 16, 16]
+            "samples": [31, 23, 59, 27, 36, 31, 56, 88, 55, 36, 35, 17, 17, 15, 15, 15, 18, 17, 16, 16, 16, 84, 17, 16, 37, 19, 16, 16, 16, 16, 17, 20]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -427,14 +427,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 71,
+            "p50": 72,
             "p95": 241,
             "min": 62,
             "max": 296,
             "n": 32,
-            "samples": [165, 71, 71, 122, 92, 230, 108, 141, 123, 211, 241, 219, 147, 144, 69, 69, 63, 63, 62, 151, 65, 63, 63, 66, 296, 66, 64, 103, 74, 65, 63, 63]
+            "samples": [122, 92, 230, 108, 141, 123, 211, 241, 219, 147, 144, 69, 69, 63, 63, 62, 151, 65, 63, 63, 66, 296, 66, 64, 103, 74, 65, 63, 63, 69, 72, 78]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -554,14 +554,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 287,
+            "p50": 285,
             "p95": 938,
             "min": 247,
             "max": 1089,
             "n": 32,
-            "samples": [667, 283, 287, 482, 369, 938, 460, 580, 485, 881, 908, 1089, 581, 575, 277, 278, 251, 247, 250, 590, 264, 252, 255, 260, 872, 259, 272, 813, 298, 254, 251, 251]
+            "samples": [482, 369, 938, 460, 580, 485, 881, 908, 1089, 581, 575, 277, 278, 251, 247, 250, 590, 264, 252, 255, 260, 872, 259, 272, 813, 298, 254, 251, 251, 278, 285, 299]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -707,9 +707,9 @@
             "min": 4,
             "max": 24,
             "n": 32,
-            "samples": [12, 4, 4, 8, 6, 10, 7, 9, 11, 24, 14, 14, 11, 9, 4, 4, 4, 4, 4, 4, 4, 4, 5, 4, 7, 4, 4, 16, 5, 4, 4, 4]
+            "samples": [8, 6, 10, 7, 9, 11, 24, 14, 14, 11, 9, 4, 4, 4, 4, 4, 4, 4, 4, 5, 4, 7, 4, 4, 16, 5, 4, 4, 4, 5, 4, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -834,9 +834,9 @@
             "min": 15,
             "max": 121,
             "n": 32,
-            "samples": [48, 18, 18, 30, 23, 47, 27, 36, 33, 121, 55, 56, 36, 35, 17, 17, 15, 16, 16, 17, 16, 15, 15, 16, 22, 16, 16, 61, 18, 15, 16, 15]
+            "samples": [30, 23, 47, 27, 36, 33, 121, 55, 56, 36, 35, 17, 17, 15, 16, 16, 17, 16, 15, 15, 16, 22, 16, 16, 61, 18, 15, 16, 15, 18, 18, 18]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -956,14 +956,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 71,
+            "p50": 70,
             "p95": 228,
             "min": 61,
             "max": 315,
             "n": 32,
-            "samples": [186, 71, 73, 121, 92, 173, 111, 185, 127, 315, 228, 206, 142, 142, 70, 69, 63, 61, 65, 68, 68, 62, 64, 64, 83, 64, 63, 125, 74, 62, 63, 64]
+            "samples": [121, 92, 173, 111, 185, 127, 315, 228, 206, 142, 142, 70, 69, 63, 61, 65, 68, 68, 62, 64, 64, 83, 64, 63, 125, 74, 62, 63, 64, 69, 72, 75]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -1083,14 +1083,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 308,
+            "p50": 296,
             "p95": 881,
             "min": 249,
             "max": 895,
             "n": 32,
-            "samples": [739, 286, 285, 481, 369, 640, 430, 749, 509, 863, 881, 895, 560, 564, 279, 279, 253, 249, 310, 316, 263, 254, 254, 259, 308, 260, 253, 643, 309, 254, 255, 252]
+            "samples": [481, 369, 640, 430, 749, 509, 863, 881, 895, 560, 564, 279, 279, 253, 249, 310, 316, 263, 254, 254, 259, 308, 260, 253, 643, 309, 254, 255, 252, 272, 285, 296]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -1236,9 +1236,9 @@
             "min": 4,
             "max": 15,
             "n": 32,
-            "samples": [10, 4, 4, 8, 6, 9, 7, 9, 8, 13, 15, 14, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 7, 4, 4, 4, 4]
+            "samples": [8, 6, 9, 7, 9, 8, 13, 15, 14, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 7, 4, 4, 4, 4, 4, 4, 5]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -1363,9 +1363,9 @@
             "min": 15,
             "max": 55,
             "n": 32,
-            "samples": [41, 18, 18, 30, 23, 35, 27, 35, 31, 53, 53, 55, 36, 35, 17, 17, 16, 15, 15, 16, 16, 16, 15, 16, 16, 16, 17, 27, 18, 16, 15, 15]
+            "samples": [30, 23, 35, 27, 35, 31, 53, 53, 55, 36, 35, 17, 17, 16, 15, 15, 16, 16, 16, 15, 16, 16, 16, 17, 27, 18, 16, 15, 15, 16, 18, 18]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -1485,14 +1485,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 71,
-            "p95": 294,
+            "p50": 70,
+            "p95": 232,
             "min": 62,
             "max": 588,
             "n": 32,
-            "samples": [294, 72, 71, 120, 92, 152, 107, 141, 123, 209, 232, 222, 140, 140, 69, 70, 62, 62, 62, 67, 66, 64, 63, 64, 86, 64, 67, 96, 588, 63, 64, 64]
+            "samples": [120, 92, 152, 107, 141, 123, 209, 232, 222, 140, 140, 69, 70, 62, 62, 62, 67, 66, 64, 63, 64, 86, 64, 67, 96, 588, 63, 64, 64, 68, 71, 74]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -1612,14 +1612,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 286,
-            "p95": 918,
+            "p50": 278,
+            "p95": 852,
             "min": 247,
             "max": 938,
             "n": 32,
-            "samples": [918, 289, 286, 436, 368, 781, 428, 570, 439, 852, 834, 938, 564, 561, 278, 274, 252, 247, 251, 277, 262, 251, 254, 252, 311, 255, 260, 384, 359, 252, 252, 251]
+            "samples": [436, 368, 781, 428, 570, 439, 852, 834, 938, 564, 561, 278, 274, 252, 247, 251, 277, 262, 251, 254, 252, 311, 255, 260, 384, 359, 252, 252, 251, 270, 292, 297]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -1765,9 +1765,9 @@
             "min": 4,
             "max": 14,
             "n": 32,
-            "samples": [13, 4, 4, 7, 6, 11, 7, 9, 7, 13, 13, 14, 9, 10, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 5, 4, 4, 4]
+            "samples": [7, 6, 11, 7, 9, 7, 13, 13, 14, 9, 10, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 5, 4, 4, 4, 4, 4, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -1887,14 +1887,14 @@
         },
         "desktop-macos": {
           "tick_us": {
-            "p50": 18,
+            "p50": 17,
             "p95": 52,
             "min": 15,
             "max": 52,
             "n": 32,
-            "samples": [52, 18, 18, 27, 23, 47, 27, 35, 28, 52, 51, 52, 35, 36, 18, 17, 16, 15, 15, 17, 16, 16, 15, 16, 17, 15, 15, 25, 21, 15, 15, 15]
+            "samples": [27, 23, 47, 27, 35, 28, 52, 51, 52, 35, 36, 18, 17, 16, 15, 15, 17, 16, 16, 15, 16, 17, 15, 15, 25, 21, 15, 15, 15, 16, 17, 18]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -2019,9 +2019,9 @@
             "min": 61,
             "max": 243,
             "n": 32,
-            "samples": [207, 76, 71, 110, 92, 243, 107, 140, 109, 206, 203, 208, 141, 144, 69, 68, 62, 62, 61, 64, 65, 63, 64, 63, 69, 64, 62, 117, 87, 64, 63, 63]
+            "samples": [110, 92, 243, 107, 140, 109, 206, 203, 208, 141, 144, 69, 68, 62, 62, 61, 64, 65, 63, 64, 63, 69, 64, 62, 117, 87, 64, 63, 63, 68, 71, 74]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
@@ -2146,9 +2146,9 @@
             "min": 246,
             "max": 919,
             "n": 32,
-            "samples": [784, 287, 285, 484, 368, 874, 429, 568, 437, 919, 811, 847, 581, 606, 279, 281, 251, 248, 246, 258, 271, 249, 255, 253, 276, 251, 253, 385, 363, 252, 251, 250]
+            "samples": [484, 368, 874, 429, 568, 437, 919, 811, 847, 581, 606, 279, 281, 251, 248, 246, 258, 271, 249, 255, 253, 276, 251, 253, 385, 363, 252, 251, 250, 299, 287, 289]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "desktop-windows": {
           "tick_us": {
diff --git a/test/scenarios/light/scenario_peripheral_switch.json b/test/scenarios/light/scenario_peripheral_switch.json
index 4db58d05..c8198651 100644
--- a/test/scenarios/light/scenario_peripheral_switch.json
+++ b/test/scenarios/light/scenario_peripheral_switch.json
@@ -173,13 +173,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 4,
-            "p95": 16,
+            "p95": 14,
             "min": 4,
             "max": 17,
             "n": 32,
-            "samples": [16, 4, 4, 8, 6, 13, 9, 9, 7, 14, 13, 17, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 5, 4, 4, 4]
+            "samples": [8, 6, 13, 9, 9, 7, 14, 13, 17, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 5, 4, 4, 4, 4, 4, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32p4rev1-eth": {
           "tick_us": {
@@ -298,9 +298,9 @@
             "min": 4,
             "max": 19,
             "n": 32,
-            "samples": [14, 4, 4, 8, 6, 11, 7, 10, 7, 13, 13, 16, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 19, 4, 4, 4]
+            "samples": [8, 6, 11, 7, 10, 7, 13, 13, 16, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 6, 19, 4, 4, 4, 4, 4, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32p4rev1-eth": {
           "tick_us": {
@@ -417,11 +417,11 @@
             "p50": 4,
             "p95": 14,
             "min": 4,
-            "max": 15,
+            "max": 14,
             "n": 32,
-            "samples": [15, 4, 4, 8, 6, 11, 7, 9, 7, 14, 13, 14, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 4, 4, 4]
+            "samples": [8, 6, 11, 7, 9, 7, 14, 13, 14, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 4, 4, 4, 4, 4, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32p4rev1-eth": {
           "tick_us": {
@@ -537,11 +537,11 @@
             "p50": 4,
             "p95": 14,
             "min": 4,
-            "max": 17,
+            "max": 14,
             "n": 32,
-            "samples": [17, 4, 4, 8, 6, 9, 9, 9, 7, 14, 13, 14, 9, 9, 4, 4, 4, 4, 4, 5, 4, 4, 4, 4, 4, 4, 4, 5, 5, 4, 4, 4]
+            "samples": [8, 6, 9, 9, 9, 7, 14, 13, 14, 9, 9, 4, 4, 4, 4, 4, 5, 4, 4, 4, 4, 4, 4, 4, 5, 5, 4, 4, 4, 4, 4, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32p4rev1-eth": {
           "tick_us": {
@@ -656,13 +656,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 4,
-            "p95": 15,
+            "p95": 13,
             "min": 4,
-            "max": 17,
+            "max": 15,
             "n": 32,
-            "samples": [17, 4, 4, 8, 6, 10, 10, 9, 7, 13, 13, 15, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 4, 4, 4]
+            "samples": [8, 6, 10, 10, 9, 7, 13, 13, 15, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 4, 4, 4, 4, 4, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32p4rev1-eth": {
           "tick_us": {
@@ -793,13 +793,13 @@
         "desktop-macos": {
           "tick_us": {
             "p50": 4,
-            "p95": 16,
+            "p95": 14,
             "min": 4,
             "max": 18,
             "n": 32,
-            "samples": [16, 4, 4, 8, 6, 11, 9, 9, 7, 13, 14, 18, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 4, 4, 4]
+            "samples": [8, 6, 11, 9, 9, 7, 13, 14, 18, 9, 9, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 4, 4, 4, 4, 4, 4]
           },
-          "last_updated": "2026-09-06"
+          "last_updated": "2026-09-07"
         },
         "esp32p4rev1-eth": {
           "tick_us": {
diff --git a/test/unit/core/unit_FirmwareImage.cpp b/test/unit/core/unit_FirmwareImage.cpp
new file mode 100644
index 00000000..38d0bfbe
--- /dev/null
+++ b/test/unit/core/unit_FirmwareImage.cpp
@@ -0,0 +1,158 @@
+// Reading a firmware image's own header, which is what stands between a mistyped URL and a board
+// with no recovery image. The MoonBase update ERASES the factory partition before it can know
+// whether a stream is any good, so everything that can reject an image is decided from its first
+// chunk. These tests are that decision.
+//
+// The offsets are pinned against REAL binaries wherever the build tree has them: the layout comes
+// from the ESP32 toolchain, not from us, and a test that only checks our own synthetic bytes
+// would agree with itself while disagreeing with every actual image.
+
+#include "doctest.h"
+
+#include "core/FirmwareImage.h"
+
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <algorithm>
+#include <vector>
+
+using namespace mm::firmware;
+
+namespace {
+
+std::filesystem::path repoRoot() {
+    // test/unit/core/<this file> -> repo root
+    return std::filesystem::path(__FILE__).parent_path().parent_path().parent_path().parent_path();
+}
+
+/// A synthetic image head: magic, chip id, and a descriptor naming a project.
+std::vector<uint8_t> makeImage(uint8_t magic, uint16_t chip, const char* project,
+                               const char* version = "4.0.0-dev", bool withDesc = true) {
+    std::vector<uint8_t> b(kIdentifyBytes, 0);
+    b[0] = magic;
+    b[kChipIdOffset] = static_cast<uint8_t>(chip & 0xFF);
+    b[kChipIdOffset + 1] = static_cast<uint8_t>(chip >> 8);
+    if (withDesc) {
+        const uint32_t m = kDescMagic;
+        std::memcpy(b.data() + kDescOffset, &m, 4);
+        std::memcpy(b.data() + kDescOffset + 16, version, std::strlen(version));
+        std::memcpy(b.data() + kDescOffset + 48, project, std::strlen(project));
+    }
+    return b;
+}
+
+std::vector<uint8_t> readHead(const std::filesystem::path& p) {
+    std::ifstream f(p, std::ios::binary);
+    if (!f) return {};
+    std::vector<uint8_t> b(kIdentifyBytes);
+    f.read(reinterpret_cast<char*>(b.data()), static_cast<std::streamsize>(b.size()));
+    b.resize(static_cast<size_t>(f.gcount()));
+    return b;
+}
+
+} // namespace
+
+namespace {
+
+/// The built images present in the tree, as (path, expected project name) pairs. Empty on a
+/// checkout that has not built for ESP32, which is the case these tests have to tell apart from
+/// "present but not checked": a loop that skips missing files and asserts nothing reports green
+/// either way, which is indistinguishable from a test that ran.
+std::vector<std::pair<std::filesystem::path, std::string>> builtImages() {
+    std::vector<std::pair<std::filesystem::path, std::string>> out;
+    const auto build = repoRoot() / "build";
+    if (!std::filesystem::exists(build)) return out;
+    for (const auto& e : std::filesystem::directory_iterator(build)) {
+        if (!e.is_directory()) continue;
+        for (const auto& [file, project] :
+             {std::pair<const char*, const char*>{"projectMM-moonbase.bin", "projectMM-moonbase"},
+              std::pair<const char*, const char*>{"projectMM.bin", "projectMM"}}) {
+            const auto p = e.path() / file;
+            if (std::filesystem::exists(p)) out.emplace_back(p, project);
+        }
+    }
+    return out;
+}
+
+} // namespace
+
+TEST_CASE("every built image identifies as what it is") {
+    // THE PIN THAT MATTERS: our offsets against images the ESP32 toolchain actually produced. A
+    // synthetic-only test would agree with itself while disagreeing with every real image.
+    //
+    // Every image found is checked, and a found image that cannot be parsed FAILS rather than
+    // being skipped: skipping the unparseable ones is skipping exactly what this catches.
+    const auto images = builtImages();
+    if (images.empty()) {
+        MESSAGE("no built ESP32 images in the tree; run build_esp32.py to exercise this");
+        return;                     // a fresh checkout, not a failure
+    }
+    for (const auto& [path, project] : images) {
+        CAPTURE(path.string());
+        const auto head = readHead(path);
+        REQUIRE(head.size() >= kIdentifyBytes);
+        const auto info = identify(head.data(), head.size());
+        CHECK(info.valid);                                  // begins with the image magic
+        CHECK(info.described);                              // carries a readable descriptor
+        CHECK(info.chip != ChipId::Invalid);                // names a chip we know
+        CHECK(std::string(info.project) == project);
+        // And the rule the install path runs: a MoonBase image is accepted for its own chip, an
+        // app image is refused whatever the chip. Both directions, against real binaries.
+        const char* verdict = moonBaseRejection(info, info.chip);
+        if (project == "projectMM-moonbase") CHECK(verdict == nullptr);
+        else CHECK(verdict == std::string("not a MoonBase image"));
+    }
+    MESSAGE("checked ", images.size(), " built image(s)");
+}
+
+TEST_CASE("an HTML error page is refused before anything is erased") {
+    // What a wrong URL actually delivers: a 404 body or a login page, with a 200 status.
+    const char* html = "<!DOCTYPE html><html><head><title>404 Not Found</title></head>";
+    const auto info = identify(reinterpret_cast<const uint8_t*>(html), std::strlen(html));
+    CHECK_FALSE(info.valid);
+    CHECK(moonBaseRejection(info, ChipId::Esp32S3) == std::string("not a firmware image"));
+}
+
+TEST_CASE("an image for the wrong chip is refused") {
+    // There is one MoonBase per chip and they are one paste apart. A checksum does NOT catch
+    // this: the image is perfectly valid, it just cannot execute on this silicon.
+    const auto classic = makeImage(kImageMagic, 0x0000, "projectMM-moonbase");
+    const auto info = identify(classic.data(), classic.size());
+    CHECK(info.valid);
+    CHECK(info.chip == ChipId::Esp32);
+    CHECK(moonBaseRejection(info, ChipId::Esp32) == nullptr);            // right chip: accepted
+    CHECK(moonBaseRejection(info, ChipId::Esp32S3) == std::string("image is for another chip"));
+}
+
+TEST_CASE("an image with no description is refused") {
+    const auto bare = makeImage(kImageMagic, 0x0009, "", "", /*withDesc=*/false);
+    const auto info = identify(bare.data(), bare.size());
+    CHECK(info.valid);
+    CHECK_FALSE(info.described);
+    CHECK(moonBaseRejection(info, ChipId::Esp32S3) == std::string("image carries no description"));
+}
+
+TEST_CASE("a truncated stream reports what it can rather than reading past its buffer") {
+    // The first chunk can arrive short. Reading a fixed 128 bytes from a 40-byte buffer is how a
+    // vetting check becomes the vulnerability it was added to prevent.
+    const auto full = makeImage(kImageMagic, 0x0009, "projectMM-moonbase");
+    for (size_t n : {size_t{0}, size_t{1}, size_t{12}, size_t{13}, size_t{31}, size_t{40},
+                     kDescOffset + 95}) {
+        const auto info = identify(full.data(), n);         // must not read past n
+        if (n == 0) { CHECK_FALSE(info.valid); continue; }
+        CHECK(info.valid);                                   // the magic is there
+        CHECK_FALSE(info.described);                         // but the descriptor is not complete
+        CHECK(moonBaseRejection(info, ChipId::Esp32S3) != nullptr);
+    }
+}
+
+TEST_CASE("a 32-character project name that fills its field stays terminated") {
+    // IDF leaves a name that exactly fills its 32 bytes unterminated. Copying all 32 into a
+    // 32-byte buffer would leave no NUL, and every later strcmp would run off the end.
+    auto b = makeImage(kImageMagic, 0x0009, "projectMM-moonbase");
+    std::memset(b.data() + kDescOffset + 48, 'x', 32);       // no terminator in the field
+    const auto info = identify(b.data(), b.size());
+    CHECK(std::strlen(info.project) == 31);                  // truncated, and NUL-terminated
+    CHECK(moonBaseRejection(info, ChipId::Esp32S3) == std::string("not a MoonBase image"));
+}
diff --git a/test/unit/core/unit_FirmwareUpdateModule.cpp b/test/unit/core/unit_FirmwareUpdateModule.cpp
index 8727601b..1ee9e53c 100644
--- a/test/unit/core/unit_FirmwareUpdateModule.cpp
+++ b/test/unit/core/unit_FirmwareUpdateModule.cpp
@@ -35,15 +35,25 @@ TEST_CASE("FirmwareUpdateModule firmware control populated") {
     // appears on a real device but NOT on desktop/test where firmwarePartition() returns 0 — assert
     // its TYPE only when present (a Progress control), rather than its presence, so this stays valid
     // on both.
-    bool hasVersion = false, hasBuild = false;
+    bool hasVersion = false, hasBuild = false, hasPartition = false;
     for (uint8_t i = 0; i < fw.controls().count(); i++) {
         const auto& c = fw.controls()[i];
         if (std::strcmp(c.name, "version") == 0) hasVersion = true;
         if (std::strcmp(c.name, "build") == 0) hasBuild = true;
-        if (std::strcmp(c.name, "firmwarePartition") == 0) CHECK(c.type == mm::ControlType::Progress);
+        // `partition`, renamed from `firmwarePartition` when one control set began describing
+        // either image. The old name left this CHECK inside a condition that is never true, so it
+        // asserted nothing while looking like it did.
+        if (std::strcmp(c.name, "partition") == 0) {
+            hasPartition = true;
+            CHECK(c.type == mm::ControlType::Progress);
+        }
     }
     CHECK(hasVersion);
     CHECK(hasBuild);
+    // Not asserted present: the control is added only when the platform reports a partition size,
+    // and desktop reports 0. What is asserted is its TYPE when it does exist, which is what the
+    // old `firmwarePartition` spelling silently stopped checking.
+    (void)hasPartition;
 }
 
 // OTA phase is surfaced through the shared status slot (MoonModule::setStatus()),
diff --git a/test/unit/core/unit_MoonBaseContract.cpp b/test/unit/core/unit_MoonBaseContract.cpp
index cb816c29..97e13cc7 100644
--- a/test/unit/core/unit_MoonBaseContract.cpp
+++ b/test/unit/core/unit_MoonBaseContract.cpp
@@ -117,4 +117,84 @@ TEST_CASE("the two boot images serve the OTA routes under the same names") {
     for (const char* gone : {"\"POST /install\"", "\"POST /install-url\"", "'/install'", "'/install-url'"}) {
         CHECK_MESSAGE(moonbase.find(gone) == std::string::npos, "MoonBase still references " << gone);
     }
+
+    // Each image owns one direction of the install, and only that one. MoonBase writes the app
+    // slot; the app writes the factory slot. Neither can write the partition it executes from,
+    // which is why both routes have to exist and why they cannot live in the same image.
+    CHECK_MESSAGE(app.find("/api/firmware/moonbase-update") != std::string::npos,
+                  "the app must serve the route that installs a new MoonBase");
+    CHECK_MESSAGE(moonbase.find("/api/firmware/moonbase-update") == std::string::npos,
+                  "MoonBase cannot install itself: it runs from the partition it would erase");
+
+    // A ~750 KB image has to STREAM, which the server gates on an explicit allowlist: a route
+    // missing from it is refused with "body too large" before its handler ever runs, so every
+    // image looks equally invalid. Found on the bench, where the vetting appeared to reject a
+    // perfectly good image.
+    // On the allowlist, checked by the route's presence in the isStreamingRoute expression rather
+    // than by its strncmp length: the length is an implementation detail that a reformat moves,
+    // while what must hold is that this route is named there at all.
+    const size_t allow = app.find("isStreamingRoute");
+    REQUIRE(allow != std::string::npos);
+    const bool onAllowlist = app.find("moonbase-update", allow) < app.find("bodyNeeded >", allow);
+    CHECK_MESSAGE(onAllowlist,
+                  "the MoonBase update route must be on the streaming allowlist");
+
+    // Both ways in: a browser push, and a URL the device fetches itself. The URL form is what
+    // makes a GitHub release asset installable without relaying ~750 KB through the browser.
+    CHECK_MESSAGE(app.find("/api/firmware/moonbase-update-url") != std::string::npos,
+                  "the app must also install a MoonBase from a URL");
+
+    // The UI decides a device HAS MoonBase by looking for a control the module publishes only
+    // there, so the two have to name the same one. They did not once: the control was renamed as
+    // part of making the set generic, and the card silently lost both its image tabs and its way
+    // into MoonBase, on a device that had one. Nothing failed, it just quietly was not there.
+    const std::string ui = read("src/ui/app.js");
+    CHECK_MESSAGE(ui.find("c.name === \"image\"") != std::string::npos,
+                  "the UI must detect MoonBase by the control the module actually publishes");
+    CHECK_MESSAGE(read("src/core/FirmwareUpdateModule.h").find("addSelect(\"image\"") != std::string::npos,
+                  "the module must publish that control");
+
+    // EVERY INSTALL SHOWS PROGRESS. Six ways in (a release, a URL, a file; for the app and for
+    // MoonBase) and all six raise the overlay, either by watching the device's own byte counts or
+    // by driving it from a browser-pushed upload. This was established over several rounds and
+    // then lost twice to changes that looked local, so it is pinned rather than remembered: an
+    // install with no visible progress is indistinguishable from one that has hung.
+    for (const char* raiser : {"watchInstall(k)", "moonbaseUpdateFlow({ url })",
+                               "moonbaseUpdateFlow({ file })", "uploadWithProgress("}) {
+        CHECK_MESSAGE(ui.find(raiser) != std::string::npos,
+                      "every install path must show progress: missing " << raiser);
+    }
+    CHECK_MESSAGE(ui.find("showUpdateOverlay()") != std::string::npos,
+                  "the progress overlay must exist");
+
+    // PROGRESS RIDES THE STATUS, in one shape, for every writer. The app parses it in exactly one
+    // place (installProgress); MoonBase's own page parses it again because that image shares no
+    // sources with the app. Two readers that must agree, so both are pinned: a writer that
+    // changed the shape used to leave one of them silently matching nothing.
+    CHECK_MESSAGE(ui.find("function installProgress(") != std::string::npos,
+                  "the app must parse install progress in ONE place");
+    CHECK_MESSAGE(moonbase.find(") of (") != std::string::npos,
+                  "MoonBase's page must read the same 'N of M' shape the app writes");
+
+    // NEITHER IMAGE MAY BE INSTALLED AS THE OTHER. The MoonBase install refuses an app image, and
+    // the app install refuses a MoonBase one. The second direction is the worse failure and was
+    // missing: MoonBase written into the app slot leaves BOTH partitions holding it, and every
+    // route out then resolves to the partition being executed (0x1501), so the device answers,
+    // serves a page, and can only be recovered with a cable. Found by doing exactly that.
+    // BOTH images must refuse it, because either can be the one writing the app slot: the app
+    // installs in place on a dual-OTA board, and MoonBase installs on a board that has one. The
+    // check first went only into the app, which is the image that never runs the install on the
+    // very devices where this failure is unrecoverable.
+    const std::string ota = read("src/platform/esp32/platform_esp32_ota.cpp");
+    CHECK_MESSAGE(ota.find("that is a MoonBase image, not an app") != std::string::npos,
+                  "the app install must refuse a MoonBase image");
+    CHECK_MESSAGE(moonbase.find("that is a MoonBase image, not an app") != std::string::npos,
+                  "MoonBase's install must refuse one too: it writes the app slot");
+    CHECK_MESSAGE(moonbase.find("this MoonBase is in the app slot") != std::string::npos,
+                  "MoonBase must report, not loop, when it is running from the app slot");
+
+    // MoonBase says which MoonBase it is. Without it, two devices running different builds are
+    // indistinguishable, which is what turned one bench failure into a git bisect.
+    CHECK_MESSAGE(moonbase.find("/api/version") != std::string::npos,
+                  "MoonBase must report its own version");
 }
diff --git a/test/unit/core/unit_PartitionTables.cpp b/test/unit/core/unit_PartitionTables.cpp
index f766fa1c..5ed20124 100644
--- a/test/unit/core/unit_PartitionTables.cpp
+++ b/test/unit/core/unit_PartitionTables.cpp
@@ -194,3 +194,28 @@ TEST_CASE("a table carries either two OTA slots or one slot plus a recovery app,
         CHECK((dualOta || safeboot));
     }
 }
+
+TEST_CASE("every MoonBase factory slot can be erased and holds a MoonBase image") {
+    // The app installs a new MoonBase by erasing this partition and streaming into it, and
+    // esp_partition_erase_range works in whole 4 KB sectors: an offset or size that is not a
+    // multiple would erase past the slot or leave a tail behind. Both are 64 KB aligned today
+    // (the app-alignment rule above), which satisfies this, but the erase depends on the weaker
+    // property and should say so rather than inherit it by luck.
+    constexpr uint32_t kSector = 4096;
+    constexpr uint32_t kImageBytes = 743 * 1024;   // the built image, which the slot must hold
+    int factories = 0;
+    for (const auto& t : allTables()) {
+        CAPTURE(t.file);
+        for (const auto& p : t.parts) {
+            if (p.type != "app" || p.subtype != "factory") continue;
+            ++factories;
+            CAPTURE(p.name);
+            CHECK((p.offset % kSector) == 0u);
+            CHECK((p.size % kSector) == 0u);
+            CHECK(p.size >= kImageBytes);
+        }
+    }
+    // A zero here would mean the tables stopped carrying MoonBase, or that this test stopped
+    // finding them: either way the checks above proved nothing.
+    CHECK(factories > 0);
+}
diff --git a/test/unit/core/unit_moonlive_compiler.cpp b/test/unit/core/unit_moonlive_compiler.cpp
index 10eb3e60..f2b514e4 100644
--- a/test/unit/core/unit_moonlive_compiler.cpp
+++ b/test/unit/core/unit_moonlive_compiler.cpp
@@ -105,6 +105,228 @@ TEST_CASE("arguments reach a function two calls deep") {
     CHECK(buf[6] == 44);
 }
 
+// --- function arguments ------------------------------------------------------------------------
+//
+// Passed BY VALUE, through a block in the arena rather than in the frame: each function opens its
+// own frame and a slot is addressed off the current frame pointer (on Xtensa via the windowed ABI's
+// `entry a1, N`), so a caller cannot reach the slot its callee will read. The arena is what both
+// activations share. See kScriptArgBase in MoonLiveBuiltins.h.
+
+TEST_CASE("a function receives the value its caller passed") {
+    moonlive::MoonLive eng;
+    REQUIRE(eng.compile("class T {\n"
+                        "  void paint(int idx, int level) { setRGB(idx, level, 0, 0); }\n"
+                        "  void tick() { paint(0, 11); paint(1, 22); }\n"
+                        "}\n", kTable, kSys));
+    REQUIRE(eng.ok());
+    std::vector<uint8_t> buf(4 * 3, 0);
+    eng.run(buf.data(), 4, 3, 0, "tick");
+    CHECK(buf[0] == 11);
+    CHECK(buf[3] == 22);
+}
+
+TEST_CASE("an argument is a copy: writing the parameter leaves the caller's variable alone") {
+    // By VALUE is the contract, and this is what it means at the call site. A reference would make
+    // the second pixel 99 as well.
+    moonlive::MoonLive eng;
+    REQUIRE(eng.compile("class T {\n"
+                        "  void bump(int v) { v = 99; setRGB(0, v, 0, 0); }\n"
+                        "  void tick() { int mine = 7; bump(mine); setRGB(1, mine, 0, 0); }\n"
+                        "}\n", kTable, kSys));
+    REQUIRE(eng.ok());
+    std::vector<uint8_t> buf(4 * 3, 0);
+    eng.run(buf.data(), 4, 3, 0, "tick");
+    CHECK(buf[0] == 99);   // the callee saw its own copy
+    CHECK(buf[3] == 7);    // the caller's variable is untouched
+}
+
+TEST_CASE("a recursive function keeps its own arguments through the calls it makes") {
+    // THE case the single arena block has to survive. One block serves every depth only because a
+    // callee copies its arguments into its own frame before it can call anything; without that
+    // copy, the inner call would overwrite the outer one's arguments and the countdown would never
+    // terminate or would paint the wrong pixels.
+    moonlive::MoonLive eng;
+    REQUIRE(eng.compile("class T {\n"
+                        "  void down(int n) { if (n > 0) { setRGB(n, n, 0, 0); down(n - 1); } }\n"
+                        "  void tick() { down(3); }\n"
+                        "}\n", kTable, kSys));
+    REQUIRE(eng.ok());
+    std::vector<uint8_t> buf(4 * 3, 0);
+    eng.run(buf.data(), 4, 3, 0, "tick");
+    CHECK(buf[9] == 3);    // each activation kept its own n
+    CHECK(buf[6] == 2);
+    CHECK(buf[3] == 1);
+}
+
+TEST_CASE("a nested call does not clobber the arguments of the call it sits inside") {
+    // `outer(inner(x))`: the inner call writes the same arena block. It has RETURNED before the
+    // outer arguments are written, which is what makes one block enough.
+    moonlive::MoonLive eng;
+    REQUIRE(eng.compile("class T {\n"
+                        "  int twice(int v) { return v * 2; }\n"
+                        "  void paint(int idx, int level) { setRGB(idx, level, 0, 0); }\n"
+                        "  void tick() { paint(0, twice(21)); }\n"
+                        "}\n", kTable, kSys));
+    REQUIRE(eng.ok());
+    std::vector<uint8_t> buf(4 * 3, 0);
+    eng.run(buf.data(), 4, 3, 0, "tick");
+    CHECK(buf[0] == 42);
+}
+
+TEST_CASE("calling a function with the wrong number of arguments is refused") {
+    // Both directions, because a silent mismatch would read whatever the arena block held from an
+    // earlier call: a wrong picture rather than an error.
+    moonlive::MoonLive tooFew;
+    CHECK_FALSE(tooFew.compile("class T {\n"
+                               "  void paint(int a, int b) { setRGB(a, b, 0, 0); }\n"
+                               "  void tick() { paint(1); }\n"
+                               "}\n", kTable, kSys));
+    moonlive::MoonLive tooMany;
+    CHECK_FALSE(tooMany.compile("class T {\n"
+                                "  void paint(int a) { setRGB(a, 1, 0, 0); }\n"
+                                "  void tick() { paint(1, 2); }\n"
+                                "}\n", kTable, kSys));
+}
+
+// What an argument COSTS. The question a script author actually asks before rewriting a helper to
+// take parameters, and the reason it is measured rather than reasoned about: the answer decides
+// whether the clearer form is also the affordable one.
+TEST_CASE("passing an argument costs about what writing a member costs") {
+    // The OLD style: a member is the channel, written by the caller and read by the helper.
+    moonlive::MoonLive viaMember;
+    REQUIRE(viaMember.compile("class T {\n"
+                              "  int idx = 0;\n"
+                              "  void paint() { setRGB(idx, 11, 0, 0); }\n"
+                              "  void tick() { idx = 0; paint(); idx = 1; paint(); }\n"
+                              "}\n", kTable, kSys));
+    // The NEW style: the same work, said directly.
+    moonlive::MoonLive viaArg;
+    REQUIRE(viaArg.compile("class T {\n"
+                           "  void paint(int idx) { setRGB(idx, 11, 0, 0); }\n"
+                           "  void tick() { paint(0); paint(1); }\n"
+                           "}\n", kTable, kSys));
+    MESSAGE("member-passing: " << viaMember.codeLen() << " bytes, "
+            "argument: " << viaArg.codeLen() << " bytes");
+    // Both go through the arena: a member write is StoreCtrl, an argument is StoreCtrl32 into the
+    // argument block, and the helper reads it back either way. So the argument form must not cost
+    // materially more, and this pins that rather than trusting it.
+    CHECK(viaArg.codeLen() < viaMember.codeLen() * 3 / 2);
+}
+
+// --- else if, and the for's comparisons ---------------------------------------------------------
+
+TEST_CASE("a byte parameter wraps at 255, the way a byte local does") {
+    // A parameter is a local, so it has to behave like one. Handed 300 it kept 300, while the same
+    // value assigned to a byte local inside the body narrowed to 44: one type, two behaviors,
+    // depending only on how the value arrived.
+    moonlive::MoonLive eng;
+    REQUIRE(eng.compile("class T {\n"
+                        "  void paint(byte v) { setRGB(0, v, 0, 0); }\n"
+                        "  void tick() { paint(300); }\n"
+                        "}\n", kTable, kSys));
+    std::vector<uint8_t> buf(3, 0);
+    eng.run(buf.data(), 1, 3, 0, "tick");
+    CHECK(buf[0] == 44);            // 300 & 0xFF, as a byte local would hold
+}
+
+TEST_CASE("a function declaring more parameters than the block holds is refused") {
+    // The arena block carries kMaxScriptArgs values, and the CALL site clamps to it. The prologue
+    // did not: it emitted one LoadCtrl32 per DECLARED parameter, so a fifth read past the end of
+    // the arena allocation and a later one wrote there. Script text is user-supplied on a
+    // network-reachable device, so the declaration has to be refused where it is written.
+    moonlive::MoonLive five;
+    CHECK_FALSE(five.compile("class T {\n"
+                             "  void helper(int a, int b, int c, int d, int e) { setRGB(a, 1, 0, 0); }\n"
+                             "  void tick() { helper(0, 0, 0, 0, 0); }\n"
+                             "}\n", kTable, kSys));
+
+    // Exactly the maximum still compiles: the bound is the block's size, not one below it.
+    moonlive::MoonLive four;
+    CHECK(four.compile("class T {\n"
+                       "  void helper(int a, int b, int c, int d) { setRGB(a, b, c, d); }\n"
+                       "  void tick() { helper(0, 1, 2, 3); }\n"
+                       "}\n", kTable, kSys));
+}
+
+TEST_CASE("a parameter name is checked the way a local is") {
+    // A parameter IS a local, so a name refused inside the body must be refused in the list.
+    // Without these checks a parameter could shadow a builtin (making it unreachable for the whole
+    // function) or repeat another, where lookups find the first while the caller stages into both.
+    for (const char* params : {"int t",            // a system variable
+                               "int width",        // a system variable
+                               "int a, int a"}) {  // the same name twice
+        moonlive::MoonLive eng;
+        char src[256];
+        std::snprintf(src, sizeof(src),
+                      "class T {\n  void helper(%s) { }\n  void tick() { helper(1); }\n}\n", params);
+        CAPTURE(params);
+        CHECK_FALSE(eng.compile(src, kTable, kSys));
+    }
+    // And a well-formed list still compiles.
+    moonlive::MoonLive ok;
+    CHECK(ok.compile("class T {\n"
+                     "  void helper(int a, int b) { setRGB(a, b, 0, 0); }\n"
+                     "  void tick() { helper(0, 42); }\n"
+                     "}\n", kTable, kSys));
+}
+
+TEST_CASE("a chain of else if arms picks exactly one") {
+    // The shape a MODE control needs, and every arm is exercised: a chain that fell through would
+    // still paint the right value for the first case while painting a later arm's for the rest.
+    // The selector is a plain local per compile rather than a control, so the arms are chosen the
+    // same way at runtime without needing a control-capable fixture table.
+    for (const auto& [mode, want] : std::vector<std::pair<int, uint8_t>>{
+             {0, 10}, {1, 20}, {2, 30}, {7, 40}}) {
+        CAPTURE(mode);
+        char src[384];
+        std::snprintf(src, sizeof(src),
+                      "class T {\n"
+                      "  void tick() {\n"
+                      "    int mode = %d;\n"
+                      "    if (mode == 0) { setRGB(0, 10, 0, 0); }\n"
+                      "    else if (mode == 1) { setRGB(0, 20, 0, 0); }\n"
+                      "    else if (mode == 2) { setRGB(0, 30, 0, 0); }\n"
+                      "    else { setRGB(0, 40, 0, 0); }\n"
+                      "  }\n"
+                      "}\n", mode);
+        moonlive::MoonLive eng;
+        REQUIRE(eng.compile(src, kTable, kSys));
+        REQUIRE(eng.ok());
+        std::vector<uint8_t> buf(3, 0);
+        eng.run(buf.data(), 1, 3, 0, "tick");
+        CHECK(buf[0] == want);    // exactly the arm that matches, and nothing after it
+    }
+}
+
+TEST_CASE("a for counts up to its bound with < and through it with <=") {
+    // `<=` is the same guard against a limit one higher, computed once rather than per iteration.
+    moonlive::MoonLive lt;
+    REQUIRE(lt.compile("class T {\n"
+                       "  void tick() { for (int i = 0; i < 3; i = i + 1) { setRGB(i, 99, 0, 0); } }\n"
+                       "}\n", kTable, kSys));
+    std::vector<uint8_t> a(4 * 3, 0);
+    lt.run(a.data(), 4, 3, 0, "tick");
+    CHECK(a[6] == 99);            // index 2 painted
+    CHECK(a[9] == 0);             // index 3 NOT painted
+
+    moonlive::MoonLive le;
+    REQUIRE(le.compile("class T {\n"
+                       "  void tick() { for (int i = 0; i <= 3; i = i + 1) { setRGB(i, 99, 0, 0); } }\n"
+                       "}\n", kTable, kSys));
+    std::vector<uint8_t> b(4 * 3, 0);
+    le.run(b.data(), 4, 3, 0, "tick");
+    CHECK(b[9] == 99);            // index 3 IS painted
+}
+
+TEST_CASE("a descending for is refused with the workaround named") {
+    // Refused rather than half-supported: the step's DIRECTION is not modelled, so a `>` accepted
+    // here would emit an ascending guard around a descending body.
+    moonlive::MoonLive eng;
+    CHECK_FALSE(eng.compile("class T {\n"
+                            "  void tick() { for (int i = 3; i > 0; i = i - 1) { setRGB(i, 9, 0, 0); } }\n"
+                            "}\n", kTable, kSys));
+}
+
 // UNBOUNDED recursion must degrade visibly and keep the device rendering. A fixed render-task
 // stack means the alternative is a reset, which the robustness rule forbids. A reset is what
 // this script produced before the depth guard: ~176 bytes of frame per activation against a 12 KB
diff --git a/test/unit/light/unit_AudioLevel.cpp b/test/unit/light/unit_AudioLevel.cpp
index 34a68791..fc452452 100644
--- a/test/unit/light/unit_AudioLevel.cpp
+++ b/test/unit/light/unit_AudioLevel.cpp
@@ -1,11 +1,9 @@
 // @module AudioService
-// @also AudioVolumeEffect
 
 #include "doctest.h"
 #include "core/AudioLevel.h"
 #include "core/AudioService.h"
 #include "core/ModuleFactory.h"
-#include "light/effects/AudioVolumeEffect.h"
 #include "light/effects/AudioSpectrumEffect.h"
 
 #include <cmath>
@@ -167,20 +165,16 @@ TEST_CASE("AudioLevel: isqrt64 matches floor(sqrt) on a spread of values") {
 // null even with no mic (so a consumer added before the mic can't deref null).
 TEST_CASE("AudioService + audio effects are registered and createable (boot-loop guard)") {
     mm::ModuleFactory::registerType<mm::AudioService>("AudioService");
-    mm::ModuleFactory::registerType<mm::AudioVolumeEffect>("AudioVolumeEffect");
     mm::ModuleFactory::registerType<mm::AudioSpectrumEffect>("AudioSpectrumEffect");
 
     auto* mic = mm::ModuleFactory::create("AudioService");
     REQUIRE(mic != nullptr);
     CHECK(mic->role() == mm::ModuleRole::Service);
 
-    auto* vol = mm::ModuleFactory::create("AudioVolumeEffect");
     auto* spec = mm::ModuleFactory::create("AudioSpectrumEffect");
-    REQUIRE(vol != nullptr);
     REQUIRE(spec != nullptr);
 
     delete mic;
-    delete vol;
     delete spec;
 }
 
diff --git a/test/unit/light/unit_ColorTrailsEffect.cpp b/test/unit/light/unit_ColorTrailsEffect.cpp
new file mode 100644
index 00000000..833f6841
--- /dev/null
+++ b/test/unit/light/unit_ColorTrailsEffect.cpp
@@ -0,0 +1,89 @@
+// @module ColorTrailsEffect
+
+// The two flows this effect can carry color with, and the property that separates them.
+//
+// `Noise` is the separable one it is named for: a shift per row and per column, so the picture
+// shears and folds. `Radial` is a current along the line through the center, computed per pixel
+// from geometry with no field and no state. What distinguishes radial from every other flow here
+// is DIRECTION: color must end up further from the center than it started (or nearer, running in),
+// which a shear can never do on average.
+
+#include "doctest.h"
+#include "golden_frame.h"                 // the effect harness: Layouts, Grid, Layer
+#include "light/effects/ColorTrailsEffect.h"
+
+#include <cstdlib>
+
+using namespace mm;
+
+namespace {
+
+/// Mean distance from the center of every lit sample, weighted by brightness. The one number that
+/// tells an outward flow from an inward one: a shear moves color around, radial moves it out.
+double litRadius(const Layer& layer, uint16_t w, uint16_t h) {
+    const auto& buf = layer.buffer();
+    const double cx = w / 2.0, cy = h / 2.0;
+    double sum = 0.0, weight = 0.0;
+    for (uint16_t y = 0; y < h; y++) {
+        for (uint16_t x = 0; x < w; x++) {
+            const size_t i = (static_cast<size_t>(y) * w + x) * 3u;
+            if (i + 2 >= buf.bytes()) continue;
+            const double v = buf.data()[i] + buf.data()[i + 1] + buf.data()[i + 2];
+            if (v <= 0.0) continue;
+            const double dx = x - cx, dy = y - cy;
+            sum += v * std::sqrt(dx * dx + dy * dy);
+            weight += v;
+        }
+    }
+    return weight > 0.0 ? sum / weight : 0.0;
+}
+
+/// Run the effect for `frames` and hand back how far the lit color sits from the center.
+double runFlow(uint8_t flowType, uint16_t frames) {
+    golden::ScopedTestClock clock(1000);
+    Layouts layouts; GridLayout grid; Layer layer; ColorTrailsEffect effect;
+    grid.width = 32; grid.height = 32; grid.depth = 1;
+    layouts.addChild(&grid);
+    layer.setLayouts(&layouts);
+    layer.setChannelsPerLight(3);
+    layer.addChild(&effect);
+    effect.flowType = flowType;
+    effect.flow = 255;                 // the strongest current, so the drift is unambiguous
+    effect.mode = static_cast<uint8_t>(ColorTrailsEffect::Mode::Orbital);
+    layer.applyState();
+    for (uint16_t i = 0; i < frames; i++) { platform::setTestNowMs(1000 + i * 20u); layer.tick(); }
+    return litRadius(layer, 32, 32);
+}
+
+}  // namespace
+
+TEST_CASE("an outward radial flow carries color further from the center than an inward one") {
+    const double out = runFlow(static_cast<uint8_t>(ColorTrailsEffect::Flow::Radial), 60);
+    const double in  = runFlow(static_cast<uint8_t>(ColorTrailsEffect::Flow::RadialIn), 60);
+    // Both draw the same emitter in the same place; only the direction of the wind differs, so the
+    // difference in where the color ends up IS the flow.
+    CHECK(out > in);
+}
+
+TEST_CASE("every flow renders something rather than draining the picture to black") {
+    for (uint8_t f = 0; f <= static_cast<uint8_t>(ColorTrailsEffect::Flow::RadialIn); f++) {
+        CHECK(runFlow(f, 40) > 0.0);
+    }
+}
+
+TEST_CASE("the center cell has no direction to move in, and does not divide by zero") {
+    // The one place a radial field is undefined. Reaching it must leave the effect running rather
+    // than trapping: the guard is a floored radius, and this is what pins it.
+    golden::ScopedTestClock clock(1000);
+    Layouts layouts; GridLayout grid; Layer layer; ColorTrailsEffect effect;
+    grid.width = 1; grid.height = 1; grid.depth = 1;   // the center IS the whole grid
+    layouts.addChild(&grid);
+    layer.setLayouts(&layouts);
+    layer.setChannelsPerLight(3);
+    layer.addChild(&effect);
+    effect.flowType = static_cast<uint8_t>(ColorTrailsEffect::Flow::Radial);
+    effect.flow = 255;
+    layer.applyState();
+    for (uint16_t i = 0; i < 20; i++) { platform::setTestNowMs(1000 + i * 20u); layer.tick(); }
+    CHECK(layer.buffer().bytes() > 0);   // still rendering
+}
diff --git a/test/unit/light/unit_Drivers_livePalettes.cpp b/test/unit/light/unit_Drivers_livePalettes.cpp
new file mode 100644
index 00000000..1d3c183c
--- /dev/null
+++ b/test/unit/light/unit_Drivers_livePalettes.cpp
@@ -0,0 +1,121 @@
+// @module Drivers
+// @also Palette, MoonLivePalette
+
+// How a DOWNLOADED palette becomes a selectable one.
+//
+// A scripted palette arrives as a `.mlp` file the UI writes to the device, and three separate things
+// have to agree before a user can pick it: the scan has to FIND the file, the picker has to LIST it,
+// and the `palette` control has to ACCEPT its index. Each of those failed independently in the
+// field, and each failure looked the same from the outside ("I downloaded it and nothing happened"),
+// so they are pinned separately here.
+
+#include "doctest.h"
+#include "light/drivers/Drivers.h"
+#include "light/Palette.h"
+#include "light/moonlive/MoonLiveScriptFile.h"
+#include "platform/platform.h"
+#include "../core/conditional_controls.h"   // mm::test::controlIndex
+
+#include <cstdio>
+#include <cstring>
+#include <filesystem>
+
+using namespace mm;
+
+namespace {
+
+/// The smallest thing that stands in for a palette script. These tests never RUN it: they are about
+/// DISCOVERY (which files are found and offered), and what a scripted palette paints is covered by
+/// MoonLivePalette's own tests.
+constexpr const char* kPaletteSrc = "void setup() {}\n";
+
+/// An empty filesystem root of its own per test, so a count assertion means what it says: the
+/// developer's own device directory carries whatever palettes they have been trying, and a test
+/// that counted those would pass or fail by accident. fsSetRoot is provided for exactly this
+/// (platform.h), and the FilesystemModule persistence tests use the same shape.
+struct IsolatedFs {
+    char root[256];
+    explicit IsolatedFs(const char* tag) {
+        std::snprintf(root, sizeof(root), "/tmp/mm_palettes_%s_%u", tag,
+                      static_cast<unsigned>(platform::millis()));
+        std::filesystem::remove_all(root);
+        platform::fsSetRoot(root);
+        REQUIRE(platform::fsMount());
+    }
+    ~IsolatedFs() {
+        platform::fsSetRoot("");        // back to the real root for every other test
+        std::filesystem::remove_all(root);
+    }
+};
+
+/// Write one `.mlp` into a script directory, creating the directory first: fsWriteAtomic does not
+/// create parents, exactly as POST /api/file does not.
+void writePalette(const char* dir, const char* name) {
+    platform::fsMkdir(dir);
+    char path[160];
+    std::snprintf(path, sizeof(path), "%s/%s", dir, name);
+    REQUIRE(platform::fsWriteAtomic(path, kPaletteSrc, std::strlen(kPaletteSrc)));
+}
+
+/// The highest index the `palette` control ACCEPTS. This is the number every one of these bugs
+/// moved: the control carries its ceiling in `max`, and a value above it is refused with "value out
+/// of range", which is what made a freshly downloaded palette unselectable even once it was listed.
+int32_t paletteMax(Drivers& drv) {
+    const int i = test::controlIndex(drv, "palette");
+    REQUIRE(i >= 0);
+    return drv.controls()[static_cast<uint8_t>(i)].max;
+}
+
+}  // namespace
+
+TEST_CASE("a palette downloaded to the factory directory is offered by the picker") {
+    // THE FIELD BUG: the UI downloads a `.mlp` to the FACTORY directory (`/.moonlive`) so that a
+    // later edit can shadow it, but the scan only ever read the USER directory (`/moonlive`). The
+    // file was on the device and could never be listed, so the picker said "reopen the picker to
+    // select it" and reopening changed nothing, forever.
+    IsolatedFs fs("factory");
+    Drivers drv;
+    drv.defineControls();
+    const int32_t before = paletteMax(drv);
+
+    writePalette(mm::moonlive::kFactoryScriptDir, "unit-factory.mlp");
+    drv.rebuildControls();      // CLEARS then re-defines, which is what a schema change does
+
+    CHECK(paletteMax(drv) == before + 1);
+}
+
+TEST_CASE("editing a factory palette leaves one entry, not two") {
+    // Editing a factory script SAVES A SECOND FILE of the same name to the user directory, which
+    // then shadows the factory copy (resolveScript prefers it). Both directories are scanned, so
+    // without a dedupe the same palette would appear twice in the picker, and one of those two rows
+    // would load a file the user cannot see.
+    IsolatedFs fs("both");
+    Drivers drv;
+    drv.defineControls();
+    const int32_t before = paletteMax(drv);
+
+    writePalette(mm::moonlive::kFactoryScriptDir, "unit-both.mlp");
+    writePalette(mm::moonlive::kScriptDir, "unit-both.mlp");
+    drv.rebuildControls();      // CLEARS then re-defines, which is what a schema change does
+
+    CHECK(paletteMax(drv) == before + 1);   // ONE entry, from two files
+}
+
+TEST_CASE("a palette added while running becomes selectable without a reboot") {
+    // THE BLOCKER BEHIND THE OTHER TWO: `palette`'s ceiling is baked when the control is defined
+    // (the scripted count plus the built-ins), while a downloaded file is discovered by prepare().
+    // So the new palette was LISTED and then REFUSED with "value out of range": the picker offered
+    // a row that could not be chosen, and only a reboot fixed it. prepare() therefore rebuilds the
+    // controls when the count moves.
+    IsolatedFs fs("late");
+    Drivers drv;
+    drv.defineControls();
+    const int32_t before = paletteMax(drv);
+
+    // Arriving AFTER the control was defined is the whole point: this is a download onto a running
+    // device, not a file that was present at boot.
+    writePalette(mm::moonlive::kFactoryScriptDir, "unit-late.mlp");
+    drv.prepare();
+
+    CHECK(paletteMax(drv) == before + 1);
+}
diff --git a/test/unit/light/unit_FixedPointEffect.cpp b/test/unit/light/unit_FixedPointEffect.cpp
new file mode 100644
index 00000000..3e939f64
--- /dev/null
+++ b/test/unit/light/unit_FixedPointEffect.cpp
@@ -0,0 +1,112 @@
+// @module FixedPointEffect
+
+#include "doctest.h"
+#include "light/effects/FixedPointEffect.h"
+#include "light/layouts/GridLayout.h"
+#include "light/layouts/Layouts.h"
+
+#include <cstring>
+#include <string>
+#include <vector>
+
+namespace {
+
+// A panel big enough for the shapes to have room, small enough that the sub-pixel property is what
+// is being tested rather than raw resolution.
+struct Panel {
+    mm::Layouts layouts;
+    mm::GridLayout grid;
+    mm::Layer layer;
+    mm::FixedPointEffect effect;
+
+    explicit Panel(mm::lengthType size = 24) {
+        grid.width = size;
+        grid.height = size;
+        grid.depth = 1;
+        layouts.addChild(&grid);
+        layer.setLayouts(&layouts);
+        layer.setChannelsPerLight(3);
+        layer.addChild(&effect);
+        layer.applyState();
+    }
+
+    // How many lights carry any color at all: the cheapest measure of "something was drawn".
+    int litCount() {
+        auto& buf = layer.buffer();
+        int n = 0;
+        for (size_t i = 0; i < buf.count(); i++) {
+            const uint8_t* p = buf.data() + i * 3;
+            if (p[0] || p[1] || p[2]) n++;
+        }
+        return n;
+    }
+
+    // How many carry a PARTIAL value: the antialiasing, which is the whole point of the effect.
+    int partialCount() {
+        auto& buf = layer.buffer();
+        int n = 0;
+        for (size_t i = 0; i < buf.count(); i++) {
+            const uint8_t* p = buf.data() + i * 3;
+            for (int c = 0; c < 3; c++) if (p[c] > 0 && p[c] < 255) { n++; break; }
+        }
+        return n;
+    }
+};
+
+}  // namespace
+
+TEST_CASE("every demo draws something on a panel") {
+    // The audit that matters for a Select: a value that renders nothing is a dead menu entry, and
+    // nothing else in the suite would notice, since a black frame is a valid frame.
+    for (uint8_t d = 1; d < mm::FixedPointEffect::kDemoCount; d++) {
+        Panel p;
+        p.effect.demo = d;
+        p.effect.fade = 255;               // no trail carried between frames: judge one frame alone
+        for (int i = 0; i < 30; i++) p.layer.tick();
+        CAPTURE(std::string(mm::FixedPointEffect::kDemoNames[d]));
+        CHECK(p.litCount() > 0);
+    }
+}
+
+// NOT TESTED HERE: that a shape moves by fractions of a pixel between frames, which is the whole
+// property this effect demonstrates. Its hands run on the WALL CLOCK (fixed periods, as the
+// original does), and a unit test ticks a dozen frames in well under a millisecond, so nothing
+// moves and any assertion about motion would be measuring the harness rather than the effect. The
+// sub-pixel behavior is pinned where it actually lives, on the primitives in unit_draw.cpp, and
+// judged on the bench.
+
+TEST_CASE("the all setting reaches every demo, and only the demos") {
+    // The rotation picks a demo from the wall clock, so a test cannot tick its way into the next
+    // slot: 200 ticks pass in milliseconds and a dwell is seconds. Testing the SELECTION instead is
+    // both faster and stricter, since the arithmetic is where the bugs are: an off-by-one that
+    // lands on `all` itself would recurse, and one that skips the last demo would hide it forever.
+    using FP = mm::FixedPointEffect;
+    bool seen[FP::kDemoCount] = {};
+    for (uint32_t slotIndex = 0; slotIndex < FP::kCycled * 3; slotIndex++) {
+        const uint8_t active = static_cast<uint8_t>(slotIndex % FP::kCycled + 1);
+        REQUIRE(active != FP::kAll);            // never selects "all" itself
+        REQUIRE(active < FP::kDemoCount);       // never runs off the end of the list
+        seen[active] = true;
+    }
+    for (uint8_t d = 1; d < FP::kDemoCount; d++) {
+        CAPTURE(FP::kDemoNames[d]);
+        CHECK(seen[d]);                          // every demo gets its turn
+    }
+}
+
+TEST_CASE("a demo switch does not join the old figure to the new one") {
+    // The curve demos share one point buffer. Carried across a switch, the first segment drawn
+    // joins a spirograph point to a lissajous point, which is a bright line straight across the
+    // panel: visible, wrong, and gone the moment the trail is cleared on the change.
+    Panel p;
+    p.effect.demo = mm::FixedPointEffect::kSpirograph;
+    p.effect.fade = 255;
+    for (int i = 0; i < 40; i++) p.layer.tick();
+    const int spiro = p.litCount();
+
+    p.effect.demo = mm::FixedPointEffect::kLissajous;
+    p.layer.tick();                        // the FIRST frame after the switch is the risky one
+    // One frame of a fresh trail lights very little; a carried-over trail would light roughly what
+    // the full spirograph did, plus the bogus joining segment.
+    CHECK(p.litCount() < spiro);
+}
diff --git a/test/unit/light/unit_MoonLiveMotion.cpp b/test/unit/light/unit_MoonLiveMotion.cpp
index e8d43ef7..ee0324fc 100644
--- a/test/unit/light/unit_MoonLiveMotion.cpp
+++ b/test/unit/light/unit_MoonLiveMotion.cpp
@@ -147,11 +147,11 @@ TEST_CASE("setPan past the last light is ignored") {
 }
 
 // The two SHIPPED motion scripts, run on a real head rig. They are the reference a user reads to
-// learn setPan/setTilt, so "it compiles" is not enough: aim.mle must put every head where its
-// sliders say, and sweep.mle must actually move them and differ between formations.
-TEST_CASE("aim.mle points every head where its sliders say") {
+// learn setPan/setTilt, so "it compiles" is not enough: mh-aim.mle must put every head where its
+// sliders say, and mh-sweep.mle must actually move them and differ between formations.
+TEST_CASE("mh-aim.mle points every head where its sliders say") {
     HeadRig rig;
-    rig.effect.setScript(shipScript("aim.mle"));
+    rig.effect.setScript(shipScript("mh-aim.mle"));
     rig.layouts.applyState();
     rig.layer.applyState();
     platform::setTestNowMs(1);
@@ -169,10 +169,10 @@ TEST_CASE("aim.mle points every head where its sliders say") {
     CHECK(rig.channel(0, rig.fc.pan) == 128);
 }
 
-TEST_CASE("sweep.mle moves the rig and its formations differ") {
+TEST_CASE("mh-sweep.mle moves the rig and its formations differ") {
     auto aimsFor = [](uint8_t formation) {
         HeadRig rig;
-        rig.effect.setScript(shipScript("sweep.mle"));
+        rig.effect.setScript(shipScript("mh-sweep.mle"));
         rig.layouts.applyState();
         rig.layer.applyState();
         // A scripted control is set by name, the same path the UI takes.
diff --git a/test/unit/light/unit_MoonLiveScriptResolve.cpp b/test/unit/light/unit_MoonLiveScriptResolve.cpp
index 7c2aaf91..84c3fafa 100644
--- a/test/unit/light/unit_MoonLiveScriptResolve.cpp
+++ b/test/unit/light/unit_MoonLiveScriptResolve.cpp
@@ -155,3 +155,101 @@ TEST_CASE("the compiler and the change-detector read the same file") {
     REQUIRE(moonlive::scriptFileHash(name, hash));
     CHECK(hash == moonlive::scriptHash(factory.c_str(), factory.size()));
 }
+
+// The fourth question: is a user copy HIDING a shipped one? From outside the two cases are
+// identical, and a stale user copy has twice been chased as a compiler bug (a control that never
+// appeared; then an old-syntax copy failing at offsets that matched nothing in the file just
+// written). The binding puts the answer in its status, and this is the predicate it asks.
+TEST_CASE("a user copy is reported as a shadow only when a shipped copy is under it") {
+    Rig rig;   // its own root: these write scripts, and without it that is the real device
+    const char* name = "unit-shadow.mle";
+    drop(moonlive::kScriptDir, name);
+    drop(moonlive::kFactoryScriptDir, name);
+
+    CHECK_FALSE(moonlive::scriptShadowsFactory(name));                 // neither
+
+    put(moonlive::kFactoryScriptDir, name, "class A { void tick() {} }\n");
+    CHECK_FALSE(moonlive::scriptShadowsFactory(name));                 // shipped only: no shadow
+
+    put(moonlive::kScriptDir, name, "class A { void tick() {} }\n");
+    CHECK(moonlive::scriptShadowsFactory(name));                       // both: the user's hides it
+
+    drop(moonlive::kFactoryScriptDir, name);
+    CHECK_FALSE(moonlive::scriptShadowsFactory(name));                 // user's own script: not a shadow
+    drop(moonlive::kScriptDir, name);
+}
+
+// The fifth question, and the one the shadow marker alone cannot answer: has the SHIPPED copy moved
+// on since the user forked it? Without lineage an edit and a stale leftover look identical forever,
+// which is what let 29 pre-`void tick()` copies sit on a bench board failing every compile.
+TEST_CASE("a fork knows whether the shipped script has changed under it") {
+    Rig rig;   // its own root, for the same reason
+    const char* name = "unit-lineage.mle";
+    const char* shipped = "class A { void tick() {} }\n";
+    drop(moonlive::kScriptDir, name);
+    drop(moonlive::kFactoryScriptDir, name);
+
+    put(moonlive::kFactoryScriptDir, name, shipped);
+    put(moonlive::kScriptDir, name, "class A { void tick() { fill(1, 2, 3); } }\n");
+
+    // No lineage recorded (an older fork): "cannot say", never "unchanged". Claiming an update on a
+    // guess would send someone to discard work for nothing.
+    CHECK_FALSE(moonlive::scriptFactoryMovedOn(name));
+
+    REQUIRE(moonlive::noteScriptLineage(name, moonlive::scriptHash(shipped, std::strlen(shipped))));
+    CHECK_FALSE(moonlive::scriptFactoryMovedOn(name));          // forked from exactly this text
+
+    put(moonlive::kFactoryScriptDir, name, "class A { void tick() { fill(9, 9, 9); } }\n");
+    CHECK(moonlive::scriptFactoryMovedOn(name));                // the library moved under the fork
+
+    char side[128];
+    moonlive::scriptLineagePath(name, side, sizeof(side));
+    platform::fsRemove(side);
+    drop(moonlive::kScriptDir, name);
+    drop(moonlive::kFactoryScriptDir, name);
+}
+
+// Lineage is bookkeeping the DEVICE does, on the same hook that reacts to any write or delete, so
+// every writer gets it: the editor, a restored backup, a script pushed by a tool.
+TEST_CASE("forking a shipped script records what it was forked from, and reverting forgets it") {
+    Rig rig;   // its own root, for the same reason
+    const char* name = "unit-fork.mle";
+    const char* shipped = "class A { void tick() {} }\n";
+    char userPath[96], side[128];
+    std::snprintf(userPath, sizeof(userPath), "%s/%s", moonlive::kScriptDir, name);
+    moonlive::scriptLineagePath(name, side, sizeof(side));
+    drop(moonlive::kScriptDir, name);
+    drop(moonlive::kFactoryScriptDir, name);
+    platform::fsRemove(side);
+
+    // A write with nothing shipped under it is a user's OWN script, not a fork: no lineage.
+    put(moonlive::kScriptDir, name, "class A { void tick() {} }\n");
+    moonlive::noteForkedFrom(userPath);
+    uint32_t from = 0;
+    CHECK_FALSE(moonlive::scriptLineage(name, from));
+
+    // Now the same name ships too, and the next write IS a fork.
+    put(moonlive::kFactoryScriptDir, name, shipped);
+    put(moonlive::kScriptDir, name, "class A { void tick() { fill(1, 2, 3); } }\n");
+    moonlive::noteForkedFrom(userPath);
+    REQUIRE(moonlive::scriptLineage(name, from));
+    CHECK(from == moonlive::scriptHash(shipped, std::strlen(shipped)));
+
+    // EDITING the fork again must not move the branch point. Re-stamping here would mark the fork
+    // up to date with a library version the user never saw, erasing the one fact the record exists
+    // to carry.
+    put(moonlive::kFactoryScriptDir, name, "class A { void tick() { fill(9, 9, 9); } }\n");
+    put(moonlive::kScriptDir, name, "class A { void tick() { fill(4, 5, 6); } }\n");
+    moonlive::noteForkedFrom(userPath);
+    REQUIRE(moonlive::scriptLineage(name, from));
+    CHECK(from == moonlive::scriptHash(shipped, std::strlen(shipped)));   // still the ORIGINAL
+    CHECK(moonlive::scriptFactoryMovedOn(name));                          // and the library moved
+
+    // Reverting removes the fork; the hook fires again and the lineage goes with it, so a later
+    // fork of this name is not compared against a hash from one that no longer exists.
+    platform::fsRemove(userPath);
+    moonlive::noteForkedFrom(userPath);
+    CHECK_FALSE(moonlive::scriptLineage(name, from));
+
+    drop(moonlive::kFactoryScriptDir, name);
+}
diff --git a/test/unit/light/unit_MoonLiveScripts.cpp b/test/unit/light/unit_MoonLiveScripts.cpp
index 867f36ee..6f10c5a3 100644
--- a/test/unit/light/unit_MoonLiveScripts.cpp
+++ b/test/unit/light/unit_MoonLiveScripts.cpp
@@ -451,8 +451,15 @@ TEST_CASE("every compile error fits the status line whole, its position included
     }
     INFO("longest diagnostic is " << longest << " chars");
     CHECK(longest >= 40);              // a control: a parse that found nothing would pass silently
-    // " @" + up to 5 digits + the terminator, against the buffer MoonLiveScript declares.
-    CHECK(longest + 8 <= mm::moonlive::MoonLiveScript::kMaxStatus);
+    // The shadow marker and its ": " in front, then " @" + up to 5 digits + the terminator, against
+    // the buffer MoonLiveScript declares. The marker is in the budget because it prefixes the
+    // longest message on the day a stale user copy fails, which is exactly when the offset matters.
+    // The LONGER of the two marks: the stale one prefixes exactly when a stale user copy fails,
+    // which is the case the offset matters most in.
+    const size_t shadow = std::strlen(mm::moonlive::MoonLiveScript::kShadowMark);
+    const size_t stale  = std::strlen(mm::moonlive::MoonLiveScript::kStaleMark);
+    const size_t mark = (stale > shadow ? stale : shadow) + 2;
+    CHECK(longest + mark + 8 <= mm::moonlive::MoonLiveScript::kMaxStatus);
     (void)longestText;
 }
 
diff --git a/test/unit/light/unit_MovingHeadEffect.cpp b/test/unit/light/unit_MovingHeadEffect.cpp
index 962b2661..cf62e022 100644
--- a/test/unit/light/unit_MovingHeadEffect.cpp
+++ b/test/unit/light/unit_MovingHeadEffect.cpp
@@ -142,3 +142,91 @@ TEST_CASE("a 1 x N fixture chain still varies head by head") {
     CHECK(pans.size() > 1);
 }
 
+
+// --- the beam wheels ---------------------------------------------------------------------------
+//
+// A head's gobo and rotate channels were reachable by the PRESET model (FixtureChannels carries all
+// five motion roles, Drivers assigns their slots and Correction reads them back) but by no EFFECT:
+// EffectBase exposed setPan/setTilt/setZoom and nothing else, so the two wheels were plumbed end to
+// end with nobody able to write them. Ported from MoonLight's MovingHeads effects, which drive both.
+
+namespace {
+
+// A head with the beam wheels as well as aim: RGBW + pan + tilt + rotate + gobo, in the packing
+// order FixtureChannels::forEachMotionSlot defines (pan, tilt, zoom, rotate, gobo), with zoom
+// absent, which is what makes this a good test: the slots must close up around the missing role.
+constexpr uint8_t kBeamChannels = mm::FixtureChannels::kMotionBase + 4;
+
+mm::FixtureChannels beamRig() {
+    mm::FixtureChannels fc;
+    fc.pan    = mm::FixtureChannels::kMotionBase + 0;
+    fc.tilt   = mm::FixtureChannels::kMotionBase + 1;
+    fc.rotate = mm::FixtureChannels::kMotionBase + 2;
+    fc.gobo   = mm::FixtureChannels::kMotionBase + 3;
+    return fc;
+}
+
+}  // namespace
+
+TEST_CASE("a head's gobo and rotate carry the values the effect asks for") {
+    mm::Layouts layouts;
+    mm::GridLayout grid;
+    grid.width = 3;
+    grid.height = 1;
+    grid.depth = 1;
+    layouts.addChild(&grid);
+
+    mm::Layer layer;
+    layer.setLayouts(&layouts);
+    layer.setChannelsPerLight(kBeamChannels);
+    layer.setFixtureChannels(beamRig());
+
+    mm::MovingHeadEffect heads;
+    heads.gobo = 96;
+    heads.rotate = 200;
+    layer.addChild(&heads);
+    layer.applyState();
+
+    for (int i = 0; i < 3; i++) layer.tick();
+
+    auto& buf = layer.buffer();
+    REQUIRE(buf.count() == 3);
+    for (size_t i = 0; i < buf.count(); i++) {
+        const uint8_t* light = buf.data() + i * kBeamChannels;
+        CHECK(light[mm::FixtureChannels::kMotionBase + 3] == 96);    // gobo
+        CHECK(light[mm::FixtureChannels::kMotionBase + 2] == 200);   // rotate
+    }
+}
+
+// The orthogonality the whole role model rests on: the same effect on a fixture WITHOUT the wheels
+// writes no beam bytes rather than scribbling on whatever channel happens to sit there. A rig of
+// plain pan/tilt heads has its own meaning for the bytes past tilt, and a stray gobo write would
+// land on one of them.
+TEST_CASE("a head with no gobo channel is not written past its own channels") {
+    mm::Layouts layouts;
+    mm::GridLayout grid;
+    grid.width = 2;
+    grid.height = 1;
+    grid.depth = 1;
+    layouts.addChild(&grid);
+
+    mm::Layer layer;
+    layer.setLayouts(&layouts);
+    layer.setChannelsPerLight(kBeamChannels);   // room for four motion bytes
+    layer.setFixtureChannels(motionRig());      // but the fixture declares only pan + tilt
+
+    mm::MovingHeadEffect heads;
+    heads.gobo = 96;
+    heads.rotate = 200;
+    layer.addChild(&heads);
+    layer.applyState();
+
+    for (int i = 0; i < 3; i++) layer.tick();
+
+    auto& buf = layer.buffer();
+    for (size_t i = 0; i < buf.count(); i++) {
+        const uint8_t* light = buf.data() + i * kBeamChannels;
+        CHECK(light[mm::FixtureChannels::kMotionBase + 2] == 0);
+        CHECK(light[mm::FixtureChannels::kMotionBase + 3] == 0);
+    }
+}
diff --git a/test/unit/light/unit_Rings241Layout.cpp b/test/unit/light/unit_Rings241Layout.cpp
index 09d40c91..f96aaed5 100644
--- a/test/unit/light/unit_Rings241Layout.cpp
+++ b/test/unit/light/unit_Rings241Layout.cpp
@@ -97,3 +97,38 @@ TEST_CASE("outside in puts light 0 on the outer ring and the center LED last, ri
     CHECK(o == kTotal);
     CHECK(b[kTotal - 1] == a[0]);              // the center LED is the last light when wired outside in
 }
+
+// `angleFirst` says where light 0 of each ring sits, in degrees from the bottom. A disc is soldered
+// with its first LED wherever the builder started, so without it the image is fixed against the
+// hardware. The default of 0 must reproduce MoonLight's placement exactly, since that is what every
+// other test here pins.
+TEST_CASE("angleFirst moves the first light around the ring, and 0 leaves the disc where it was") {
+    mm::Rings241Layout plain;
+    const auto at0 = coordsOf(plain);
+
+    mm::Rings241Layout alsoZero;
+    alsoZero.angleFirst = 0;
+    CHECK(coordsOf(alsoZero) == at0);          // the default is not merely near MoonLight's, it IS it
+
+    // A quarter turn moves every ring's first light. The disc is symmetric, so the SET of
+    // coordinates barely changes; what moves is which index sits where, which is the point.
+    mm::Rings241Layout turned;
+    turned.angleFirst = 90;
+    const auto at90 = coordsOf(turned);
+    REQUIRE(at90.size() == at0.size());
+    CHECK_FALSE(at90 == at0);
+
+    // The center LED has no angle, so it cannot move however far the disc is turned.
+    CHECK(at90[0] == at0[0]);
+
+    // 359 is one degree short of a full turn, so the disc is nearly back where it started: the
+    // control stops at 359 because 360 IS 0 (the ring closes) and offering both invites the
+    // question of which one it is.
+    mm::Rings241Layout almost;
+    almost.angleFirst = 359;
+    const auto at359 = coordsOf(almost);
+    for (size_t i = 0; i < at0.size(); i++) {
+        CHECK(std::abs(int(at359[i].x) - int(at0[i].x)) <= 1);
+        CHECK(std::abs(int(at359[i].y) - int(at0[i].y)) <= 1);
+    }
+}
diff --git a/test/unit/light/unit_draw.cpp b/test/unit/light/unit_draw.cpp
index f107c273..5e84305a 100644
--- a/test/unit/light/unit_draw.cpp
+++ b/test/unit/light/unit_draw.cpp
@@ -761,3 +761,90 @@ TEST_CASE("scrolling along y moves every column, and along z every cell of the v
             CHECK(vol.data()[((size_t(1) * 2 + y) * 2 + x) * 3] == 1);
         }
 }
+
+// --- ring and strokeLine -----------------------------------------------------------------------
+//
+// The two shapes a fixed-point canvas needs beyond a disc: an outline and a thick line. Ported for
+// Sutaburosu's fixed-point demos, which draw clock hands, orbits and spokes from them.
+
+TEST_CASE("a ring is hollow: lit on its band, dark at its center") {
+    Buffer buf;
+    Coord3D dims{11, 11, 1};
+    REQUIRE(buf.allocate(121, 3));
+    const draw::Canvas cv = draw::Canvas::of(buf, 11, 11, 1);
+    draw::ring(cv, draw::toSub(5), draw::toSub(5), draw::toSub(3), draw::toSub(1),
+               RGB{255, 255, 255});
+
+    // The hole is what separates a ring from a disc, and the property a caller relies on when
+    // stacking rings: the middle must stay dark however thick the stroke.
+    CHECK(isBlack(at(buf, dims, 5, 5, 0)));
+    CHECK(at(buf, dims, 5, 2, 0).r > 0);       // on the band, three up from center
+    CHECK(isBlack(at(buf, dims, 0, 0, 0)));    // outside it entirely
+}
+
+TEST_CASE("a ring's inner edge is antialiased, not cut") {
+    Buffer buf;
+    Coord3D dims{21, 21, 1};
+    REQUIRE(buf.allocate(441, 3));
+    const draw::Canvas cv = draw::Canvas::of(buf, 21, 21, 1);
+    draw::ring(cv, draw::toSub(10), draw::toSub(10), draw::toSub(6), draw::toSub(2),
+               RGB{255, 255, 255});
+
+    // Walking in from the band toward the center must pass through a PARTIAL pixel. Two discs
+    // subtracted would step straight from full to black here, which is the bug this shape exists to
+    // avoid: the inner edge of a subtracted ring is never blended, only removed.
+    bool sawPartial = false;
+    for (int y = 10; y >= 0; y--) {
+        const uint8_t v = at(buf, dims, 10, static_cast<lengthType>(y), 0).r;
+        if (v > 0 && v < 255) sawPartial = true;
+    }
+    CHECK(sawPartial);
+}
+
+TEST_CASE("a thick line covers pixels a one-pixel line would miss") {
+    Buffer thin, thick;
+    Coord3D dims{15, 15, 1};
+    REQUIRE(thin.allocate(225, 3));
+    REQUIRE(thick.allocate(225, 3));
+    const draw::Canvas cvThin = draw::Canvas::of(thin, 15, 15, 1);
+    const draw::Canvas cvThick = draw::Canvas::of(thick, 15, 15, 1);
+
+    draw::line(cvThin, {2, 7, 0}, {12, 7, 0}, RGB{255, 255, 255});
+    draw::strokeLine(cvThick, draw::toSub(2), draw::toSub(7), draw::toSub(12), draw::toSub(7),
+                     draw::toSub(3), RGB{255, 255, 255});
+
+    // Width is the whole point: a row either side of the axis is dark for the thin line and lit for
+    // the thick one.
+    CHECK(isBlack(at(thin, dims, 7, 5, 0)));
+    CHECK(at(thick, dims, 7, 6, 0).r > 0);
+    CHECK(at(thick, dims, 7, 8, 0).r > 0);
+}
+
+TEST_CASE("a thick line stops at its endpoints instead of running along the infinite line") {
+    Buffer buf;
+    Coord3D dims{15, 15, 1};
+    REQUIRE(buf.allocate(225, 3));
+    const draw::Canvas cv = draw::Canvas::of(buf, 15, 15, 1);
+    // A short horizontal stroke in the middle of the grid.
+    draw::strokeLine(cv, draw::toSub(6), draw::toSub(7), draw::toSub(8), draw::toSub(7),
+                     draw::toSub(2), RGB{255, 255, 255});
+
+    CHECK(at(buf, dims, 7, 7, 0).r > 0);       // on the segment
+    // Well past both ends must be dark. Without clamping the projection to the segment, every pixel
+    // in the row would be "on the line" and the stroke would span the whole grid.
+    CHECK(isBlack(at(buf, dims, 0, 7, 0)));
+    CHECK(isBlack(at(buf, dims, 14, 7, 0)));
+}
+
+TEST_CASE("a zero-length thick line draws a dot rather than nothing") {
+    Buffer buf;
+    Coord3D dims{9, 9, 1};
+    REQUIRE(buf.allocate(81, 3));
+    const draw::Canvas cv = draw::Canvas::of(buf, 9, 9, 1);
+    // What a fully retracted clock hand asks for. Dividing by the length would be a divide by zero,
+    // so this case is handled rather than guarded against.
+    draw::strokeLine(cv, draw::toSub(4), draw::toSub(4), draw::toSub(4), draw::toSub(4),
+                     draw::toSub(3), RGB{255, 255, 255});
+
+    CHECK(at(buf, dims, 4, 4, 0).r > 0);
+}