diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
index 328c3d322..6bcd15d22 100644
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
     "isRoot": true,
     "tools": {
         "vpk": {
-            "version": "0.0.1298",
+            "version": "1.2.161",
             "commands": [
                 "vpk"
             ],
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 75297f3a3..a8b2ae8d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  ZIG_VERSION: "0.16.0"
+  ZIG_VERSION: "0.17.0"
 
 jobs:
   changes:
diff --git a/.github/workflows/plugin-loop.yml b/.github/workflows/plugin-loop.yml
index 52c992559..8fd20fe89 100644
--- a/.github/workflows/plugin-loop.yml
+++ b/.github/workflows/plugin-loop.yml
@@ -16,7 +16,7 @@ on:
     inputs:
       zig_version:
         description: "Zig to measure with (a version, or master)"
-        default: "0.16.0"
+        default: "0.17.0"
       backends:
         description: "Comma-separated: default, llvm, self-hosted"
         default: "default,llvm,self-hosted"
@@ -34,7 +34,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  ZIG_VERSION: ${{ inputs.zig_version || '0.16.0' }}
+  ZIG_VERSION: ${{ inputs.zig_version || '0.17.0' }}
 
 jobs:
   measure:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b3f116108..16f427006 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  ZIG_VERSION: "0.16.0"
+  ZIG_VERSION: "0.17.0"
 
 jobs:
   # Linux + Windows: no fizzy_release environment (no signing secrets needed).
@@ -114,7 +114,7 @@ jobs:
 
       - uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: "8.0"
+          dotnet-version: "10.0"  # vpk 1.2 targets .NET 10
 
       # Prefetch before msvcup/package so lazy deps (e.g. zigwin32 from GitHub) get retry
       # backoff; zig build msvcup-setup alone can hit HttpConnectionClosing with no retries.
@@ -278,7 +278,7 @@ jobs:
 
       - uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: "8.0"
+          dotnet-version: "10.0"  # vpk 1.2 targets .NET 10
 
       - name: Fetch deps with retries
         shell: bash
@@ -349,7 +349,13 @@ jobs:
           log="$RUNNER_TEMP/package-${{ matrix.channel }}.log"
           n=0
           until [ "$n" -ge 3 ]; do
-            if zig build package -Doptimize=ReleaseFast "-Dtarget=${{ matrix.target }}" 2>&1 | tee "$log"; then
+            # Signing as build options: zig build caches its configuration without regard to the
+            # environment, so build.zig does not read the FIZZY_MACOS_* variables itself.
+            sign=()
+            [ -n "${FIZZY_MACOS_SIGN_APP:-}" ] && sign+=("-Dmacos-sign-app=$FIZZY_MACOS_SIGN_APP")
+            [ -n "${FIZZY_MACOS_SIGN_INSTALLER:-}" ] && sign+=("-Dmacos-sign-installer=$FIZZY_MACOS_SIGN_INSTALLER")
+            [ -n "${FIZZY_MACOS_NOTARY_PROFILE:-}" ] && sign+=("-Dmacos-notary-profile=$FIZZY_MACOS_NOTARY_PROFILE")
+            if zig build package -Doptimize=ReleaseFast "-Dtarget=${{ matrix.target }}" ${sign[@]+"${sign[@]}"} 2>&1 | tee "$log"; then
               exit 0
             fi
             if ! grep -Eq 'HttpConnectionClosing|invalid HTTP response|TlsInitializationFailed|ConnectionResetByPeer|TemporaryNameServerFailure|unable to fetch|connection reset' "$log"; then
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 4db3c81b1..a74d33b3f 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -59,7 +59,7 @@ on:
         default: ""
 
 env:
-  ZIG_VERSION: "0.16.0"
+  ZIG_VERSION: "0.17.0"
   WEBSITE: fizzyedit/website
 
 jobs:
diff --git a/app/App.zig b/app/App.zig
index 078b051bf..8c4155d4d 100644
--- a/app/App.zig
+++ b/app/App.zig
@@ -844,11 +844,11 @@ pub fn readPluginReservedField(gpa: std.mem.Allocator, settings_data: ?[:0]const
     const data = settings_data orelse return null;
     const plugins = SettingsPluginsZon.extractField(gpa, data, "plugins") orelse return null;
     defer gpa.free(plugins);
-    const plugins_z = gpa.dupeZ(u8, plugins) catch return null;
+    const plugins_z = gpa.dupeSentinel(u8, plugins, 0) catch return null;
     defer gpa.free(plugins_z);
     const id_block = SettingsPluginsZon.extractField(gpa, plugins_z, id) orelse return null;
     defer gpa.free(id_block);
-    const id_z = gpa.dupeZ(u8, id_block) catch return null;
+    const id_z = gpa.dupeSentinel(u8, id_block, 0) catch return null;
     defer gpa.free(id_z);
     return SettingsPluginsZon.extractField(gpa, id_z, field);
 }
@@ -858,11 +858,11 @@ pub fn readPluginSettingsText(gpa: std.mem.Allocator, settings_data: ?[:0]const
     const data = settings_data orelse return null;
     const plugins = SettingsPluginsZon.extractField(gpa, data, "plugins") orelse return null;
     defer gpa.free(plugins);
-    const plugins_z = gpa.dupeZ(u8, plugins) catch return null;
+    const plugins_z = gpa.dupeSentinel(u8, plugins, 0) catch return null;
     defer gpa.free(plugins_z);
     const id_block = SettingsPluginsZon.extractField(gpa, plugins_z, id) orelse return null;
     defer gpa.free(id_block);
-    const id_z = gpa.dupeZ(u8, id_block) catch return null;
+    const id_z = gpa.dupeSentinel(u8, id_block, 0) catch return null;
     defer gpa.free(id_z);
     return SettingsPluginsZon.extractField(gpa, id_z, "settings");
 }
diff --git a/app/Recents.zig b/app/Recents.zig
index 8a535f74f..4b38e6b12 100644
--- a/app/Recents.zig
+++ b/app/Recents.zig
@@ -49,9 +49,10 @@ pub fn load(allocator: std.mem.Allocator, path: []const u8) !Recents {
     if (core.fs.readZ(allocator, dvui.io, path) catch null) |data| {
         defer allocator.free(data);
 
-        if (std.zon.parse.fromSliceAlloc(Disk, allocator, data, null, .{ .ignore_unknown_fields = true }) catch null) |disk| {
-            defer std.zon.parse.free(allocator, disk);
-
+        var disk_arena: std.heap.ArenaAllocator = .init(allocator);
+        defer disk_arena.deinit();
+        var disk_diag: std.zon.parse.Diagnostics = undefined;
+        if (std.zon.parse.fromSlice(Disk, .{ .gpa = allocator, .arena = disk_arena.allocator(), .source = data, .diagnostics = &disk_diag, .ignore_unknown_fields = true }) catch null) |disk| {
             for (disk.folders) |folder| {
                 // A folder on a mount (`gdrive://…`) is not the disk's to check: it exists
                 // whenever its plugin is signed in, which is decided at open time.
diff --git a/app/Secrets.zig b/app/Secrets.zig
index b7f4e91ae..f4102611b 100644
--- a/app/Secrets.zig
+++ b/app/Secrets.zig
@@ -138,7 +138,7 @@ fn save(self: *Secrets) !void {
     const tmp = try std.fmt.allocPrint(self.gpa, "{s}.tmp", .{self.path});
     defer self.gpa.free(tmp);
     {
-        var file = try std.Io.Dir.createFileAbsolute(self.io, tmp, .{ .permissions = @enumFromInt(0o600), .truncate = true });
+        var file = try std.Io.Dir.createFileAbsolute(self.io, tmp, .{ .permissions = @fromBackingInt(@intCast(0o600)), .truncate = true });
         defer file.close(self.io);
         try file.writeStreamingAll(self.io, out.written());
     }
diff --git a/app/automation/Service.zig b/app/automation/Service.zig
index 77c2eaf1d..b8d7b7a4f 100644
--- a/app/automation/Service.zig
+++ b/app/automation/Service.zig
@@ -112,7 +112,7 @@ fn playFor(self: *Service, bytes: []const u8, author: ?sdk.Author) Api.Play {
         else => .{ .invalid = @errorName(err) },
     };
     if (self.current) |t| self.remember(.{ .ticket = t, .outcome = last });
-    const ticket: Api.Ticket = @enumFromInt(self.next);
+    const ticket: Api.Ticket = @fromBackingInt(@intCast(self.next));
     self.next += 1;
     self.current = ticket;
     return .{ .started = ticket };
@@ -170,22 +170,22 @@ pub fn frameEnded(self: *Service, end_micros: ?u32) bool {
 }
 
 fn snapshot(ctx: *anyopaque) Api.SnapshotTicket {
-    const s = from(ctx).snapshots orelse return @enumFromInt(0);
-    return @enumFromInt(s.request());
+    const s = from(ctx).snapshots orelse return @fromBackingInt(@intCast(0));
+    return @fromBackingInt(@intCast(s.request()));
 }
 
 fn snapshotText(ctx: *anyopaque, ticket: Api.SnapshotTicket) ?[]const u8 {
     const s = from(ctx).snapshots orelse return null;
-    return s.get(@intFromEnum(ticket));
+    return s.get(@backingInt(ticket));
 }
 
 fn capture(ctx: *anyopaque, window: []const u8) Api.CaptureTicket {
-    const c = from(ctx).captures orelse return @enumFromInt(0);
-    return @enumFromInt(c.request(window));
+    const c = from(ctx).captures orelse return @fromBackingInt(@intCast(0));
+    return @fromBackingInt(@intCast(c.request(window)));
 }
 
 fn captureImage(ctx: *anyopaque, ticket: Api.CaptureTicket) ?Api.Image {
     const c = from(ctx).captures orelse return null;
-    const image = c.get(@intFromEnum(ticket)) orelse return null;
+    const image = c.get(@backingInt(ticket)) orelse return null;
     return .{ .pixels = image.pixels, .width = image.width, .height = image.height };
 }
diff --git a/app/automation/overlay.zig b/app/automation/overlay.zig
index f3eb017fe..74c569eb9 100644
--- a/app/automation/overlay.zig
+++ b/app/automation/overlay.zig
@@ -634,12 +634,12 @@ fn drawTransport(player: *Player, tape: *const Tape, win: dvui.Rect) f32 {
 
     var phys: [5]dvui.Rect.Physical = undefined;
     for (pieces, &phys) |r, *out| out.* = wrs.rectToPhysical(r);
-    tr.prev = phys[@intFromEnum(Piece.prev)];
-    tr.play = phys[@intFromEnum(Piece.play)];
-    tr.next = phys[@intFromEnum(Piece.next)];
-    tr.close = phys[@intFromEnum(Piece.close)];
+    tr.prev = phys[@backingInt(Piece.prev)];
+    tr.play = phys[@backingInt(Piece.play)];
+    tr.next = phys[@backingInt(Piece.next)];
+    tr.close = phys[@backingInt(Piece.close)];
     const hovered: ?Piece = if (tr.pointer) |pt| for (phys, 0..) |r, i| {
-        if (i != @intFromEnum(Piece.track) and r.contains(pt)) break @enumFromInt(i);
+        if (i != @backingInt(Piece.track) and r.contains(pt)) break @fromBackingInt(@intCast(i));
     } else null else null;
 
     barGlass(fw.data().id, &phys, s, hovered, apart);
@@ -650,11 +650,11 @@ fn drawTransport(player: *Player, tape: *const Tape, win: dvui.Rect) f32 {
     const ink = theme().color(.content, .text);
     const playing = player.state == .playing or (player.state == .seeking and player.after_seek == .play);
     const play_glyph: Glyph = if (playing) .pause else if (player.state == .ended) .replay else .play;
-    barIcon(bounds, pieces[@intFromEnum(Piece.prev)], .prev, ink.opacity(0.8));
-    barIcon(bounds, pieces[@intFromEnum(Piece.play)], play_glyph, ink);
-    barIcon(bounds, pieces[@intFromEnum(Piece.next)], .next, ink.opacity(0.8));
-    barIcon(bounds, pieces[@intFromEnum(Piece.close)], .close, ink.opacity(0.65));
-    tr.track = barTrack(player, tape, bounds, pieces[@intFromEnum(Piece.track)], ink);
+    barIcon(bounds, pieces[@backingInt(Piece.prev)], .prev, ink.opacity(0.8));
+    barIcon(bounds, pieces[@backingInt(Piece.play)], play_glyph, ink);
+    barIcon(bounds, pieces[@backingInt(Piece.next)], .next, ink.opacity(0.8));
+    barIcon(bounds, pieces[@backingInt(Piece.close)], .close, ink.opacity(0.65));
+    tr.track = barTrack(player, tape, bounds, pieces[@backingInt(Piece.track)], ink);
     return std.math.clamp(p * 1.6, 0, 1);
 }
 
@@ -671,9 +671,9 @@ fn barGeometry(center: dvui.Point, full_w: f32, p: f32, out: *[5]dvui.Rect) f32
     var widths = piece_d;
     var round_w: f32 = 0;
     for (piece_d, 0..) |d, i| {
-        if (i != @intFromEnum(Piece.track)) round_w += d;
+        if (i != @backingInt(Piece.track)) round_w += d;
     }
-    widths[@intFromEnum(Piece.track)] = @max(80, full_w - round_w - 4 * bar_gap);
+    widths[@backingInt(Piece.track)] = @max(80, full_w - round_w - 4 * bar_gap);
     const gap = bar_gap * apart;
     var total: f32 = 4 * gap;
     for (widths) |w| total += w;
@@ -694,7 +694,7 @@ fn barGlass(id: dvui.Id, pieces: []const dvui.Rect.Physical, s: f32, hovered: ?P
     var bubbles: [5]core.dialogs.Bubble = undefined;
     for (pieces, bubbles[0..pieces.len], 0..) |r, *b, i| b.* = .{
         .rect = r,
-        .light = if (hovered != null and @intFromEnum(hovered.?) == i) core.dialogs.bubble_hover else 0,
+        .light = if (hovered != null and @backingInt(hovered.?) == i) core.dialogs.bubble_hover else 0,
     };
     core.dialogs.glassBubbles(id, bubbles[0..pieces.len], s, .{ .merge = bar_merge, .shadow = apart });
 }
@@ -715,7 +715,7 @@ fn barIcon(bounds: dvui.Rect, r: dvui.Rect, glyph: Glyph, color: dvui.Color) voi
         .stroke_color = .{ .color = color },
         .fill_color = .{ .color = color },
     }, .{
-        .id_extra = @intFromEnum(glyph),
+        .id_extra = @backingInt(glyph),
         .rect = .{ .x = r.x + (r.w - d) / 2 - bounds.x, .y = r.y + (r.h - d) / 2 - bounds.y, .w = d, .h = d },
     });
 }
diff --git a/app/control/Server.zig b/app/control/Server.zig
index 8bcd151d2..2fe5ce823 100644
--- a/app/control/Server.zig
+++ b/app/control/Server.zig
@@ -32,7 +32,7 @@ pub const keep_alive_ms = 15_000;
 /// The longest socket path the OS takes, without its terminating zero. std's
 /// `UnixAddress.max_len` says 108 everywhere but Windows, where Darwin's `sockaddr_un` holds 104:
 /// a path between them passes `UnixAddress.init` and then overruns the copy in `listen`.
-pub const max_path = if (builtin.os.tag == .windows) 107 else @sizeOf(std.posix.sockaddr.un) - @offsetOf(std.posix.sockaddr.un, "path") - 1;
+pub const max_path = if (builtin.target.os.tag == .windows) 107 else @sizeOf(std.posix.sockaddr.un) - @offsetOf(std.posix.sockaddr.un, "path") - 1;
 
 /// Where an app whose config folder is `config_folder` listens: `control/control.sock` in it, a folder
 /// of its own only this user can open (`start` makes it). When that is longer than the OS takes
@@ -188,7 +188,7 @@ pub fn start(self: *Server) !void {
     // target may be a folder shared with others, which the mode would then be set on.
     if (std.fs.path.dirname(self.socket_path)) |dir| {
         try Io.Dir.cwd().createDirPath(self.io, dir);
-        if (comptime builtin.os.tag != .windows) {
+        if (comptime builtin.target.os.tag != .windows) {
             const st = try Io.Dir.cwd().statFile(self.io, dir, .{ .follow_symlinks = false });
             if (st.kind != .directory) return error.NotAFolder;
             try Io.Dir.cwd().setFilePermissions(self.io, dir, .fromMode(0o700), .{ .follow_symlinks = false });
@@ -203,7 +203,7 @@ pub fn start(self: *Server) !void {
         self.listener = null;
         Io.Dir.deleteFileAbsolute(self.io, self.socket_path) catch {};
     }
-    if (comptime builtin.os.tag != .windows) {
+    if (comptime builtin.target.os.tag != .windows) {
         // This user only. The umask usually says so already; a shared machine's may not.
         try Io.Dir.cwd().setFilePermissions(self.io, self.socket_path, .fromMode(0o600), .{});
         // Not on Windows, where the socket is a reparse point `statFile` cannot open: there this
@@ -545,7 +545,7 @@ const TestClient = struct {
         }
         const head = self.reply[0..self.reply_len];
         const key = "content-length: ";
-        if (std.ascii.indexOfIgnoreCase(head, key)) |i| {
+        if (std.ascii.findIgnoreCase(head, key)) |i| {
             const end = std.mem.indexOfPos(u8, head, i, "\r\n") orelse return;
             const len = std.fmt.parseInt(usize, head[i + key.len .. end], 10) catch return;
             const want = @min(len, self.reply.len - self.reply_len);
@@ -604,7 +604,7 @@ test "a request reaches the UI thread and its answer goes back" {
     try std.testing.expect(std.mem.endsWith(u8, reply, "\r\n\r\n{\"ok\":true}"));
 
     // Only this user may open it.
-    if (builtin.os.tag == .windows) return;
+    if (builtin.target.os.tag == .windows) return;
     const st = try Io.Dir.cwd().statFile(io, path, .{});
     try std.testing.expectEqual(@as(std.posix.mode_t, 0o600), st.permissions.toMode() & 0o777);
     // And its folder: nobody else reaches it, even before the socket's own mode is set.
@@ -688,7 +688,7 @@ test "a config folder too deep for a socket path listens in a runtime folder ins
     defer gpa.free(want);
     try std.testing.expectEqualStrings(want, short);
     // Between Darwin's 104 and std's 108, the length that crashed `listen`: not used as it is.
-    const deep = "/" ++ "d" ** (max_path - "/control/control.sock".len + 2);
+    const deep = "/" ++ @as([max_path - "/control/control.sock".len + 2]u8, @splat('d'));
     const fallback = try socketPath(gpa, deep, "/tmp/me");
     defer gpa.free(fallback);
     try std.testing.expect(fallback.len <= max_path);
@@ -704,7 +704,7 @@ test "a config folder too deep for a socket path listens in a runtime folder ins
 test "a socket path the OS cannot hold fails at start, not later" {
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     // Longer than the OS takes but within std's limit: refused here, not overrun in `listen`.
-    const long = "/" ++ "d" ** max_path;
+    const long = "/" ++ @as([max_path]u8, @splat('d'));
     var server: Server = .{ .gpa = std.testing.allocator, .io = std.testing.io, .socket_path = long, .wake = noWake };
     try std.testing.expectError(error.NameTooLong, server.start());
 }
@@ -854,7 +854,7 @@ test "a client that stops reading neither holds up the quit nor buffers without
     try answerStreams(&server, 1);
     // Until its task blocks writing and the backlog passes the cap; how much the socket takes first
     // is the OS's (Windows grows its buffers), so publish until then, up to far more than any.
-    const chunk = "\"" ++ "x" ** (64 * 1024) ++ "\"";
+    const chunk = "\"" ++ @as([64 * 1024]u8, @splat('x')) ++ "\"";
     var published: usize = 0;
     while (!overrun(&server) and published < 256 * 1024 * 1024) : (published += chunk.len) server.publish("e", chunk);
     try std.testing.expect(overrun(&server));
@@ -895,7 +895,7 @@ test "a stopped server ends a stream whose client stopped reading" {
     }
     try answerStreams(&server, 1);
     // Enough to block its write, not enough to overrun.
-    const chunk = "\"" ++ "x" ** (64 * 1024) ++ "\"";
+    const chunk = "\"" ++ @as([64 * 1024]u8, @splat('x')) ++ "\"";
     for (0..16) |_| server.publish("e", chunk);
     io.sleep(.fromMilliseconds(50), .awake) catch {};
     // Returns: the stream's socket is shut down under its blocked write.
diff --git a/app/control/json.zig b/app/control/json.zig
index c0a58d974..86cd8746d 100644
--- a/app/control/json.zig
+++ b/app/control/json.zig
@@ -71,13 +71,13 @@ fn writeZon(w: *std.Io.Writer, value: std.json.Value) std.Io.Writer.Error!void {
 pub fn jsonFromZon(arena: std.mem.Allocator, zon: ?[]const u8) Error![]u8 {
     const text = zon orelse return arena.dupe(u8, "null");
     if (std.mem.trim(u8, text, " \t\r\n").len == 0) return arena.dupe(u8, "null");
-    const source = try arena.dupeZ(u8, text);
-    const ast = try std.zig.Ast.parse(arena, source, .zon);
+    const source = try arena.dupeSentinel(u8, text, 0);
+    const ast = try std.zig.Ast.parse(arena, source, .{ .mode = .zon });
     if (ast.errors.len > 0) return error.NotZon;
     const zoir = try std.zig.ZonGen.generate(arena, ast, .{ .parse_str_lits = true });
     if (zoir.hasCompileErrors()) return error.NotZon;
     var out: std.Io.Writer.Allocating = .init(arena);
-    writeJson(&out.writer, zoir, .root) catch |err| return switch (err) {
+    writeJson(&out.writer, &zoir, .root) catch |err| return switch (err) {
         error.NotUtf8 => error.NotUtf8,
         error.WriteFailed => error.OutOfMemory,
     };
@@ -91,7 +91,7 @@ fn writeString(w: *std.Io.Writer, s: []const u8) (std.Io.Writer.Error || error{N
     try std.json.Stringify.encodeJsonString(s, .{}, w);
 }
 
-fn writeJson(w: *std.Io.Writer, zoir: std.zig.Zoir, index: std.zig.Zoir.Node.Index) (std.Io.Writer.Error || error{NotUtf8})!void {
+fn writeJson(w: *std.Io.Writer, zoir: *const std.zig.Zoir, index: std.zig.Zoir.Node.Index) (std.Io.Writer.Error || error{NotUtf8})!void {
     switch (index.get(zoir)) {
         .true => try w.writeAll("true"),
         .false => try w.writeAll("false"),
@@ -152,7 +152,8 @@ test "arguments: JSON object to a ZON struct literal" {
     // Negative zero as ZON reads it.
     const neg = try zonFromJson(a, "{\"x\":-0.0}", &.{});
     try std.testing.expectEqualStrings(".{.x=-0.0}", neg);
-    _ = try std.zon.parse.fromSliceAlloc(struct { x: f64 }, a, try a.dupeZ(u8, neg), null, .{});
+    var diag: std.zon.parse.Diagnostics = undefined;
+    _ = try std.zon.parse.fromSlice(struct { x: f64 }, .{ .gpa = a, .arena = a, .source = try a.dupeSentinel(u8, neg, 0), .diagnostics = &diag });
     try std.testing.expectError(error.NotAnObject, zonFromJson(a, "[1]", &.{}));
 }
 
diff --git a/app/crash/crash.zig b/app/crash/crash.zig
index a5f4848ee..4f55f4c69 100644
--- a/app/crash/crash.zig
+++ b/app/crash/crash.zig
@@ -284,7 +284,7 @@ pub fn writeTo(io: std.Io, config_folder: []const u8) void {
     const pid = if (builtin.target.os.tag == .windows) win.GetCurrentProcessId() else std.c.getpid();
     const launched = std.Io.Timestamp.now(io, .real).toMilliseconds();
     const sep = std.fs.path.sep;
-    const path = std.fmt.bufPrintZ(&path_buf, "{s}{c}crashes{c}{d}-{d}.txt", .{ config_folder, sep, sep, launched, pid }) catch return;
+    const path = std.fmt.bufPrintSentinel(&path_buf, "{s}{c}crashes{c}{d}-{d}.txt", .{ config_folder, sep, sep, launched, pid }, 0) catch return;
     const dir = std.fs.path.dirname(path).?;
     std.Io.Dir.cwd().createDirPath(io, dir) catch |err| {
         std.log.warn("crash reports: can't create {s}: {t}", .{ dir, err });
diff --git a/app/crash/image.zig b/app/crash/image.zig
index c4d85820d..b76524741 100644
--- a/app/crash/image.zig
+++ b/app/crash/image.zig
@@ -176,7 +176,7 @@ test "a GNU build-id note is found among others" {
             return std.mem.toBytes(v);
         }
     }.u;
-    const other = w(4) ++ w(8) ++ w(1) ++ "GNU\x00".* ++ [_]u8{0} ** 8;
+    const other = w(4) ++ w(8) ++ w(1) ++ "GNU\x00".* ++ @as([8]u8, @splat(0));
     const build_id = w(4) ++ w(5) ++ w(std.elf.NT_GNU_BUILD_ID) ++ "GNU\x00".* ++ "\xde\xad\xbe\xef\x01\x00\x00\x00".*;
     try std.testing.expectEqualSlices(u8, "\xde\xad\xbe\xef\x01", gnuBuildId(&(other ++ build_id)).?);
     try std.testing.expectEqual(null, gnuBuildId(&other));
diff --git a/app/keymap/Keymap.zig b/app/keymap/Keymap.zig
index 360d62d3c..1f83374f0 100644
--- a/app/keymap/Keymap.zig
+++ b/app/keymap/Keymap.zig
@@ -60,8 +60,8 @@ pub const When = packed struct {
     /// context-specific binding always wins over a global one on the same chord.
     pub fn weight(self: When) u8 {
         var n: u8 = 0;
-        inline for (@typeInfo(When).@"struct".fields) |f| {
-            if (@field(self, f.name)) n += 1;
+        inline for (@typeInfo(When).@"struct".field_names, @typeInfo(When).@"struct".field_types, @typeInfo(When).@"struct".field_attrs) |f_name, _, _| {
+            if (@field(self, f_name)) n += 1;
         }
         return n;
     }
@@ -79,9 +79,9 @@ pub const When = packed struct {
             const tok = std.mem.trim(u8, raw, " \t");
             if (tok.len == 0) continue;
             var matched = false;
-            inline for (@typeInfo(When).@"struct".fields) |f| {
-                if (eqlCamelOrSnake(tok, f.name)) {
-                    @field(out, f.name) = true;
+            inline for (@typeInfo(When).@"struct".field_names, @typeInfo(When).@"struct".field_types, @typeInfo(When).@"struct".field_attrs) |f_name, _, _| {
+                if (eqlCamelOrSnake(tok, f_name)) {
+                    @field(out, f_name) = true;
                     matched = true;
                 }
             }
@@ -205,8 +205,8 @@ fn best(self: Keymap, stroke: Stroke, ctx: When, active_owner: ?[]const u8) ?Bin
             winner = b;
             continue;
         };
-        const b_rank = (@as(u16, @intFromEnum(b.source)) << 8) | b.when.weight();
-        const w_rank = (@as(u16, @intFromEnum(w.source)) << 8) | w.when.weight();
+        const b_rank = (@as(u16, @backingInt(b.source)) << 8) | b.when.weight();
+        const w_rank = (@as(u16, @backingInt(w.source)) << 8) | w.when.weight();
         // Owner-scoped bindings beat otherwise equal-rank global ones — that's the whole
         // point of active-owner conflict resolution (pixi Export vs fizzy Quick Open).
         const b_owner_boost: u16 = if (b.owner_id != null) 1 else 0;
@@ -322,7 +322,7 @@ pub fn conflicts(self: Keymap, gpa: Allocator) ![]Conflict {
 
     for (self.bindings.items, 0..) |b, i| {
         const cmd = b.command orelse continue;
-        const rank: u16 = (@as(u16, @intFromEnum(b.source)) << 8) | b.when.weight();
+        const rank: u16 = (@as(u16, @backingInt(b.source)) << 8) | b.when.weight();
         for (claims.items) |*c| {
             if (!c.stroke.eql(b.stroke) or !c.when.eql(b.when)) continue;
             if (!std.mem.eql(u8, c.command, cmd) or !std.mem.eql(u8, c.args, b.args)) continue;
diff --git a/app/keymap/zon.zig b/app/keymap/zon.zig
index 5fa7bc3a4..203e9869f 100644
--- a/app/keymap/zon.zig
+++ b/app/keymap/zon.zig
@@ -111,7 +111,7 @@ pub const File = struct {
 const Parsed = struct { ast: std.zig.Ast, zoir: std.zig.Zoir };
 
 fn parseZon(gpa: Allocator, source: [:0]const u8) ?Parsed {
-    var ast = std.zig.Ast.parse(gpa, source, .zon) catch return null;
+    var ast = std.zig.Ast.parse(gpa, source, .{ .mode = .zon }) catch return null;
     errdefer ast.deinit(gpa);
     var zoir = std.zig.ZonGen.generate(gpa, ast, .{ .parse_str_lits = true }) catch {
         ast.deinit(gpa);
@@ -130,12 +130,12 @@ fn findField(
     container: std.zig.Zoir.Node.Index,
     name: []const u8,
 ) ?std.zig.Zoir.Node.Index {
-    const s = switch (container.get(zoir)) {
+    const s = switch (container.get(&zoir)) {
         .struct_literal => |sl| sl,
         else => return null,
     };
     for (s.names, 0..) |field_name, i| {
-        if (std.mem.eql(u8, field_name.get(zoir), name)) return s.vals.at(@intCast(i));
+        if (std.mem.eql(u8, field_name.get(&zoir), name)) return s.vals.at(@intCast(i));
     }
     return null;
 }
@@ -146,7 +146,7 @@ fn stringField(
     name: []const u8,
 ) ?[]const u8 {
     const node = findField(zoir, container, name) orelse return null;
-    return switch (node.get(zoir)) {
+    return switch (node.get(&zoir)) {
         .string_literal => |s| s,
         else => null,
     };
@@ -154,7 +154,7 @@ fn stringField(
 
 /// 1-based line/column of a node's first token.
 fn locationOf(ast: std.zig.Ast, zoir: std.zig.Zoir, node: std.zig.Zoir.Node.Index) struct { line: u32, column: u32 } {
-    const tok = ast.firstToken(node.getAstNode(zoir));
+    const tok = ast.firstToken(node.getAstNode(&zoir));
     const start = ast.tokenStart(tok);
     var line: u32 = 1;
     var col: u32 = 1;
@@ -188,7 +188,7 @@ fn collectBlock(
     owner_id: ?[]const u8,
     platform: Platform,
 ) Allocator.Error!void {
-    const range = switch (block.get(zoir)) {
+    const range = switch (block.get(&zoir)) {
         .array_literal => |r| r,
         .empty_literal => return,
         else => {
@@ -203,7 +203,7 @@ fn collectBlock(
         const entry = range.at(i);
         const loc = locationOf(ast, zoir, entry);
 
-        switch (entry.get(zoir)) {
+        switch (entry.get(&zoir)) {
             .struct_literal => {},
             else => {
                 c.diag(loc.line, loc.column, "binding must be a struct, e.g. .{{ .keys = \"ctrl+s\", .command = \"fizzy.save\" }}", .{});
@@ -226,7 +226,7 @@ fn collectBlock(
             c.diag(loc.line, loc.column, "binding is missing `.command` (use `.command = null` to unbind)", .{});
             continue;
         };
-        const command: ?[]const u8 = switch (command_node.get(zoir)) {
+        const command: ?[]const u8 = switch (command_node.get(&zoir)) {
             .string_literal => |s| s,
             .null => null,
             else => {
@@ -244,8 +244,8 @@ fn collectBlock(
         // `.args`, when given, is a struct literal of the command's arguments, kept as written.
         var args_text: ?[]const u8 = null;
         if (findField(zoir, entry, "args")) |args_node| {
-            switch (args_node.get(zoir)) {
-                .struct_literal => args_text = ast.getNodeSource(args_node.getAstNode(zoir)),
+            switch (args_node.get(&zoir)) {
+                .struct_literal => args_text = ast.getNodeSource(args_node.getAstNode(&zoir)),
                 .empty_literal => {},
                 else => {
                     c.diag(loc.line, loc.column, "`.args` must be a struct of the command's arguments, e.g. .{{ .line = 1 }}", .{});
@@ -262,7 +262,7 @@ fn collectBlock(
         var when_text: ?[]u8 = null;
         errdefer if (when_text) |w| c.gpa.free(w);
         if (findField(zoir, entry, "when")) |when_node| {
-            switch (when_node.get(zoir)) {
+            switch (when_node.get(&zoir)) {
                 .string_literal => |s| {
                     var unknown: std.ArrayList([]const u8) = .empty;
                     defer unknown.deinit(c.gpa);
@@ -332,10 +332,10 @@ pub fn parse(gpa: Allocator, source: [:0]const u8, platform: Platform) Allocator
     }
 
     if (findField(parsed.zoir, .root, "plugins")) |plugins_node| {
-        switch (plugins_node.get(parsed.zoir)) {
+        switch (plugins_node.get(&parsed.zoir)) {
             .struct_literal => |sl| {
                 for (sl.names, 0..) |id_str, i| {
-                    const id = id_str.get(parsed.zoir);
+                    const id = id_str.get(&parsed.zoir);
                     try collectBlock(&c, parsed.ast, parsed.zoir, sl.vals.at(@intCast(i)), id, platform);
                 }
             },
@@ -577,7 +577,7 @@ test "format round-trips through parse" {
 
     const written = try format(a, first.bindings);
     defer a.free(written);
-    const written_z = try a.dupeZ(u8, written);
+    const written_z = try a.dupeSentinel(u8, written, 0);
     defer a.free(written_z);
 
     var second = try parse(a, written_z, .other);
@@ -631,7 +631,7 @@ test "backslash keys survive a write/read cycle" {
 
     const written = try format(a, f.bindings);
     defer a.free(written);
-    const written_z = try a.dupeZ(u8, written);
+    const written_z = try a.dupeSentinel(u8, written, 0);
     defer a.free(written_z);
     var again = try parse(a, written_z, .other);
     defer again.deinit(a);
diff --git a/app/layout/Chooser.zig b/app/layout/Chooser.zig
index 26f4b9fca..fe8927480 100644
--- a/app/layout/Chooser.zig
+++ b/app/layout/Chooser.zig
@@ -303,7 +303,8 @@ fn carryLifted(self: *Chooser) void {
     } else {
         f.beginViewDrag(lift.id, lift.rect);
         // From the motion that lifted it on: a release in the same frame is the drag's too.
-        if (dvui.currentWindow().capture) |cm| dvui.captureMouseCustom(cm, lift.event);
+        if (dvui.captureMouseGet()) |cm|
+            dvui.captureMouseCustom(cm, lift.event);
     }
     self.carried = lift.id;
     dvui.refresh(null, @src(), null);
diff --git a/app/layout/Floats.zig b/app/layout/Floats.zig
index 0b48b5e52..19ea90fa4 100644
--- a/app/layout/Floats.zig
+++ b/app/layout/Floats.zig
@@ -472,10 +472,10 @@ fn syncStack(l: *Layout) void {
     const floats = &l.state.floats;
     const n = @min(floats.items.items.len, max);
     var ids: [max]u64 = undefined;
-    for (floats.items.items[0..n], 0..) |f, i| ids[i] = @intFromEnum(f.win_id);
+    for (floats.items.items[0..n], 0..) |f, i| ids[i] = @backingInt(f.win_id);
     const stack = dvui.currentWindow().subwindows.stack.items;
     const stack_ids = l.arena.alloc(u64, stack.len) catch return;
-    for (stack, 0..) |sw, i| stack_ids[i] = @intFromEnum(sw.id);
+    for (stack, 0..) |sw, i| stack_ids[i] = @backingInt(sw.id);
     var order: [max]usize = undefined;
     rules.stackOrder(order[0..n], ids[0..n], stack_ids);
     floats.reorder(order[0..n]);
diff --git a/app/layout/Layout.zig b/app/layout/Layout.zig
index a202af997..63319f616 100644
--- a/app/layout/Layout.zig
+++ b/app/layout/Layout.zig
@@ -517,7 +517,7 @@ fn claimedElsewhere(
         if (sdk.keywords.groupKey(r.keywords) == want) continue;
         if (self.state.assignment(r.name) != null) continue;
         const theirs = sdk.keywords.strength(r.keywords, s.keywords);
-        if (@intFromEnum(theirs) > @intFromEnum(mine)) return true;
+        if (@backingInt(theirs) > @backingInt(mine)) return true;
         if (theirs == mine and mine_at != null and i < mine_at.?) return true;
     }
     return false;
@@ -890,7 +890,7 @@ fn resetPack(b: *dvui.BoxWidget) void {
     b.packed_children = 0;
     b.total_weight = 0;
     b.min_space_taken = 0;
-    if (builtin.mode == .Debug) b.child_id = .zero;
+    if (builtin.mode == .debug) b.child_id = .zero;
 }
 
 // ── The base layer: regions and keywords ────────────────────────────────────────────────────
@@ -1030,7 +1030,7 @@ pub fn beginPluginRegion(self: *Layout, spec: sdk.RegionSpec) ?sdk.RegionSpec.To
 
     self.plugin_regions[self.plugin_depth] = r;
     self.plugin_depth += 1;
-    return @enumFromInt(self.plugin_depth);
+    return @fromBackingInt(@intCast(self.plugin_depth));
 }
 
 pub fn drawPluginRegionContents(self: *Layout, token: sdk.RegionSpec.Token) !dvui.App.Result {
@@ -1109,7 +1109,7 @@ pub fn endPluginRegion(self: *Layout, token: sdk.RegionSpec.Token) void {
     // Strictly nested, like the boxes they are. Closing out of order would deinit the wrong box
     // and dvui would report it as a stack mismatch two widgets later, naming neither the plugin
     // nor the region — so say it here while the token still means something.
-    const depth = @intFromEnum(token);
+    const depth = @backingInt(token);
     if (depth != self.plugin_depth) {
         dvui.log.err("plugin region closed out of order ({d} of {d} open)", .{ depth, self.plugin_depth });
         return;
@@ -1119,7 +1119,7 @@ pub fn endPluginRegion(self: *Layout, token: sdk.RegionSpec.Token) void {
 }
 
 fn pluginRegion(self: *Layout, token: sdk.RegionSpec.Token) ?*Region {
-    const depth = @intFromEnum(token);
+    const depth = @backingInt(token);
     if (depth == 0 or depth > self.plugin_depth) return null;
     return &self.plugin_regions[depth - 1];
 }
diff --git a/app/layout/Picker.zig b/app/layout/Picker.zig
index 52c562d15..c159d52c0 100644
--- a/app/layout/Picker.zig
+++ b/app/layout/Picker.zig
@@ -417,7 +417,7 @@ fn sectionOf(places: []const Place, id: []const u8, keywords: []const []const u8
     var best_fit: sdk.keywords.Fit = .none;
     for (places, 0..) |p, i| {
         const fit = sdk.keywords.strength(p.keywords, keywords);
-        if (@intFromEnum(fit) > @intFromEnum(best_fit)) {
+        if (@backingInt(fit) > @backingInt(best_fit)) {
             best = i;
             best_fit = fit;
         }
diff --git a/app/layout/Region.zig b/app/layout/Region.zig
index 360ca4e1a..673762ef0 100644
--- a/app/layout/Region.zig
+++ b/app/layout/Region.zig
@@ -1104,7 +1104,7 @@ fn nameExtra(name: []const u8) usize {
 }
 
 fn extraFor(name: []const u8, side: SplitTree.Side) usize {
-    return @truncate(nameExtra(name) ^ @as(u64, @intFromEnum(side)) << 8);
+    return @truncate(nameExtra(name) ^ @as(u64, @backingInt(side)) << 8);
 }
 
 fn idOf(state: *Layout.State, name: []const u8) ?dvui.Id {
diff --git a/app/root.zig b/app/root.zig
index 8e7e7dfdf..5b9767466 100644
--- a/app/root.zig
+++ b/app/root.zig
@@ -117,7 +117,7 @@ pub const control = struct {
     /// (`Server.socketPath`), with this user's runtime folder for a config folder too deep.
     pub fn socketPath(gpa: @import("std").mem.Allocator, config_folder: []const u8) ![]u8 {
         const std = @import("std");
-        const runtime: ?[]const u8 = if (@import("builtin").os.tag == .windows) null else for ([_][*:0]const u8{ "TMPDIR", "XDG_RUNTIME_DIR" }) |name| {
+        const runtime: ?[]const u8 = if (@import("builtin").target.os.tag == .windows) null else for ([_][*:0]const u8{ "TMPDIR", "XDG_RUNTIME_DIR" }) |name| {
             if (std.c.getenv(name)) |v| if (std.mem.len(v) > 0) break std.mem.span(v);
         } else null;
         return Server.socketPath(gpa, config_folder, runtime);
diff --git a/app/settings/Settings.zig b/app/settings/Settings.zig
index a32d07b5a..3019d1f5b 100644
--- a/app/settings/Settings.zig
+++ b/app/settings/Settings.zig
@@ -186,42 +186,37 @@ pub fn load(allocator: std.mem.Allocator, path: []const u8, plugins_dir: ?[]cons
     const data = core.fs.readZ(allocator, dvui.io, path) catch return default(allocator);
     defer allocator.free(data);
 
-    const parsed = parseOnly(allocator, data) catch |err| {
+    var arena: std.heap.ArenaAllocator = .init(allocator);
+    defer arena.deinit();
+    const parsed = parseOnly(allocator, arena.allocator(), data) catch |err| {
         dvui.log.warn("Could not parse settings.zon ({s}); using defaults.", .{@errorName(err)});
         return default(allocator);
     };
 
-    defer freeParsed(allocator, parsed);
-
     var result = parsed;
     // Own `theme` for the process lifetime (freed in `deinit`); every other field is scalar.
     result.theme = try allocator.dupe(u8, parsed.theme);
     return result;
 }
 
-/// Frees a `parseOnly`/`load` result. Not `std.zon.parse.free` directly: since R12 the file only
-/// records non-default fields, so a missing `theme` is filled by `std.zon.parse` with *this
-/// struct's declared default* — a comptime string literal, not an allocation — and handing that
-/// pointer to the allocator would be an invalid free. Zeroing it first makes the whole-struct
-/// free a no-op for that field (`Allocator.free` returns early on an empty slice) while still
-/// covering any other allocated field.
-pub fn freeParsed(allocator: std.mem.Allocator, parsed: Settings) void {
-    var value = parsed;
-    if (value.theme.ptr == default_theme.ptr) value.theme = "";
-    std.zon.parse.free(allocator, value);
-}
-
 /// Parses `data` (already-read `settings.zon` bytes) into a `Settings` value, ignoring unknown
 /// fields (forward-compat + `.plugins` is handled separately — see `load`'s doc comment above).
 /// Unlike `load`, this returns the raw parse error on failure instead of falling back to
 /// defaults — defaulting is only correct when there's no existing live state to fall back *to*
 /// (startup); `Editor.reconcileExternalSettingsChange` (external hand-edit reconciliation, R11)
 /// has existing state and must not let a transient torn-write read reset every fizzy field and
-/// every plugin's settings. Caller frees the result with `freeParsed` (not `Settings.deinit`,
-/// which owns the live value's long-lived `theme`).
-pub fn parseOnly(allocator: std.mem.Allocator, data: [:0]const u8) !Settings {
+/// every plugin's settings. The result's strings live in `arena` (`allocator` is the parse's
+/// scratch); `load` copies out the one it keeps.
+pub fn parseOnly(allocator: std.mem.Allocator, arena: std.mem.Allocator, data: [:0]const u8) !Settings {
     @setEvalBranchQuota(10_000);
-    var parsed = try std.zon.parse.fromSliceAlloc(Settings, allocator, data, null, .{ .ignore_unknown_fields = true });
+    var diag: std.zon.parse.Diagnostics = undefined;
+    var parsed = try std.zon.parse.fromSlice(Settings, .{
+        .gpa = allocator,
+        .arena = arena,
+        .source = data,
+        .diagnostics = &diag,
+        .ignore_unknown_fields = true,
+    });
     SettingsMigration.windowGlass(allocator, data, &parsed);
     return parsed;
 }
@@ -243,7 +238,7 @@ fn fieldEqual(comptime FT: type, a: FT, b: FT) bool {
 /// halves of `settings.zon` record just what the user actually changed. An untouched fizzy
 /// serializes to `.{}`; a field hand-written back at its default drops out on the next write.
 /// Reading back is unaffected: `load`/`parseOnly` fill every missing field from these same
-/// defaults (see `freeParsed` for the one ownership wrinkle that creates).
+/// defaults (they are the declared defaults themselves: `load` copies `theme` before keeping it).
 ///
 /// This is *not* the whole `settings.zon` file — plugin settings are a separate
 /// `.plugins = .{ .<id> = .{...}, ... }` field spliced on afterward by
@@ -257,12 +252,12 @@ pub fn serialize(settings: *const Settings, allocator: std.mem.Allocator) ![]u8
     defer aw.deinit();
 
     var any = false;
-    inline for (std.meta.fields(Settings)) |f| {
-        if (!fieldEqual(f.type, @field(settings, f.name), @field(default_value, f.name))) {
+    inline for (@typeInfo(Settings).@"struct".field_names, @typeInfo(Settings).@"struct".field_types, @typeInfo(Settings).@"struct".field_attrs) |f_name, f_type, _| {
+        if (!fieldEqual(f_type, @field(settings, f_name), @field(default_value, f_name))) {
             if (!any) try aw.writer.writeAll(".{\n");
             any = true;
-            try aw.writer.print("    .{f} = ", .{std.zig.fmtId(f.name)});
-            try std.zon.stringify.serialize(@field(settings, f.name), .{}, &aw.writer);
+            try aw.writer.print("    .{f} = ", .{std.zig.fmtId(f_name)});
+            try std.zon.stringify.serialize(@field(settings, f_name), .{}, &aw.writer);
             try aw.writer.writeAll(",\n");
         }
     }
diff --git a/app/settings/SettingsMigration.zig b/app/settings/SettingsMigration.zig
index 475941ec3..ae99eaa8f 100644
--- a/app/settings/SettingsMigration.zig
+++ b/app/settings/SettingsMigration.zig
@@ -75,13 +75,13 @@ pub fn migrateToPerPluginEnabled(allocator: std.mem.Allocator, settings_zon_path
     defer allocator.free(data);
 
     @setEvalBranchQuota(10_000);
-    const legacy = std.zon.parse.fromSliceAlloc(LegacyDisk, allocator, data, null, .{
-        .ignore_unknown_fields = true,
-    }) catch |err| {
+    var legacy_arena: std.heap.ArenaAllocator = .init(allocator);
+    defer legacy_arena.deinit();
+    var legacy_diag: std.zon.parse.Diagnostics = undefined;
+    const legacy = std.zon.parse.fromSlice(LegacyDisk, .{ .gpa = allocator, .arena = legacy_arena.allocator(), .source = data, .diagnostics = &legacy_diag, .ignore_unknown_fields = true }) catch |err| {
         dvui.log.warn("settings: could not parse settings.zon for R12 enabled migration ({s}); skipping", .{@errorName(err)});
         return;
     };
-    defer std.zon.parse.free(allocator, legacy);
 
     const blocks = SettingsPluginsZon.listPluginBlocks(allocator, data) catch return;
     defer SettingsPluginsZon.freeEntries(allocator, blocks);
@@ -157,11 +157,12 @@ pub fn migrateToPerPluginEnabled(allocator: std.mem.Allocator, settings_zon_path
 
     // Regenerate fizzy's own fields from a Settings parse (unknown fields — including the legacy
     // `disabled_plugins` list — are ignored), so the rewritten file drops that list for free.
-    const parsed = Settings.parseOnly(allocator, data) catch |err| {
+    var parsed_arena: std.heap.ArenaAllocator = .init(allocator);
+    defer parsed_arena.deinit();
+    const parsed = Settings.parseOnly(allocator, parsed_arena.allocator(), data) catch |err| {
         dvui.log.warn("settings: could not re-serialize fizzy's own fields for R12 migration ({s}); skipping", .{@errorName(err)});
         return;
     };
-    defer Settings.freeParsed(allocator, parsed);
 
     const fizzy_text = Settings.serialize(&parsed, allocator) catch |err| {
         dvui.log.warn("settings: could not serialize fizzy's own fields for R12 migration ({s}); skipping", .{@errorName(err)});
@@ -195,15 +196,15 @@ pub fn migrateToPerPluginEnabled(allocator: std.mem.Allocator, settings_zon_path
 /// `enabled` was listed, so an `.auto_update = false`-only block — which the app itself can
 /// write for a disabled plugin — was being swallowed too.)
 fn isAlreadyNested(gpa: std.mem.Allocator, text: []const u8) bool {
-    const z = gpa.dupeZ(u8, text) catch return false;
+    const z = gpa.dupeSentinel(u8, text, 0) catch return false;
     defer gpa.free(z);
 
     if (SettingsPluginsZon.extractField(gpa, z, "settings")) |s| {
         gpa.free(s);
         return true;
     }
-    inline for (@typeInfo(SettingsPluginsZon.Reserved).@"struct".fields) |field| {
-        if (SettingsPluginsZon.extractField(gpa, z, field.name)) |s| {
+    inline for (@typeInfo(SettingsPluginsZon.Reserved).@"struct".field_names, @typeInfo(SettingsPluginsZon.Reserved).@"struct".field_types, @typeInfo(SettingsPluginsZon.Reserved).@"struct".field_attrs) |field_name, _, _| {
+        if (SettingsPluginsZon.extractField(gpa, z, field_name)) |s| {
             gpa.free(s);
             return true;
         }
@@ -254,8 +255,10 @@ const LegacyGlass = struct {
 /// dialogs' blur goes with them, as the roughness that followed it does.
 pub fn windowGlass(allocator: std.mem.Allocator, data: [:0]const u8, settings: *Settings) void {
     @setEvalBranchQuota(10_000);
-    const legacy = std.zon.parse.fromSliceAlloc(LegacyGlass, allocator, data, null, .{ .ignore_unknown_fields = true }) catch return;
-    defer std.zon.parse.free(allocator, legacy);
+    var legacy_arena: std.heap.ArenaAllocator = .init(allocator);
+    defer legacy_arena.deinit();
+    var legacy_diag: std.zon.parse.Diagnostics = undefined;
+    const legacy = std.zon.parse.fromSlice(LegacyGlass, .{ .gpa = allocator, .arena = legacy_arena.allocator(), .source = data, .diagnostics = &legacy_diag, .ignore_unknown_fields = true }) catch return;
     if (legacy.dialog_opacity == null and legacy.dialog_blur == null and legacy.dialog_lift == null and
         legacy.dialog_detail == null and legacy.dialog_refraction == null) return;
     const opaque_window = comptime builtin.target.cpu.arch == .wasm32 or (builtin.target.os.tag != .macos and builtin.target.os.tag != .windows);
diff --git a/app/settings/SettingsPluginsZon.zig b/app/settings/SettingsPluginsZon.zig
index bb787c75c..e112e2bf5 100644
--- a/app/settings/SettingsPluginsZon.zig
+++ b/app/settings/SettingsPluginsZon.zig
@@ -43,13 +43,13 @@ pub fn freeEntries(gpa: Allocator, entries: []const Entry) void {
 /// restriction on `name`). Returns the field's value node, or null if `container` isn't a struct
 /// literal or has no such field.
 fn findField(zoir: std.zig.Zoir, container: std.zig.Zoir.Node.Index, name: []const u8) ?std.zig.Zoir.Node.Index {
-    const node = container.get(zoir);
+    const node = container.get(&zoir);
     const s = switch (node) {
         .struct_literal => |sl| sl,
         else => return null,
     };
     for (s.names, 0..) |field_name, i| {
-        if (std.mem.eql(u8, field_name.get(zoir), name)) return s.vals.at(@intCast(i));
+        if (std.mem.eql(u8, field_name.get(&zoir), name)) return s.vals.at(@intCast(i));
     }
     return null;
 }
@@ -57,7 +57,7 @@ fn findField(zoir: std.zig.Zoir, container: std.zig.Zoir.Node.Index, name: []con
 /// Owned copy of `node`'s exact source text (first token's start through last token's end),
 /// preserving whitespace/comments inside the span verbatim.
 fn nodeSourceText(gpa: Allocator, ast: std.zig.Ast, zoir: std.zig.Zoir, node: std.zig.Zoir.Node.Index) Allocator.Error![]u8 {
-    const ast_node = node.getAstNode(zoir);
+    const ast_node = node.getAstNode(&zoir);
     const first_tok = ast.firstToken(ast_node);
     const last_tok = ast.lastToken(ast_node);
     const start = ast.tokenStart(first_tok);
@@ -70,7 +70,7 @@ fn nodeSourceText(gpa: Allocator, ast: std.zig.Ast, zoir: std.zig.Zoir, node: st
 const Parsed = struct { ast: std.zig.Ast, zoir: std.zig.Zoir };
 
 fn parseZon(gpa: Allocator, source: [:0]const u8) ?Parsed {
-    var ast = std.zig.Ast.parse(gpa, source, .zon) catch return null;
+    var ast = std.zig.Ast.parse(gpa, source, .{ .mode = .zon }) catch return null;
     errdefer ast.deinit(gpa);
     var zoir = std.zig.ZonGen.generate(gpa, ast, .{ .parse_str_lits = false }) catch {
         ast.deinit(gpa);
@@ -102,7 +102,7 @@ pub fn extractField(gpa: Allocator, source: [:0]const u8, field_name: []const u8
 pub fn extractPluginBlob(gpa: Allocator, source: [:0]const u8, id: []const u8) ?[]u8 {
     const plugins = extractField(gpa, source, "plugins") orelse return null;
     defer gpa.free(plugins);
-    const plugins_z = gpa.dupeZ(u8, plugins) catch return null;
+    const plugins_z = gpa.dupeSentinel(u8, plugins, 0) catch return null;
     defer gpa.free(plugins_z);
     return extractField(gpa, plugins_z, id);
 }
@@ -122,7 +122,7 @@ pub fn listPluginBlocks(gpa: Allocator, source: ?[:0]const u8) Allocator.Error![
     }
 
     const plugins_node = findField(parsed.zoir, .root, "plugins") orelse return &.{};
-    const node = plugins_node.get(parsed.zoir);
+    const node = plugins_node.get(&parsed.zoir);
     const s = switch (node) {
         .struct_literal => |sl| sl,
         else => return &.{},
@@ -137,7 +137,7 @@ pub fn listPluginBlocks(gpa: Allocator, source: ?[:0]const u8) Allocator.Error![
         out.deinit(gpa);
     }
     for (s.names, 0..) |field_name, i| {
-        const id = try gpa.dupe(u8, field_name.get(parsed.zoir));
+        const id = try gpa.dupe(u8, field_name.get(&parsed.zoir));
         errdefer gpa.free(id);
         const text = try nodeSourceText(gpa, parsed.ast, parsed.zoir, s.vals.at(@intCast(i)));
         try out.append(gpa, .{ .id = id, .text = text });
@@ -295,7 +295,7 @@ pub fn upsertOne(gpa: Allocator, existing_full_source: ?[:0]const u8, entry: Ent
         return gpa.dupe(u8, src);
     }
 
-    const ast_node = plugins_node.getAstNode(parsed.zoir);
+    const ast_node = plugins_node.getAstNode(&parsed.zoir);
     const last_tok = parsed.ast.lastToken(ast_node);
     const insert_at = parsed.ast.tokenStart(last_tok);
 
@@ -435,11 +435,11 @@ test "extractPluginBlob returns null when the id is missing from an existing .pl
 test "nested extractField reaches .plugins.<id>.settings" {
     const plugins = extractField(testing.allocator, sample_source, "plugins").?;
     defer testing.allocator.free(plugins);
-    const plugins_z = try testing.allocator.dupeZ(u8, plugins);
+    const plugins_z = try testing.allocator.dupeSentinel(u8, plugins, 0);
     defer testing.allocator.free(plugins_z);
     const id_block = extractField(testing.allocator, plugins_z, "text").?;
     defer testing.allocator.free(id_block);
-    const id_z = try testing.allocator.dupeZ(u8, id_block);
+    const id_z = try testing.allocator.dupeSentinel(u8, id_block, 0);
     defer testing.allocator.free(id_z);
     const settings = extractField(testing.allocator, id_z, "settings").?;
     defer testing.allocator.free(settings);
@@ -453,7 +453,7 @@ test "composeMergedText round-trips: overlay replaces one id, others survive unt
     const composed = try composeMergedText(testing.allocator, fizzy_text, sample_source, &overlay);
     defer testing.allocator.free(composed);
 
-    const composed_z = try testing.allocator.dupeZ(u8, composed);
+    const composed_z = try testing.allocator.dupeSentinel(u8, composed, 0);
     defer testing.allocator.free(composed_z);
 
     const pixi = extractPluginBlob(testing.allocator, composed_z, "pixi").?;
@@ -472,7 +472,7 @@ test "composeMergedText removes an id when overlay text is null" {
     const composed = try composeMergedText(testing.allocator, fizzy_text, sample_source, &overlay);
     defer testing.allocator.free(composed);
 
-    const composed_z = try testing.allocator.dupeZ(u8, composed);
+    const composed_z = try testing.allocator.dupeSentinel(u8, composed, 0);
     defer testing.allocator.free(composed_z);
 
     try testing.expect(extractPluginBlob(testing.allocator, composed_z, "pixi") == null);
@@ -489,7 +489,7 @@ test "composeMergedText adds a brand-new id when there is no existing .plugins b
     const composed = try composeMergedText(testing.allocator, fizzy_text, null, &overlay);
     defer testing.allocator.free(composed);
 
-    const composed_z = try testing.allocator.dupeZ(u8, composed);
+    const composed_z = try testing.allocator.dupeSentinel(u8, composed, 0);
     defer testing.allocator.free(composed_z);
 
     const pixi = extractPluginBlob(testing.allocator, composed_z, "pixi").?;
@@ -512,7 +512,7 @@ test "composeMergedText accepts an empty fizzy struct (every fizzy field at its
     const composed = try composeMergedText(testing.allocator, ".{}", null, &overlay);
     defer testing.allocator.free(composed);
 
-    const composed_z = try testing.allocator.dupeZ(u8, composed);
+    const composed_z = try testing.allocator.dupeSentinel(u8, composed, 0);
     defer testing.allocator.free(composed_z);
 
     const pixi = extractPluginBlob(testing.allocator, composed_z, "pixi").?;
@@ -523,7 +523,7 @@ test "composeMergedText accepts an empty fizzy struct (every fizzy field at its
 test "upsertOne inserts a new id into an existing .plugins block, leaving the rest untouched" {
     const composed = try upsertOne(testing.allocator, sample_source, .{ .id = "markdown", .text = ".{ .enabled = true }" });
     defer testing.allocator.free(composed);
-    const composed_z = try testing.allocator.dupeZ(u8, composed);
+    const composed_z = try testing.allocator.dupeSentinel(u8, composed, 0);
     defer testing.allocator.free(composed_z);
 
     const markdown = extractPluginBlob(testing.allocator, composed_z, "markdown").?;
@@ -546,7 +546,7 @@ test "upsertOne adds a .plugins block when none exists yet" {
     const source: [:0]const u8 = ".{ .theme = 0.35 }";
     const composed = try upsertOne(testing.allocator, source, .{ .id = "pixi", .text = ".{ .enabled = true }" });
     defer testing.allocator.free(composed);
-    const composed_z = try testing.allocator.dupeZ(u8, composed);
+    const composed_z = try testing.allocator.dupeSentinel(u8, composed, 0);
     defer testing.allocator.free(composed_z);
 
     const pixi = extractPluginBlob(testing.allocator, composed_z, "pixi").?;
@@ -557,7 +557,7 @@ test "upsertOne adds a .plugins block when none exists yet" {
 test "upsertOne handles a missing settings.zon (null source)" {
     const composed = try upsertOne(testing.allocator, null, .{ .id = "pixi", .text = ".{ .enabled = true }" });
     defer testing.allocator.free(composed);
-    const composed_z = try testing.allocator.dupeZ(u8, composed);
+    const composed_z = try testing.allocator.dupeSentinel(u8, composed, 0);
     defer testing.allocator.free(composed_z);
 
     const pixi = extractPluginBlob(testing.allocator, composed_z, "pixi").?;
@@ -601,7 +601,7 @@ test "composed extensions survive extractField + parseExtensions" {
     );
     defer testing.allocator.free(block);
 
-    const block_z = try testing.allocator.dupeZ(u8, block);
+    const block_z = try testing.allocator.dupeSentinel(u8, block, 0);
     defer testing.allocator.free(block_z);
 
     const exts_text = extractField(testing.allocator, block_z, "extensions").?;
@@ -642,24 +642,24 @@ test "every Reserved field is discoverable by extractField" {
     // reserved field that composes to something `extractField` cannot find back is silently
     // destructive: it would be reinterpreted as a plugin-author setting. This asserts the two
     // sides stay in step for every field, including ones added later.
-    inline for (@typeInfo(Reserved).@"struct".fields) |field| {
+    inline for (@typeInfo(Reserved).@"struct".field_names, @typeInfo(Reserved).@"struct".field_types, @typeInfo(Reserved).@"struct".field_attrs) |field_name, field_type, _| {
         // Compose a block in which this field is guaranteed non-default, so it is actually
         // emitted (fields are written only when they differ from their default).
         var reserved: Reserved = .{};
-        switch (field.type) {
-            bool => @field(reserved, field.name) = !@field(reserved, field.name),
+        switch (field_type) {
+            bool => @field(reserved, field_name) = !@field(reserved, field_name),
             // Tri-state: absent is the default, so either concrete value is "non-default" and
             // must be emitted. `false` is the interesting one — it used to be omitted.
-            ?bool => @field(reserved, field.name) = false,
-            []const []const u8 => @field(reserved, field.name) = &.{".probe"},
-            else => @compileError("extend this test for Reserved field type " ++ @typeName(field.type)),
+            ?bool => @field(reserved, field_name) = false,
+            []const []const u8 => @field(reserved, field_name) = &.{".probe"},
+            else => @compileError("extend this test for Reserved field type " ++ @typeName(field_type)),
         }
         const block = try composePluginIdBlock(testing.allocator, reserved, null);
         defer testing.allocator.free(block);
-        const block_z = try testing.allocator.dupeZ(u8, block);
+        const block_z = try testing.allocator.dupeSentinel(u8, block, 0);
         defer testing.allocator.free(block_z);
 
-        const found = extractField(testing.allocator, block_z, field.name);
+        const found = extractField(testing.allocator, block_z, field_name);
         try testing.expect(found != null);
         testing.allocator.free(found.?);
     }
diff --git a/app/state_delta.zig b/app/state_delta.zig
index 5caa4deb5..592af11b9 100644
--- a/app/state_delta.zig
+++ b/app/state_delta.zig
@@ -43,11 +43,11 @@ pub fn encode(gpa: std.mem.Allocator, ref: []const u8, new: []const u8) std.mem.
     const w = &out.writer;
     write(w, new.len, prefix, suffix) catch return error.OutOfMemory;
     if (a.len != b.len) {
-        w.writeByte(@intFromEnum(Mode.raw)) catch return error.OutOfMemory;
+        w.writeByte(@backingInt(Mode.raw)) catch return error.OutOfMemory;
         w.writeAll(b) catch return error.OutOfMemory;
         return out.toOwnedSlice();
     }
-    w.writeByte(@intFromEnum(Mode.runs)) catch return error.OutOfMemory;
+    w.writeByte(@backingInt(Mode.runs)) catch return error.OutOfMemory;
     // Runs of differing blocks, found in one pass and kept so their count can lead them.
     var runs: std.ArrayList(Run) = .empty;
     defer runs.deinit(gpa);
@@ -159,7 +159,13 @@ test "an edit in one place is a delta of about its size" {
 }
 
 test "text inserted shifts what follows, and the delta is still the part between the edits" {
-    const ref = "fn main() void {\n    std.debug.print(\"hello\", .{});\n}\n" ** 100;
+    const line = "fn main() void {\n    std.debug.print(\"hello\", .{});\n}\n";
+    const ref: *const [line.len * 100]u8 = comptime blk: {
+        var buf: [line.len * 100]u8 = undefined;
+        for (0..100) |i| buf[i * line.len ..][0..line.len].* = line.*;
+        const out = buf;
+        break :blk &out;
+    };
     const new = ref[0..2000] ++ "// inserted\n" ++ ref[2000..];
     const size = try roundTrip(ref, new);
     try testing.expect(size < 32);
diff --git a/app/store/PluginLoader.zig b/app/store/PluginLoader.zig
index 333f793ba..b74bef099 100644
--- a/app/store/PluginLoader.zig
+++ b/app/store/PluginLoader.zig
@@ -492,7 +492,7 @@ pub fn register(host: *Host, opened: Opened, pre: ?PreRegister) LoadError!Loaded
     crash.addModule(o.plugin_id, plugin_version, @intFromPtr(o.register_fn));
     errdefer crash.removeModule(@intFromPtr(o.register_fn));
 
-    const status: dylib_api.RegisterStatus = @enumFromInt(o.register_fn(host));
+    const status: dylib_api.RegisterStatus = @fromBackingInt(@intCast(o.register_fn(host)));
     switch (status) {
         .ok => {},
         .err_abi_mismatch => return error.AbiMismatch,
@@ -514,7 +514,7 @@ pub fn register(host: *Host, opened: Opened, pre: ?PreRegister) LoadError!Loaded
 }
 
 fn allowAbiWarn() bool {
-    if (builtin.mode != .Debug) return false;
+    if (builtin.mode != .debug) return false;
     if (std.c.getenv("FIZZY_PLUGIN_ABI_WARN")) |v| {
         return std.mem.eql(u8, std.mem.span(v), "1");
     }
@@ -533,8 +533,9 @@ pub fn probeName(allocator: std.mem.Allocator, path: []const u8) ?[]u8 {
     if (lib.lookup(dylib_api.GetManifestZonFn, dylib_api.symbol_manifest_zon)) |get_zon| {
         const zon = std.mem.span(get_zon());
         if (zon.len > 0) {
-            if (sdk.Manifest.parse(allocator, zon)) |parsed| {
-                defer sdk.Manifest.free(allocator, parsed);
+            var arena: std.heap.ArenaAllocator = .init(allocator);
+            defer arena.deinit();
+            if (sdk.Manifest.parse(allocator, arena.allocator(), zon)) |parsed| {
                 if (parsed.name.len > 0) return allocator.dupe(u8, parsed.name) catch null;
             } else |_| {}
         }
@@ -571,8 +572,9 @@ pub fn probeManifestInfo(allocator: std.mem.Allocator, path: []const u8) ?Probed
     const get_zon = lib.lookup(dylib_api.GetManifestZonFn, dylib_api.symbol_manifest_zon) orelse return null;
     const zon = std.mem.span(get_zon());
     if (zon.len == 0) return null;
-    const parsed = sdk.Manifest.parse(allocator, zon) catch return null;
-    defer sdk.Manifest.free(allocator, parsed);
+    var arena: std.heap.ArenaAllocator = .init(allocator);
+    defer arena.deinit();
+    const parsed = sdk.Manifest.parse(allocator, arena.allocator(), zon) catch return null;
 
     var out: ProbedManifest = .{};
     errdefer freeProbedManifest(allocator, out);
@@ -615,10 +617,10 @@ pub fn probeVersionInfo(path: []const u8) ?PluginVersionInfo {
     if (lib.lookup(dylib_api.GetManifestZonFn, dylib_api.symbol_manifest_zon)) |get_zon| {
         const zon = std.mem.span(get_zon());
         if (zon.len > 0) {
-            // Stack/arena-free parse: use page allocator for a short-lived Manifest.
-            const gpa = std.heap.page_allocator;
-            if (sdk.Manifest.parse(gpa, zon)) |parsed| {
-                defer sdk.Manifest.free(gpa, parsed);
+            // A short-lived Manifest, in an arena over the page allocator.
+            var arena: std.heap.ArenaAllocator = .init(std.heap.page_allocator);
+            defer arena.deinit();
+            if (sdk.Manifest.parse(std.heap.page_allocator, arena.allocator(), zon)) |parsed| {
                 if (std.SemanticVersion.parse(parsed.version)) |sv| {
                     plugin_version = .{ .major = @intCast(sv.major), .minor = @intCast(sv.minor), .patch = @intCast(sv.patch) };
                 } else |_| {}
diff --git a/app/store/PluginLoader_web.zig b/app/store/PluginLoader_web.zig
index 45c8ef0e4..d6e906f72 100644
--- a/app/store/PluginLoader_web.zig
+++ b/app/store/PluginLoader_web.zig
@@ -264,7 +264,7 @@ pub const Prepared = struct {
         if (pre) |inject| {
             self.set_globals(if (inject.gpa) |gpa| @ptrCast(gpa) else null, inject.arg_b, inject.arg_c);
         }
-        const status: dylib_api.RegisterStatus = @enumFromInt(self.reg_fn(host));
+        const status: dylib_api.RegisterStatus = @fromBackingInt(@intCast(self.reg_fn(host)));
         switch (status) {
             .ok => {},
             .err_abi_mismatch => return error.AbiMismatch,
diff --git a/app/store/PluginStore.zig b/app/store/PluginStore.zig
index 4d205aec3..3cf6560bb 100644
--- a/app/store/PluginStore.zig
+++ b/app/store/PluginStore.zig
@@ -262,7 +262,7 @@ pub fn queueInstall(id: []const u8) void {
 pub fn isInstalling(id: []const u8) bool {
     if (web_in_flight.contains(id)) return true;
     const job = jobs.get(id) orelse return false;
-    const status: JobStatus = @enumFromInt(job.status.load(.acquire));
+    const status: JobStatus = @fromBackingInt(@intCast(job.status.load(.acquire)));
     return status == .downloading or status == .downloaded;
 }
 
@@ -1062,7 +1062,7 @@ pub fn applyPendingUpdate(id: []const u8) void {
 /// here too.
 pub fn updateStatus(id: []const u8) ?[]const u8 {
     if (web_in_flight.contains(id)) return "Updating\u{2026}";
-    if (jobs.get(id)) |job| return switch (@as(JobStatus, @enumFromInt(job.status.load(.acquire)))) {
+    if (jobs.get(id)) |job| return switch (@as(JobStatus, @fromBackingInt(@intCast(job.status.load(.acquire))))) {
         .downloading => "Updating\u{2026}",
         .downloaded => "Installing\u{2026}",
         .failed => "Failed",
@@ -1388,7 +1388,7 @@ pub fn tick() void {
     var i: usize = 0;
     while (i < jobs.count()) {
         const job = jobs.values()[i];
-        switch (@as(JobStatus, @enumFromInt(job.status.load(.acquire)))) {
+        switch (@as(JobStatus, @fromBackingInt(@intCast(job.status.load(.acquire))))) {
             .downloading => i += 1,
             .failed => {
                 // Nobody asked for a quiet job, so it leaves no failed card to retry from. Log it,
@@ -1437,7 +1437,7 @@ pub fn tick() void {
                     const n = @min(@errorName(err).len, job.err_buf.len);
                     @memcpy(job.err_buf[0..n], @errorName(err)[0..n]);
                     job.err_len = n;
-                    job.status.store(@intFromEnum(JobStatus.failed), .release);
+                    job.status.store(@backingInt(JobStatus.failed), .release);
                     i += 1;
                     continue;
                 };
@@ -1670,10 +1670,10 @@ fn worker(job: *Job, io: std.Io) void {
         const n = @min(@errorName(err).len, job.err_buf.len);
         @memcpy(job.err_buf[0..n], @errorName(err)[0..n]);
         job.err_len = n;
-        job.status.store(@intFromEnum(JobStatus.failed), .release);
+        job.status.store(@backingInt(JobStatus.failed), .release);
         return;
     };
-    job.status.store(@intFromEnum(JobStatus.downloaded), .release);
+    job.status.store(@backingInt(JobStatus.downloaded), .release);
 }
 
 fn removeJob(id: []const u8) void {
@@ -1750,7 +1750,7 @@ fn buildJob(id: []const u8, url: []const u8, sha256: []const u8, opts: DownloadO
     errdefer a.free(dest);
 
     job.* = .{
-        .status = .init(@intFromEnum(JobStatus.downloading)),
+        .status = .init(@backingInt(JobStatus.downloading)),
         .id = id_dup,
         .url = url_dup,
         .sha256 = sha_dup,
@@ -3105,7 +3105,7 @@ fn drawCardControls(entry: StoreEntry) void {
     defer ctl.deinit();
 
     // An in-flight / failed install job preempts the normal controls.
-    if (jobs.get(entry.id)) |job| switch (@as(JobStatus, @enumFromInt(job.status.load(.acquire)))) {
+    if (jobs.get(entry.id)) |job| switch (@as(JobStatus, @fromBackingInt(@intCast(job.status.load(.acquire))))) {
         .downloading => {
             drawInstalling(if (job.is_update) "Updating…" else "Installing…", muted);
             return;
@@ -3250,7 +3250,7 @@ fn drawStoreCardControls(entry: StoreEntry) void {
     defer ctl.deinit();
 
     // An in-flight / failed install job preempts the normal controls.
-    if (jobs.get(entry.id)) |job| switch (@as(JobStatus, @enumFromInt(job.status.load(.acquire)))) {
+    if (jobs.get(entry.id)) |job| switch (@as(JobStatus, @fromBackingInt(@intCast(job.status.load(.acquire))))) {
         .downloading => {
             drawInstalling(if (job.is_update) "Updating…" else "Installing…", muted);
             return;
diff --git a/app/store/plugin_repo_asset.zig b/app/store/plugin_repo_asset.zig
index f593406ae..c1b25299c 100644
--- a/app/store/plugin_repo_asset.zig
+++ b/app/store/plugin_repo_asset.zig
@@ -29,7 +29,7 @@ pub fn fetchOk(io: std.Io, url: []const u8, limit: std.Io.Limit) ?[]u8 {
     if (result.status != .ok) return null;
 
     const written = body.written();
-    if (limit != .unlimited and limit != .nothing and written.len > @intFromEnum(limit)) return null;
+    if (limit != .unlimited and limit != .nothing and written.len > @backingInt(limit)) return null;
     return gpa().dupe(u8, written) catch null;
 }
 
diff --git a/app/store/readme.zig b/app/store/readme.zig
index a0f6e5d17..449fbd3bf 100644
--- a/app/store/readme.zig
+++ b/app/store/readme.zig
@@ -30,7 +30,7 @@ pub const Readme = struct {
     /// Captured at select time so the worker can wake the blocked event loop when the fetch
     /// finishes (otherwise the UI stays on "Loading…" until an unrelated input event).
     window: *dvui.Window,
-    status: std.atomic.Value(u8) = .init(@intFromEnum(Status.idle)),
+    status: std.atomic.Value(u8) = .init(@backingInt(Status.idle)),
     /// Fetched README bytes (app-allocator owned). Written once by the worker before it flips
     /// `status` to `ready` with release ordering; read on the UI thread only after an acquire
     /// load sees `ready`, so no lock is needed for the bytes themselves.
@@ -48,7 +48,7 @@ pub const Readme = struct {
     preview: markdown.Preview = .{},
 
     fn statusValue(self: *Readme) Status {
-        return @enumFromInt(self.status.load(.acquire));
+        return @fromBackingInt(@intCast(self.status.load(.acquire)));
     }
 
     /// Start fetching `id`'s README (from its `repo` URL, optionally scoped to `subpath` within
@@ -72,7 +72,7 @@ pub const Readme = struct {
             .io = dvui.io,
             .window = dvui.currentWindow(),
         };
-        self.status.store(@intFromEnum(Status.fetching), .release);
+        self.status.store(@backingInt(Status.fetching), .release);
         return self;
     }
 
@@ -85,7 +85,7 @@ pub const Readme = struct {
             return;
         }
         self.thread = std.Thread.spawn(.{}, worker, .{self}) catch {
-            self.status.store(@intFromEnum(Status.failed), .release);
+            self.status.store(@backingInt(Status.failed), .release);
             return;
         };
     }
@@ -113,7 +113,7 @@ pub const Readme = struct {
         if (comptime !is_wasm) return;
         if (self.statusValue() != .fetching) return;
         if (self.wasm_url_i >= self.wasm_url_len) {
-            self.status.store(@intFromEnum(Status.not_found), .release);
+            self.status.store(@backingInt(Status.not_found), .release);
             return;
         }
         switch (web_fetch.request(repo_asset.gpa(), self.wasm_urls[self.wasm_url_i])) {
@@ -121,16 +121,16 @@ pub const Readme = struct {
             .failed => {
                 self.wasm_url_i += 1;
                 if (self.wasm_url_i >= self.wasm_url_len)
-                    self.status.store(@intFromEnum(Status.not_found), .release);
+                    self.status.store(@backingInt(Status.not_found), .release);
             },
             .ready => |body| {
                 const gpa = repo_asset.gpa();
                 self.bytes = gpa.dupe(u8, body) catch {
-                    self.status.store(@intFromEnum(Status.failed), .release);
+                    self.status.store(@backingInt(Status.failed), .release);
                     return;
                 };
                 self.image_base = gpa.dupe(u8, self.wasm_urls[self.wasm_url_i]) catch null;
-                self.status.store(@intFromEnum(Status.ready), .release);
+                self.status.store(@backingInt(Status.ready), .release);
             },
         }
     }
@@ -184,7 +184,7 @@ pub fn deinit() void {
 fn fillWasmCandidates(self: *Readme) void {
     var url_buf: [3][256]u8 = undefined;
     const candidates = repo_asset.rawGithubUrls(&url_buf, self.repo, self.subpath, readme_filename) orelse {
-        self.status.store(@intFromEnum(Status.not_found), .release);
+        self.status.store(@backingInt(Status.not_found), .release);
         return;
     };
     const gpa = repo_asset.gpa();
@@ -194,7 +194,7 @@ fn fillWasmCandidates(self: *Readme) void {
         n += 1;
     }
     self.wasm_url_len = n;
-    if (n == 0) self.status.store(@intFromEnum(Status.not_found), .release);
+    if (n == 0) self.status.store(@backingInt(Status.not_found), .release);
 }
 
 fn worker(self: *Readme) void {
@@ -206,14 +206,14 @@ fn worker(self: *Readme) void {
         if (repo_asset.readLocalAsset(self.io, self.subpath, readme_filename, limit)) |asset| {
             self.bytes = asset.bytes;
             self.image_base = asset.dir;
-            self.status.store(@intFromEnum(Status.ready), .release);
+            self.status.store(@backingInt(Status.ready), .release);
             return;
         }
     }
 
     var url_buf: [3][256]u8 = undefined;
     const candidates = repo_asset.rawGithubUrls(&url_buf, self.repo, self.subpath, readme_filename) orelse {
-        self.status.store(@intFromEnum(Status.not_found), .release);
+        self.status.store(@backingInt(Status.not_found), .release);
         return;
     };
 
@@ -222,9 +222,9 @@ fn worker(self: *Readme) void {
             self.bytes = body;
             // `url` lives in the worker's stack buffer — the preview needs it every frame.
             self.image_base = repo_asset.gpa().dupe(u8, url) catch null;
-            self.status.store(@intFromEnum(Status.ready), .release);
+            self.status.store(@backingInt(Status.ready), .release);
             return;
         }
     }
-    self.status.store(@intFromEnum(Status.not_found), .release);
+    self.status.store(@backingInt(Status.not_found), .release);
 }
diff --git a/app/store/registry/store.zig b/app/store/registry/store.zig
index 74d816491..7d4f7a247 100644
--- a/app/store/registry/store.zig
+++ b/app/store/registry/store.zig
@@ -46,7 +46,7 @@ pub const Catalog = struct {
     io: std.Io,
     summary_url: []const u8,
     shard_url: []const u8,
-    status_value: std.atomic.Value(u8) = .init(@intFromEnum(Status.idle)),
+    status_value: std.atomic.Value(u8) = .init(@backingInt(Status.idle)),
     mutex: std.Io.Mutex = .init,
     summary: ?ParsedSummary = null,
     shard: ?ParsedShard = null,
@@ -92,7 +92,7 @@ pub const Catalog = struct {
     }
 
     pub fn status(self: *Catalog) Status {
-        return @enumFromInt(self.status_value.load(.acquire));
+        return @fromBackingInt(@intCast(self.status_value.load(.acquire)));
     }
 
     /// Kick off a background refresh. No-op while one is already in flight. Must be called from
@@ -106,10 +106,10 @@ pub const Catalog = struct {
         // Release the previous worker's group resources. `status() != .fetching` means it has
         // already stored its final status, so this returns as soon as that task unwinds.
         self.tasks.await(self.io) catch {};
-        self.status_value.store(@intFromEnum(Status.fetching), .release);
+        self.status_value.store(@backingInt(Status.fetching), .release);
         // `concurrent`, not `async`: this must run on its own thread, never inline on the caller's.
         self.tasks.concurrent(self.io, worker, .{self}) catch {
-            self.status_value.store(@intFromEnum(Status.failed), .release);
+            self.status_value.store(@backingInt(Status.failed), .release);
             return;
         };
     }
@@ -118,12 +118,12 @@ pub const Catalog = struct {
         if (self.wasm_summary_url) |u| self.allocator.free(u);
         if (self.wasm_shard_url) |u| self.allocator.free(u);
         self.wasm_summary_url = cacheBust(self.allocator, self.io, self.summary_url) orelse {
-            self.status_value.store(@intFromEnum(Status.failed), .release);
+            self.status_value.store(@backingInt(Status.failed), .release);
             return;
         };
         self.wasm_shard_url = cacheBust(self.allocator, self.io, self.shard_url);
         self.wasm_phase = .summary;
-        self.status_value.store(@intFromEnum(Status.fetching), .release);
+        self.status_value.store(@backingInt(Status.fetching), .release);
     }
 
     /// Advance in-flight browser GETs. UI thread, wasm only — a no-op natively. `fetcher` is the
@@ -163,7 +163,7 @@ pub const Catalog = struct {
             .shard => {
                 const url = self.wasm_shard_url orelse {
                     self.wasm_phase = .idle;
-                    self.status_value.store(@intFromEnum(Status.ready), .release);
+                    self.status_value.store(@backingInt(Status.ready), .release);
                     return;
                 };
                 switch (fetcher.request(self.allocator, url)) {
@@ -172,7 +172,7 @@ pub const Catalog = struct {
                     // every card reads "no compatible build".
                     .failed => {
                         self.wasm_phase = .idle;
-                        self.status_value.store(@intFromEnum(Status.ready), .release);
+                        self.status_value.store(@backingInt(Status.ready), .release);
                     },
                     .ready => |bytes| {
                         if (std.json.parseFromSlice(registry.ReleaseShard, self.allocator, bytes, .{
@@ -183,7 +183,7 @@ pub const Catalog = struct {
                             self.shard = parsed;
                         } else |_| {}
                         self.wasm_phase = .idle;
-                        self.status_value.store(@intFromEnum(Status.ready), .release);
+                        self.status_value.store(@backingInt(Status.ready), .release);
                     },
                 }
             },
@@ -192,7 +192,7 @@ pub const Catalog = struct {
 
     fn failWasm(self: *Catalog) void {
         self.wasm_phase = .idle;
-        self.status_value.store(@intFromEnum(Status.failed), .release);
+        self.status_value.store(@backingInt(Status.failed), .release);
     }
 
     /// Runs in the task group. Every failure path — including `error.Canceled` from a shutdown
@@ -200,7 +200,7 @@ pub const Catalog = struct {
     /// refresh: the app is on its way down, and a later `refresh` would overwrite it anyway.
     fn worker(self: *Catalog) void {
         const fresh_summary = registry.fetchSummary(self.allocator, self.io, self.summary_url) catch {
-            self.status_value.store(@intFromEnum(Status.failed), .release);
+            self.status_value.store(@backingInt(Status.failed), .release);
             return;
         };
         // Best-effort: any failure (network, 404 for a brand-new fingerprint nobody has
@@ -216,7 +216,7 @@ pub const Catalog = struct {
             self.shard = s;
         }
         self.mutex.unlock(self.io);
-        self.status_value.store(@intFromEnum(Status.ready), .release);
+        self.status_value.store(@backingInt(Status.ready), .release);
     }
 
     /// A joined view of the latest summary + this host's release shard, for the duration the
diff --git a/app/store/store_icon.zig b/app/store/store_icon.zig
index 55dcfccc7..60b68ea43 100644
--- a/app/store/store_icon.zig
+++ b/app/store/store_icon.zig
@@ -17,7 +17,7 @@ const icon_filename = "ICON.png";
 const Status = enum(u8) { idle, fetching, ready, not_found, failed };
 
 const IconEntry = struct {
-    status: std.atomic.Value(u8) = .init(@intFromEnum(Status.idle)),
+    status: std.atomic.Value(u8) = .init(@backingInt(Status.idle)),
     /// Fetched PNG bytes (app-allocator owned). Written by the worker; decoded on the UI thread.
     bytes: ?[]u8 = null,
     /// Decoded once on the UI thread after `bytes` is ready.
@@ -28,7 +28,7 @@ const IconEntry = struct {
     wasm_url_i: usize = 0,
 
     fn statusValue(self: *IconEntry) Status {
-        return @enumFromInt(self.status.load(.acquire));
+        return @fromBackingInt(@intCast(self.status.load(.acquire)));
     }
 
     fn deinit(self: *IconEntry) void {
@@ -92,7 +92,7 @@ pub fn request(id: []const u8, repo: []const u8, subpath: []const u8) void {
         return;
     };
 
-    entry.status.store(@intFromEnum(Status.fetching), .release);
+    entry.status.store(@backingInt(Status.fetching), .release);
     if (comptime is_wasm) {
         fillWasmCandidates(entry, repo_owned, subpath_owned);
         gpa.free(repo_owned);
@@ -102,7 +102,7 @@ pub fn request(id: []const u8, repo: []const u8, subpath: []const u8) void {
     entry.thread = std.Thread.spawn(.{}, worker, .{ repo_owned, subpath_owned, entry }) catch {
         gpa.free(repo_owned);
         gpa.free(subpath_owned);
-        entry.status.store(@intFromEnum(Status.failed), .release);
+        entry.status.store(@backingInt(Status.failed), .release);
         return;
     };
 }
@@ -117,7 +117,7 @@ pub fn pump() void {
 fn pumpEntry(entry: *IconEntry) void {
     if (entry.statusValue() != .fetching) return;
     if (entry.wasm_url_i >= entry.wasm_url_len) {
-        entry.status.store(@intFromEnum(Status.not_found), .release);
+        entry.status.store(@backingInt(Status.not_found), .release);
         return;
     }
     switch (web_fetch.request(repo_asset.gpa(), entry.wasm_urls[entry.wasm_url_i])) {
@@ -125,14 +125,14 @@ fn pumpEntry(entry: *IconEntry) void {
         .failed => {
             entry.wasm_url_i += 1;
             if (entry.wasm_url_i >= entry.wasm_url_len)
-                entry.status.store(@intFromEnum(Status.not_found), .release);
+                entry.status.store(@backingInt(Status.not_found), .release);
         },
         .ready => |body| {
             entry.bytes = repo_asset.gpa().dupe(u8, body) catch {
-                entry.status.store(@intFromEnum(Status.failed), .release);
+                entry.status.store(@backingInt(Status.failed), .release);
                 return;
             };
-            entry.status.store(@intFromEnum(Status.ready), .release);
+            entry.status.store(@backingInt(Status.ready), .release);
         },
     }
 }
@@ -140,7 +140,7 @@ fn pumpEntry(entry: *IconEntry) void {
 fn fillWasmCandidates(entry: *IconEntry, repo: []const u8, subpath: []const u8) void {
     var url_buf: [3][256]u8 = undefined;
     const candidates = repo_asset.rawGithubUrls(&url_buf, repo, subpath, icon_filename) orelse {
-        entry.status.store(@intFromEnum(Status.not_found), .release);
+        entry.status.store(@backingInt(Status.not_found), .release);
         return;
     };
     const gpa = repo_asset.gpa();
@@ -150,7 +150,7 @@ fn fillWasmCandidates(entry: *IconEntry, repo: []const u8, subpath: []const u8)
         n += 1;
     }
     entry.wasm_url_len = n;
-    if (n == 0) entry.status.store(@intFromEnum(Status.not_found), .release);
+    if (n == 0) entry.status.store(@backingInt(Status.not_found), .release);
 }
 
 /// Draw the cached icon for `id` into the current dvui parent, at `size` square. Returns true
@@ -200,23 +200,23 @@ fn worker(repo_owned: []u8, subpath_owned: []u8, entry: *IconEntry) void {
         if (repo_asset.readLocalAsset(io, subpath_owned, icon_filename, limit)) |asset| {
             repo_asset.gpa().free(asset.dir); // an icon has nothing relative to resolve
             entry.bytes = asset.bytes;
-            entry.status.store(@intFromEnum(Status.ready), .release);
+            entry.status.store(@backingInt(Status.ready), .release);
             return;
         }
     }
 
     var url_buf: [3][256]u8 = undefined;
     const candidates = repo_asset.rawGithubUrls(&url_buf, repo_owned, subpath_owned, icon_filename) orelse {
-        entry.status.store(@intFromEnum(Status.not_found), .release);
+        entry.status.store(@backingInt(Status.not_found), .release);
         return;
     };
 
     for (candidates.slice()) |url| {
         if (repo_asset.fetchOk(io, url, limit)) |body| {
             entry.bytes = body;
-            entry.status.store(@intFromEnum(Status.ready), .release);
+            entry.status.store(@backingInt(Status.ready), .release);
             return;
         }
     }
-    entry.status.store(@intFromEnum(Status.not_found), .release);
+    entry.status.store(@backingInt(Status.not_found), .release);
 }
diff --git a/app/update/auto_update.zig b/app/update/auto_update.zig
index 2cc28af01..fe2f7420c 100644
--- a/app/update/auto_update.zig
+++ b/app/update/auto_update.zig
@@ -18,12 +18,7 @@ pub var hooks: Hooks = .{};
 
 pub const impl: bool = build_opts.velopack_enabled and builtin.target.cpu.arch != .wasm32;
 
-const Vpk = if (impl)
-    @cImport({
-        @cInclude("Velopack.h");
-    })
-else
-    struct {};
+const Vpk = if (impl) @import("velopack_c") else struct {};
 
 pub fn logVpkError(prefix: []const u8) void {
     if (!impl) return;
@@ -93,7 +88,7 @@ fn openGithubManager(allocator: std.mem.Allocator, url: []const u8) error{OutOfM
     if (!impl) return null;
     if (url.len == 0) return null;
 
-    const repo_url_z = try allocator.dupeZ(u8, url);
+    const repo_url_z = try allocator.dupeSentinel(u8, url, 0);
     defer allocator.free(repo_url_z);
 
     const source: ?*Vpk.vpkc_update_source_t = Vpk.vpkc_new_source_github(repo_url_z.ptr, null, false);
@@ -125,7 +120,7 @@ pub fn openUpdateManager(io: std.Io, allocator: std.mem.Allocator) error{OutOfMe
     if (std.c.getenv("FIZZY_AUTOUPDATE_URL")) |raw| {
         const update_url = std.mem.span(raw);
         if (update_url.len == 0) return null;
-        const update_url_z = try allocator.dupeZ(u8, update_url);
+        const update_url_z = try allocator.dupeSentinel(u8, update_url, 0);
         defer allocator.free(update_url_z);
         var manager: ?*Vpk.vpkc_update_manager_t = null;
         if (!Vpk.vpkc_new_update_manager(update_url_z.ptr, null, null, &manager)) {
diff --git a/app/update/update_install.zig b/app/update/update_install.zig
index 24a1adb94..235ed8da0 100644
--- a/app/update/update_install.zig
+++ b/app/update/update_install.zig
@@ -19,12 +19,7 @@ const dvui = @import("dvui");
 const auto_update = @import("auto_update.zig");
 const build_opts = @import("build_opts");
 
-const Vpk = if (auto_update.impl)
-    @cImport({
-        @cInclude("Velopack.h");
-    })
-else
-    struct {};
+const Vpk = if (auto_update.impl) @import("velopack_c") else struct {};
 
 const UpdateJob = @This();
 
@@ -41,7 +36,7 @@ allocator: std.mem.Allocator,
 window: *dvui.Window,
 io: std.Io,
 
-phase: std.atomic.Value(u8) = .init(@intFromEnum(Phase.queued)),
+phase: std.atomic.Value(u8) = .init(@backingInt(Phase.queued)),
 /// 0–100 from Velopack's download callback. Stays at 0 outside `.downloading`.
 progress: std.atomic.Value(u8) = .init(0),
 /// Worker → main publish flag.
@@ -141,7 +136,7 @@ pub fn applyAtExit() bool {
 
 pub fn currentPhase(job: *const UpdateJob) Phase {
     const raw = job.phase.load(.acquire);
-    return @enumFromInt(raw);
+    return @fromBackingInt(@intCast(raw));
 }
 
 pub fn progressPercent(job: *const UpdateJob) u8 {
@@ -184,7 +179,7 @@ fn setFailed(job: *UpdateJob, e: auto_update.UpdateInstallError) void {
     } else {
         job.err_msg_len = 0;
     }
-    job.phase.store(@intFromEnum(Phase.failed), .release);
+    job.phase.store(@backingInt(Phase.failed), .release);
 }
 
 fn workerMain(job: *UpdateJob) void {
@@ -202,7 +197,7 @@ fn workerMain(job: *UpdateJob) void {
         return;
     }
 
-    job.phase.store(@intFromEnum(Phase.downloading), .release);
+    job.phase.store(@backingInt(Phase.downloading), .release);
     dvui.refresh(job.window, @src(), null);
 
     const mgr_opaque = auto_update.openUpdateManager(job.io, job.allocator) catch {
@@ -223,7 +218,7 @@ fn workerMain(job: *UpdateJob) void {
     switch (result) {
         Vpk.UPDATE_AVAILABLE => {},
         Vpk.NO_UPDATE_AVAILABLE, Vpk.REMOTE_IS_EMPTY => {
-            job.phase.store(@intFromEnum(Phase.no_update), .release);
+            job.phase.store(@backingInt(Phase.no_update), .release);
             return;
         },
         Vpk.UPDATE_ERROR => {
@@ -250,6 +245,6 @@ fn workerMain(job: *UpdateJob) void {
     job.manager = mgr_opaque;
     job.update_info = u;
     job.progress.store(100, .monotonic);
-    job.phase.store(@intFromEnum(Phase.downloaded), .release);
+    job.phase.store(@backingInt(Phase.downloaded), .release);
     job.downloaded_unseen.store(true, .release);
 }
diff --git a/app/update/update_notify.zig b/app/update/update_notify.zig
index 195ffc128..c6657ada2 100644
--- a/app/update/update_notify.zig
+++ b/app/update/update_notify.zig
@@ -16,7 +16,7 @@ const Phase = enum(u8) {
 };
 
 var launched: bool = false;
-var phase: std.atomic.Value(u8) = .init(@intFromEnum(Phase.pending));
+var phase: std.atomic.Value(u8) = .init(@backingInt(Phase.pending));
 
 /// Set by `startLaunchCheck` when the "update available" state is faked for UI work
 /// (`Constants.debug_simulate_update_available`). Nothing may act on it beyond drawing the
@@ -44,7 +44,7 @@ const PROGRESS_TOAST_TIMEOUT_US: i32 = std.math.maxInt(i32);
 /// Stable, non-null subwindow id for this toast. Using a non-null id makes DVUI's
 /// default `toastsShow(null, …)` (run in `Window.end`) skip it, so we can render
 /// it ourselves in a custom rect via `dvui.toastsFor(SUBWINDOW_ID)`.
-const SUBWINDOW_ID: dvui.Id = @enumFromInt(0xF122_DA70_AD0E_71D0);
+const SUBWINDOW_ID: dvui.Id = @fromBackingInt(@intCast(0xF122_DA70_AD0E_71D0));
 
 // Estimated toast size — used for the FloatingWidget bounding rect and for
 // computing the bottom-left anchor relative to the infobar. The real toast
@@ -63,22 +63,22 @@ pub fn startLaunchCheck(io: std.Io, simulate_out_of_date: bool) void {
         const fake = "9.9.9 (simulated)";
         @memcpy(remote_ver[0..fake.len], fake);
         remote_ver_len = fake.len;
-        phase.store(@intFromEnum(Phase.done_yes), .release);
+        phase.store(@backingInt(Phase.done_yes), .release);
         return;
     }
 
     if (!auto_update.impl) {
-        phase.store(@intFromEnum(Phase.done_no), .release);
+        phase.store(@backingInt(Phase.done_no), .release);
         return;
     }
 
     if (!auto_update.installLayoutSupported(io)) {
-        phase.store(@intFromEnum(Phase.done_no), .release);
+        phase.store(@backingInt(Phase.done_no), .release);
         return;
     }
 
     const thread = std.Thread.spawn(.{}, worker, .{io}) catch {
-        phase.store(@intFromEnum(Phase.done_no), .release);
+        phase.store(@backingInt(Phase.done_no), .release);
         return;
     };
     thread.detach();
@@ -87,7 +87,7 @@ pub fn startLaunchCheck(io: std.Io, simulate_out_of_date: bool) void {
 fn worker(io: std.Io) void {
     var ver_buf: [128]u8 = undefined;
     const summary = auto_update.checkRemoteVersionSummary(io, std.heap.page_allocator, &ver_buf) catch {
-        phase.store(@intFromEnum(Phase.done_no), .release);
+        phase.store(@backingInt(Phase.done_no), .release);
         return;
     };
     switch (summary) {
@@ -95,19 +95,19 @@ fn worker(io: std.Io) void {
             const n = @min(v.len, remote_ver.len);
             @memcpy(remote_ver[0..n], v[0..n]);
             remote_ver_len = n;
-            phase.store(@intFromEnum(Phase.done_yes), .release);
+            phase.store(@backingInt(Phase.done_yes), .release);
         },
         .no_update, .remote_empty => {
-            phase.store(@intFromEnum(Phase.done_no), .release);
+            phase.store(@backingInt(Phase.done_no), .release);
         },
         else => {
-            phase.store(@intFromEnum(Phase.done_no), .release);
+            phase.store(@backingInt(Phase.done_no), .release);
         },
     }
 }
 
 pub fn badgeVisible() bool {
-    return phase.load(.acquire) == @intFromEnum(Phase.done_yes);
+    return phase.load(.acquire) == @backingInt(Phase.done_yes);
 }
 
 /// Where the launch update check has got to, for anything that must sequence itself *behind* a
@@ -138,7 +138,7 @@ pub fn appUpdateState() AppUpdateState {
             else => return .installing,
         };
     }
-    return switch (@as(Phase, @enumFromInt(phase.load(.acquire)))) {
+    return switch (@as(Phase, @fromBackingInt(@intCast(phase.load(.acquire))))) {
         .pending => .checking,
         .done_no => .none,
         .done_yes => .available,
diff --git a/app/watch/folder_events.zig b/app/watch/folder_events.zig
index 736fe2334..12a6f4bed 100644
--- a/app/watch/folder_events.zig
+++ b/app/watch/folder_events.zig
@@ -372,7 +372,7 @@ pub const Watches = struct {
     /// for, wherever it was left out before.
     fn done(self: *Watches, path: []const u8, owed: Owed) void {
         inline for (.{ &self.frontier, &self.todo }) |map| {
-            if (map.getIndex(path)) |i| if (@intFromEnum(map.values()[i]) <= @intFromEnum(owed)) {
+            if (map.getIndex(path)) |i| if (@backingInt(map.values()[i]) <= @backingInt(owed)) {
                 const k = map.keys()[i];
                 map.swapRemoveAt(i);
                 self.gpa.free(k);
@@ -480,7 +480,7 @@ pub const Watches = struct {
     fn leftOut(self: *Watches, path: []const u8, owed: Owed, ctx: anytype) void {
         const gop = self.frontier.getOrPut(self.gpa, path) catch return self.degrade(ctx);
         if (gop.found_existing) {
-            if (@intFromEnum(owed) > @intFromEnum(gop.value_ptr.*)) gop.value_ptr.* = owed;
+            if (@backingInt(owed) > @backingInt(gop.value_ptr.*)) gop.value_ptr.* = owed;
             return;
         }
         gop.key_ptr.* = self.gpa.dupe(u8, path) catch {
@@ -632,7 +632,7 @@ pub const Watches = struct {
 
 /// Where `Doorbell` builds: POSIX only. The walker that uses it exists only for a backend that
 /// watches folder by folder (inotify, kqueue), and none of those is on Windows.
-pub const has_doorbell = builtin.os.tag != .windows and !builtin.cpu.arch.isWasm();
+pub const has_doorbell = builtin.target.os.tag != .windows and !builtin.target.cpu.arch.isWasm();
 
 /// Wakes a thread from another that may not wait, allocate or touch an `Io`: nightwatch's
 /// reader. A pipe with a flag in front of it, so a burst of rings is one byte.
@@ -1068,7 +1068,7 @@ test "a folder refused for its own reasons is left out, said once, and the walk
 }
 
 test "a folder that can't be read is left out and said; the rest is watched" {
-    if (builtin.os.tag == .windows) return error.SkipZigTest;
+    if (builtin.target.os.tag == .windows) return error.SkipZigTest;
     var t: TestTree = .{ .tmp = undefined };
     try t.init();
     defer t.tmp.cleanup();
diff --git a/backend/AGENTS.md b/backend/AGENTS.md
index 988a5ab8a..4657436f0 100644
--- a/backend/AGENTS.md
+++ b/backend/AGENTS.md
@@ -31,6 +31,13 @@ The `.m` files in `src/platform/macos/` are built **without ARC**, under a frame
   - `orderedIndex` is stale right after `setLevel:`: order after a level change, don't ask first.
   - A child window (`addChildWindow:`) drops to its parent's level. Set the level after attaching,
     and attach only once it is shown.
+  - No macOS window both stays above another and has a full screen of its own. A child window
+    moves with its parent and goes into full screen with it. A window above the normal level is
+    taken into the app's full-screen Space as a palette, on the way there and when the person
+    swipes to it, before the app hears the Space changed. A normal window comes forward when
+    clicked. So a float in the OS's frame (`ViewportFrame.native`) is an ordinary window: don't
+    attach it or raise its level to keep it above the main one. Three rounds of that each failed
+    at a new moment (fizzyedit/fizzy#483, #492).
   - Borderless windows join the Window menu only through `changeWindowsItem:`.
 - **A press reaches SDL3View but not SDL:** SDL3View inherits NSView's `-mouseDown:`, which keeps
   the press in a full-screen window. `visual_effect_view.m` adds a forwarding one. Add the
@@ -41,6 +48,8 @@ The `.m` files in `src/platform/macos/` are built **without ARC**, under a frame
   - AppKit pictures the after-state synchronously *inside* `toggleFullScreen:`.
   - Whoever moves a window's frame sets its drawable size, because SDL hears of the new size late.
   - Take frame jumps only inside the app's frame transaction.
+  - Step a still window's way (`WindowMonitor.still`) only in the app's frames. Stepped by the
+    pump between them, its backdrop runs ahead of a late picture and shows as a band round it.
   - Read the pixel density from `backingScaleFactor`.
   - A sandbox fizzy launched from a shell isn't the active app, and AppKit stalls or refuses its
     transitions.
diff --git a/backend/build.zig b/backend/build.zig
index 86ad7433e..30817b4a4 100644
--- a/backend/build.zig
+++ b/backend/build.zig
@@ -23,7 +23,7 @@ pub fn build(b: *std.Build) void {
     // harness, against the patched library. Arguments after `--` reach the runner:
     // `--filter <suite|test>`, `--require-gpu <driver>`.
     const test_sdl_step = b.step("test-sdl", "Build and run the suites for fizzy's SDL patches");
-    const sdl_optimize: std.builtin.OptimizeMode = if (optimize == .Debug) .ReleaseFast else optimize;
+    const sdl_optimize: std.builtin.OptimizeMode = if (optimize == .debug) .fast else optimize;
     if (sdlDependency(b, target, sdl_optimize, null)) |sdl| {
         const source = patchedSdl(b).?;
         const sdl_test = b.addLibrary(.{
@@ -54,7 +54,7 @@ pub fn build(b: *std.Build) void {
         suites.root_module.linkLibrary(sdl_test);
         suites.root_module.linkLibrary(sdl.artifact("SDL3"));
         const run = b.addRunArtifact(suites);
-        if (b.args) |args| run.addArgs(args);
+        run.addPassthruArgs();
         test_sdl_step.dependOn(&run.step);
     }
 }
@@ -109,7 +109,7 @@ pub fn backendModule(dep: *std.Build.Dependency, dvui_mod: *std.Build.Module, op
     // device, every window's present. A Debug frame spent much of itself there (`sample`), and a
     // window's way into full screen ran at half the display's rate in Debug alone. The app's own
     // code stays Debug; stepping into SDL's C is what a Debug app gives up.
-    const sdl_optimize: std.builtin.OptimizeMode = if (opts.optimize == .Debug) .ReleaseFast else opts.optimize;
+    const sdl_optimize: std.builtin.OptimizeMode = if (opts.optimize == .debug) .fast else opts.optimize;
     const sdl_dep = sdlDependency(b, opts.target, sdl_optimize, opts.macos_sdk);
 
     const sdl_translate_c = b.addTranslateC(.{
@@ -147,7 +147,8 @@ pub fn backendModule(dep: *std.Build.Dependency, dvui_mod: *std.Build.Module, op
 fn patchedSdl(b: *std.Build) ?std.Build.LazyPath {
     const io = b.graph.io;
     var names: std.ArrayList([]const u8) = .empty;
-    var dir = b.build_root.handle.openDir(io, "patches/sdl", .{ .iterate = true }) catch |err|
+    b.dependOnDirectoryContents(b.path("patches/sdl"));
+    var dir = b.root.openDir(io, "patches/sdl", .{ .iterate = true }) catch |err|
         std.debug.panic("backend: open patches/sdl: {t}", .{err});
     defer dir.close(io);
     var it = dir.iterate();
diff --git a/backend/build.zig.zon b/backend/build.zig.zon
index 715385de8..5674be36a 100644
--- a/backend/build.zig.zon
+++ b/backend/build.zig.zon
@@ -2,15 +2,15 @@
     .name = .fizzy_backend,
     .version = "0.1.0",
     .fingerprint = 0x2bf08855a368b9a8,
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .dependencies = .{
         // SDL3 for the window, its events and the GPU: upstream SDL, patched at build time with
         // `patches/sdl` (marler8997/zig-patch), built by fizzyedit/sdl_zig's `fizzy` branch, which
         // takes the patched tree (`-Dsdl_source`). How the patches are made and how SDL is updated:
         // fizzy's docs/DEPENDENCIES.md. Pinned here, by the package that uses them, and nowhere else.
         .sdl = .{
-            .url = "https://github.com/fizzyedit/sdl_zig/archive/a99807da9b6217422449a824cb24de4d97f482a3.tar.gz",
-            .hash = "sdl-1.0.3+3.4.16-i4QD0f8KqgC0YeoFofQA7ZnPQWkyEVe2MJ-jhVnFqYk9",
+            .url = "https://github.com/fizzyedit/sdl_zig/archive/ef7eb36b0b28aeac933d1bcdc152c56654891780.tar.gz",
+            .hash = "sdl-1.0.3+3.4.16-i4QD0fEMqgARU41cFUViN07xvtpE9OeVQ6bDHadi1OfP",
             .lazy = true,
         },
         // The release sdl_zig's own `.sdl` pins: the same tarball, fetched once.
@@ -26,8 +26,8 @@
         },
         // AppKit from Zig, for the macOS platform pieces (and an app's own, `objcModule`).
         .zig_objc = .{
-            .url = "https://github.com/foxnne/zig-objc/archive/c8de82ff80281215ad92900866dab7103a8efa8b.tar.gz",
-            .hash = "zig_objc-0.0.0-Ir_Sp9gsAQCPAJc0oF5xoWePHWP6Y6tCphDeyNUThJoi",
+            .url = "https://github.com/foxnne/zig-objc/archive/f90394bce753153e387117cff6bf5536cd08f0c5.tar.gz",
+            .hash = "zig_objc-0.0.0-Ir_Sp1orAQDJQI7i3urWjRRHXVlB7ZG4pbKY3H8hX1AU",
             .lazy = true,
         },
         // Win32 from Zig, for the Windows platform pieces (and an app's own, `win32Module`).
diff --git a/backend/src/GpuRenderer.zig b/backend/src/GpuRenderer.zig
index 50d5b9f41..671bd620f 100644
--- a/backend/src/GpuRenderer.zig
+++ b/backend/src/GpuRenderer.zig
@@ -243,6 +243,10 @@ verts: std.ArrayList(Vertex) = .empty,
 indices: std.ArrayList(Index) = .empty,
 draws: std.ArrayList(Draw) = .empty,
 uniforms: std.ArrayList([4]f32) = .empty,
+/// Where the frame is laid down in the window, physical pixels from its top left: nothing but while
+/// the main window stands still on its way into or out of full screen, its picture growing or
+/// shrinking in it (`SDLBackend.places_main_picture`).
+window_offset: [2]f32 = .{ 0, 0 },
 
 active: ?Active = null,
 blend_override: ?Blend = null,
@@ -272,7 +276,7 @@ pub fn primary() ?*GpuRenderer {
 /// D3D12 the window takes whatever SDL picks, and is opaque.
 fn createDevice(window: *c.SDL_Window) ?*c.SDL_GPUDevice {
     const formats = c.SDL_GPU_SHADERFORMAT_SPIRV | c.SDL_GPU_SHADERFORMAT_DXIL | c.SDL_GPU_SHADERFORMAT_MSL;
-    const debug = builtin.mode == .Debug;
+    const debug = builtin.mode == .debug;
     if (builtin.target.os.tag == .windows and c.SDL_GetWindowFlags(window) & c.SDL_WINDOW_TRANSPARENT != 0) {
         if (c.SDL_CreateGPUDevice(formats, debug, "direct3d12")) |device| return device;
         log.warn("no D3D12 device ({s}); the transparent window will be opaque", .{c.SDL_GetError()});
@@ -881,6 +885,8 @@ fn clearPass(self: *GpuRenderer, tex: *Tex) !void {
 }
 
 fn encodePass(self: *GpuRenderer, dest: *c.SDL_GPUTexture, dw: u32, dh: u32, format: c.SDL_GPUTextureFormat, load: c.SDL_GPULoadOp) !void {
+    // Into the window: moved by `window_offset`, physical pixels.
+    const off: [2]f32 = if (self.swapchain == dest) self.window_offset else .{ 0, 0 };
     if (self.target != null) try self.clearSampled();
     // Before the rings are asked for room: they cycle per command buffer (`epoch`).
     const cmd = try self.ensureCmd();
@@ -898,7 +904,7 @@ fn encodePass(self: *GpuRenderer, dest: *c.SDL_GPUTexture, dw: u32, dh: u32, for
         const sx = 2.0 / @as(f32, @floatFromInt(dw));
         const sy = 2.0 / @as(f32, @floatFromInt(dh));
         for (self.verts.items, 0..) |v, i| {
-            out[i] = .{ .x = v.x * sx - 1.0, .y = 1.0 - v.y * sy, .col = v.col, .u = v.u, .v = v.v };
+            out[i] = .{ .x = (v.x + off[0]) * sx - 1.0, .y = 1.0 - (v.y + off[1]) * sy, .col = v.col, .u = v.u, .v = v.v };
         }
         @memcpy(staged.ptr[ioff..total], std.mem.sliceAsBytes(self.indices.items));
         self.stream_ring.unmap(self.device);
@@ -939,7 +945,10 @@ fn encodePass(self: *GpuRenderer, dest: *c.SDL_GPUTexture, dw: u32, dh: u32, for
     var last_n: u32 = 0;
     for (self.draws.items) |d| {
         var r = full;
-        if (d.clip) |cr| {
+        if (d.clip) |clip| {
+            var cr = clip;
+            cr.x += @intFromFloat(off[0]);
+            cr.y += @intFromFloat(off[1]);
             const x0 = @max(cr.x, 0);
             const y0 = @max(cr.y, 0);
             const x1 = @min(cr.x + cr.w, full.w);
@@ -1310,7 +1319,7 @@ pub fn programBegin(self: *GpuRenderer, id: u32, textures: []const ?*anyopaque,
 }
 
 pub fn programBlend(self: *GpuRenderer, mode: u8) void {
-    self.blend_override = @enumFromInt(@as(u2, @truncate(mode)));
+    self.blend_override = @fromBackingInt(@intCast(@as(u2, @truncate(mode))));
 }
 
 pub fn programEnd(self: *GpuRenderer) void {
diff --git a/backend/src/Health.zig b/backend/src/Health.zig
index 57c0c8c02..eeed51b86 100644
--- a/backend/src/Health.zig
+++ b/backend/src/Health.zig
@@ -77,11 +77,11 @@ pub const Counts = struct {
     destroyed: u32 = 0,
 
     fn add(a: *Counts, b: Counts) void {
-        inline for (std.meta.fields(Counts)) |f| @field(a, f.name) +|= @field(b, f.name);
+        inline for (@typeInfo(Counts).@"struct".field_names, @typeInfo(Counts).@"struct".field_types, @typeInfo(Counts).@"struct".field_attrs) |f_name, _, _| @field(a, f_name) +|= @field(b, f_name);
     }
 
     fn max(a: *Counts, b: Counts) void {
-        inline for (std.meta.fields(Counts)) |f| @field(a, f.name) = @max(@field(a, f.name), @field(b, f.name));
+        inline for (@typeInfo(Counts).@"struct".field_names, @typeInfo(Counts).@"struct".field_types, @typeInfo(Counts).@"struct".field_attrs) |f_name, _, _| @field(a, f_name) = @max(@field(a, f_name), @field(b, f_name));
     }
 };
 
@@ -284,7 +284,7 @@ test "SDL's log is counted from any thread, and the first error kept" {
     for (&pool) |*th| th.* = try std.Thread.spawn(.{}, struct {
         fn run(hp: *Health) void {
             for (0..each) |_| {
-                hp.noteLog(.@"error", "x" ** (first_error_cap + 10));
+                hp.noteLog(.@"error", &@as([first_error_cap + 10]u8, @splat('x')));
                 hp.noteLog(.warning, "w");
             }
         }
@@ -295,7 +295,7 @@ test "SDL's log is counted from any thread, and the first error kept" {
     try std.testing.expectEqual(@as(u32, threads * each), s.sdl_errors);
     try std.testing.expectEqual(@as(u32, threads * each + 1), s.sdl_warnings);
     // Cut to the cap, written once.
-    try std.testing.expectEqualStrings("x" ** first_error_cap, s.first_sdl_error);
+    try std.testing.expectEqualStrings(&@as([first_error_cap]u8, @splat('x')), s.first_sdl_error);
 }
 
 test "a snapshot round-trips through ZON" {
@@ -312,10 +312,12 @@ test "a snapshot round-trips through ZON" {
     var out: std.Io.Writer.Allocating = .init(std.testing.allocator);
     defer out.deinit();
     try std.zon.stringify.serialize(s, .{}, &out.writer);
-    const text = try std.testing.allocator.dupeZ(u8, out.written());
+    const text = try std.testing.allocator.dupeSentinel(u8, out.written(), 0);
     defer std.testing.allocator.free(text);
-    const back = try std.zon.parse.fromSliceAlloc(Snapshot, std.testing.allocator, text, null, .{});
-    defer std.zon.parse.free(std.testing.allocator, back);
+    var back_arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
+    defer back_arena.deinit();
+    var back_diag: std.zon.parse.Diagnostics = undefined;
+    const back = try std.zon.parse.fromSlice(Snapshot, .{ .gpa = std.testing.allocator, .arena = back_arena.allocator(), .source = text, .diagnostics = &back_diag });
     try std.testing.expectEqual(s.presents, back.presents);
     try std.testing.expectEqual(s.os_windows, back.os_windows);
     try std.testing.expectEqual(s.ns_windows, back.ns_windows);
diff --git a/backend/src/SDLBackend.zig b/backend/src/SDLBackend.zig
index 87b57fd29..3f188f979 100644
--- a/backend/src/SDLBackend.zig
+++ b/backend/src/SDLBackend.zig
@@ -19,7 +19,7 @@ pub const viewport_map = @import("viewport_map.zig");
 const TouchSlots = @import("touch_slots.zig");
 /// The OS windows besides the main one an app draws with (`Viewport`).
 pub const viewports = @import("viewports.zig");
-/// `dvui.osWindow` as a window of its own from the one frame (`osWindowFloating`).
+/// dvui's floating windows as OS windows of their own from the one frame (`floatingWindowOs`).
 pub const os_windows = @import("os_windows.zig");
 /// What this backend keeps count of as it runs (`health`).
 pub const Health = @import("Health.zig");
@@ -96,6 +96,19 @@ sdl_quit: bool = true,
 clear_window_on_begin: bool = false,
 /// See `mainPicture`.
 main_picture: ?viewport_map.Rect = null,
+/// The backend lays the main window's frame down where its picture is (`mainPicture`), the app
+/// drawing straight to the window: a plain dvui app's, whose picture is also below the title bar
+/// (`platform.macos_monitor.titlebarStrip`). Fizzy draws to a target and lays it down itself
+/// (`core.gfx.FrameTarget`), and keeps its content clear of the traffic lights itself.
+places_main_picture: bool = false,
+/// A plain dvui app's main window's size its shadow was last taken at, and the frames it is taken
+/// again for: clear over its backdrop (`platform.window.nativeTitleBar`), AppKit shapes the shadow
+/// — and the outline that comes with it — from what is drawn, as a float's window has it
+/// (`Viewport.shadow_size`).
+main_shadow_size: [2]i32 = .{ 0, 0 },
+main_shadow_frames: u8 = 0,
+/// Whether a viewport's window, itself seen, was presented into this frame (`unseen`).
+viewport_seen: bool = false,
 /// Added to the wall clock by `nanoTime`: how far a demo's silent frames have moved the app's
 /// clock on (`app.automation.Player.frames`). Only grows.
 clock_ahead_ns: i128 = 0,
@@ -125,7 +138,7 @@ stack_stale: bool = true,
 /// is skinned so as it opens (`viewportGlass`).
 window_skin: ?dvui.Color = null,
 
-const cursor_enum_count = @typeInfo(dvui.enums.Cursor).@"enum".fields.len;
+const cursor_enum_count = @typeInfo(dvui.enums.Cursor).@"enum".field_names.len;
 
 /// The most viewports open at once.
 pub const max_viewports = 8;
@@ -222,6 +235,9 @@ pub const Viewport = struct {
     menu: bool = false,
     /// Framed by the app, not the OS (`ViewportFrame.app`): borderless everywhere, macOS too.
     app_frame: bool = false,
+    /// Framed by the OS as any app's window is (`ViewportFrame.native`): its title bar, frame and
+    /// hit-testing are the OS's own, and nothing of fizzy's dresses it.
+    native: bool = false,
     /// macOS, framed by the app: the size its shadow was last taken at, and how many frames more
     /// to take it again. AppKit shapes a clear window's shadow from what is drawn in it, so it is
     /// taken again once the window shows and after it changes size, a frame late, once the
@@ -353,6 +369,12 @@ pub var window_create_hook: ?*const fn (props: c.SDL_PropertiesID) void = null;
 /// sees the answer change without asking for frames itself.
 pub var frame_ended_hook: ?*const fn (end_micros: ?u32) bool = null;
 
+/// Which of dvui's floating windows are shown in OS windows of their own (`floatingWindowOs`,
+/// `os_windows`): those that ask (`os_window`, as `dvui.osWindow`'s does), every one (not modal),
+/// or none, for an app that takes floats out into windows itself, as fizzy does (`Popout`). Set
+/// before the first frame.
+pub var floating_os_windows: enum { asked, all, none } = .asked;
+
 /// The backend's health counters now (`Health`): frames, presents, swapchain resizes, the OS
 /// windows alive, what SDL logged, frame-time percentiles and each frame's GPU work. Kept current
 /// whether or not anyone reads them; reading them sorts the frame times and asks SDL (and AppKit)
@@ -476,7 +498,7 @@ const quit_signals = struct {
             const n = std.c.read(fd, &buf, buf.len);
             if (n == 0) return;
             if (n < 0) {
-                if (std.c._errno().* == @intFromEnum(posix.E.INTR)) continue;
+                if (std.c._errno().* == @backingInt(posix.E.INTR)) continue;
                 return;
             }
             const pool = if (comptime has_objc) objc_autoreleasePoolPush() else null;
@@ -656,16 +678,16 @@ pub const WindowGeometry = struct {
     fn filePath(buf: []u8, options: InitOptions) ?[:0]const u8 {
         if (options.pref_path) |dir| {
             if (std.mem.endsWith(u8, dir, std.fs.path.sep_str)) {
-                return std.fmt.bufPrintZ(buf, "{s}{s}", .{ dir, zon_file_name }) catch null;
+                return std.fmt.bufPrintSentinel(buf, "{s}{s}", .{ dir, zon_file_name }, 0) catch null;
             }
-            return std.fmt.bufPrintZ(buf, "{s}{c}{s}", .{ dir, std.fs.path.sep, zon_file_name }) catch null;
+            return std.fmt.bufPrintSentinel(buf, "{s}{c}{s}", .{ dir, std.fs.path.sep, zon_file_name }, 0) catch null;
         }
         const pref = c.SDL_GetPrefPath(options.org.ptr, options.title.ptr) orelse {
             logErr("SDL_GetPrefPath in WindowGeometry") catch {};
             return null;
         };
         defer c.SDL_free(pref);
-        return std.fmt.bufPrintZ(buf, "{s}" ++ zon_file_name, .{std.mem.span(@as([*:0]const u8, @ptrCast(pref)))}) catch null;
+        return std.fmt.bufPrintSentinel(buf, "{s}" ++ zon_file_name, .{std.mem.span(@as([*:0]const u8, @ptrCast(pref)))}, 0) catch null;
     }
 
     fn fromSaved(saved: Saved) ?WindowGeometry {
@@ -703,13 +725,10 @@ pub const WindowGeometry = struct {
         if (data.len >= nul_buf.len) return null;
         @memcpy(nul_buf[0..data.len], data);
         nul_buf[data.len] = 0;
-        const saved = std.zon.parse.fromSlice(
-            Saved,
-            std.heap.page_allocator,
-            nul_buf[0..data.len :0],
-            null,
-            .{ .ignore_unknown_fields = true },
-        ) catch return null;
+        var arena: std.heap.ArenaAllocator = .init(std.heap.page_allocator);
+        defer arena.deinit();
+        var diag: std.zon.parse.Diagnostics = undefined;
+        const saved = std.zon.parse.fromSliceNoAlloc(Saved, .{ .gpa = std.heap.page_allocator, .arena = arena.allocator(), .source = nul_buf[0..data.len :0], .diagnostics = &diag, .ignore_unknown_fields = true }) catch return null;
         return fromSaved(saved);
     }
 
@@ -1056,12 +1075,108 @@ fn addEventWinRecursive(self: *SDLBackend, event: *c.SDL_Event, win: *dvui.Windo
 // ---------------------------------------------------------------------------------------------
 // dvui's OS windows
 
-/// A `dvui.osWindow`, which dvui draws as a floating window here: this backend makes no
-/// `dvui.Window` of its own for one (no `initWindowSecondary`), so it is a floating window in the
-/// one frame, and `os_windows` shows it in an OS window of its own. dvui calls this each frame it is
-/// drawn, with the header it is moved by (physical).
-pub fn osWindowFloating(_: *SDLBackend, id: dvui.Id, header: dvui.Rect.Physical, opts: dvui.OsWindowWidget.InitOptions) void {
-    os_windows.named(id, header, opts.title);
+/// The theme's window colours `dressPlainWindows` last gave the windows.
+var plain_dressed: ?[2]dvui.Color = null;
+
+/// The OS's own title bar on a plain dvui app's windows — the main one and each of the OS's own
+/// frame (`Viewport.native`) — in the theme's colour: set again only when the theme's colours
+/// change. A window opening is dressed as it opens (`viewportOpen`).
+fn dressPlainWindows(self: *SDLBackend) void {
+    const theme = dvui.themeGet();
+    const colors: [2]dvui.Color = .{ theme.color(.window, .fill), theme.color(.window, .text) };
+    if (plain_dressed) |d| if (std.meta.eql(d, colors)) return;
+    plain_dressed = colors;
+    platform.window.nativeTitleBar(self.window, colors[0], colors[1], theme.dark);
+    for (&self.viewport_slots) |*slot| if (slot.*) |*v| if (v.native) {
+        platform.window.nativeTitleBar(v.window, colors[0], colors[1], theme.dark);
+    };
+}
+
+/// A floating window of dvui's (not modal) shown in an OS window of its own, its frame the OS's
+/// (`os_windows`), as `floating_os_windows` says: dvui asks as it begins (`asked`, the window asked
+/// for one), true while it has one or one can open for it. `dvui.osWindow`'s asks, which this
+/// backend draws as a floating window: it makes no `dvui.Window` of its own for one (no
+/// `initWindowSecondary`).
+pub fn floatingWindowOs(_: *SDLBackend, id: dvui.Id, asked: bool, open_flag: ?*bool, min: dvui.Size, max: dvui.Size) bool {
+    const shown = switch (floating_os_windows) {
+        // And one torn off the main window by a drop over no window (`os_windows.torn`).
+        .asked => asked or os_windows.torn(id) or os_windows.heldFrameless(id),
+        .all => true,
+        .none => false,
+    };
+    return shown and os_windows.named(id, open_flag, min, max);
+}
+
+/// `windowHeader` in floating window `id`: its title on that window's title bar, where it has one
+/// of its own (`floatingWindowOs`).
+pub fn floatingWindowTitle(_: *SDLBackend, id: dvui.Id, header: []const u8) bool {
+    return os_windows.titled(id, header);
+}
+
+/// The kinds of window material this backend can show (fizzy's `core.material`, field for field):
+/// only a kind every surface it puts glass on can show. A clear window everywhere (`transparent`);
+/// on macOS vibrancy (`frost`) and a plain blur, and Liquid Glass from macOS 26; on Windows
+/// Acrylic (`frost`); on Linux the compositor's blur behind a window, where it has one
+/// (`wayland_blur`).
+pub const MaterialKinds = struct {
+    none: bool = true,
+    transparent: bool = false,
+    blur: bool = false,
+    frost: bool = false,
+    liquid: bool = false,
+};
+
+/// Whether the pointer is over no window of the app's: the bare desktop, or another app's window.
+/// macOS (`os_windows`' tear-off); false elsewhere, where it is not asked.
+pub fn pointerOverNoWindow(self: *SDLBackend) bool {
+    if (comptime builtin.target.os.tag != .macos) return false;
+    return self.windowAtPointer() == null;
+}
+
+/// The app's window the pointer is over, as an opaque handle (macOS: its `NSWindow`), or null.
+pub fn windowAtPointer(_: *SDLBackend) ?*anyopaque {
+    if (comptime builtin.target.os.tag != .macos) return null;
+    return fizzy_macos_app_window_at_pointer();
+}
+
+/// `window` (`windowAtPointer`'s) in front of the app's other windows, not made key.
+pub fn bringForward(_: *SDLBackend, window: *anyopaque) void {
+    if (comptime builtin.target.os.tag != .macos) return;
+    fizzy_macos_window_bring_forward(window);
+}
+
+/// The OS's title bar over a window of its own frame (`ViewportFrame.native`), physical pixels: as
+/// the main window's, a plain dvui app's being one too, or macOS's own height where it shows none
+/// (full screen).
+pub fn titleBand(self: *SDLBackend) f32 {
+    const points = platform.macos_monitor.titlebarStrip(self.window, 0, 0);
+    return (if (points > 0) points else 28) * self.density();
+}
+
+/// Where the pointer is on the desktop, in the main window's frame (physical pixels from its top
+/// left), as a held pointer over the main window is read (`heldPoint`): not in the band of the
+/// window a press began in.
+pub fn pointerInMain(self: *SDLBackend) dvui.Point.Physical {
+    var gx: f32 = 0;
+    var gy: f32 = 0;
+    _ = c.SDL_GetGlobalMouseState(&gx, &gy);
+    const origin = self.mainOnScreen();
+    const d = self.density();
+    return .{ .x = (gx - origin.x) * d, .y = (gy - origin.y) * d };
+}
+
+/// Whether a pointer button is held, wherever the pointer is.
+pub fn pointerHeld(_: *SDLBackend) bool {
+    return c.SDL_GetGlobalMouseState(null, null) != 0;
+}
+
+pub fn materialKinds(self: *SDLBackend) MaterialKinds {
+    return switch (comptime builtin.target.os.tag) {
+        .macos => .{ .transparent = true, .blur = true, .frost = true, .liquid = liquidGlassAvailable() },
+        .windows => .{ .transparent = true, .frost = true },
+        .linux => .{ .transparent = true, .blur = platform.linux_titlebar.blurOffered(self.window) },
+        else => .{},
+    };
 }
 
 // ---------------------------------------------------------------------------------------------
@@ -1087,6 +1202,11 @@ pub const ViewportFrame = enum {
     /// on macOS. Moved and resized only where the app says (`viewportHints`). A dvui app's
     /// floating windows, drawn as dvui draws them.
     app,
+    /// The OS's own window, as any app's: its title bar (the window's title, its buttons, moving,
+    /// full screen), its frame and resizing, the title bar in the window's colour
+    /// (`platform.window.nativeTitleBar`), and what the app draws below it — a dvui floating
+    /// window's content and nothing of its frame. `dvui.osWindow`'s windows (`os_windows`).
+    native,
 };
 
 const ViewportKind = enum { window, carry, overlay, menu };
@@ -1303,7 +1423,8 @@ fn openViewport(self: *SDLBackend, at: viewport_map.Rect, title_text: [:0]const
     // A menu's window is a carry window that takes the pointer, never focused: the window it opened
     // from keeps the keyboard, as an OS menu leaves it.
     // One framed by the app (`ViewportFrame.app`) is borderless on macOS as well.
-    const titled = builtin.target.os.tag == .macos and !carry and frame == .os;
+    // One framed natively (`ViewportFrame.native`) is titled everywhere: the OS's ordinary window.
+    const titled = !carry and (frame == .native or (builtin.target.os.tag == .macos and frame == .os));
     const frame_flag: c.SDL_WindowFlags = if (titled) 0 else c.SDL_WINDOW_BORDERLESS;
     const size_flag: c.SDL_WindowFlags = if (carry) 0 else c.SDL_WINDOW_RESIZABLE;
     const focus_flag: c.SDL_WindowFlags = if (menu) c.SDL_WINDOW_NOT_FOCUSABLE else 0;
@@ -1328,7 +1449,7 @@ fn openViewport(self: *SDLBackend, at: viewport_map.Rect, title_text: [:0]const
     // where SDL makes it a child window that moves with its parent, and the windows that left
     // the main one stay where they are when it moves (`plans/POPOUT_WINDOWS_PLAN.md`, decision 2).
     if (comptime builtin.target.os.tag != .macos) _ = c.SDL_SetWindowParent(window, self.window);
-    self.viewport_slots[slot] = .{ .window = window, .band = b, .anchor = anchor, .density = d, .screen = placed.screen, .frame = placed.frame, .passive = carry and !menu, .overlay = role == .overlay, .menu = menu, .app_frame = frame == .app };
+    self.viewport_slots[slot] = .{ .window = window, .band = b, .anchor = anchor, .density = d, .screen = placed.screen, .frame = placed.frame, .passive = carry and !menu, .overlay = role == .overlay, .menu = menu, .app_frame = frame == .app, .native = frame == .native };
     const vp = &self.viewport_slots[slot].?;
     // Dressed by `viewportOpenMenu`, and no hit test: nothing in it moves or resizes it.
     if (menu) return vp;
@@ -1340,6 +1461,26 @@ fn openViewport(self: *SDLBackend, at: viewport_map.Rect, title_text: [:0]const
         if (comptime builtin.target.os.tag == .macos) fizzy_macos_viewport_carry(cocoaWindow(window), cocoaWindow(self.window), platform.window.ns_visual_effect_material);
         return vp;
     }
+    // The OS's own window: its title bar and frame are the OS's to hit-test and move. No show or
+    // close animation, as no viewport has one (`viewportDress`): AppKit's never finishes under
+    // this loop and leaves the window behind as a ghost.
+    if (frame == .native) {
+        if (comptime builtin.target.os.tag == .macos) fizzy_macos_viewport_still(cocoaWindow(window));
+        const theme = dvui.themeGet();
+        platform.window.nativeTitleBar(window, theme.color(.window, .fill), theme.color(.window, .text), theme.dark);
+        // Through Spaces, zooms and live resizes as the main window goes.
+        if (comptime builtin.target.os.tag == .macos) platform.macos_monitor.watch(window);
+        // Its part of the frame below the title bar's band (`platform.macos_monitor.titlebarStrip`):
+        // the window that much taller, and as far up, for that part to be where it was asked.
+        const band = platform.macos_monitor.titlebarStrip(window, 0, 0);
+        if (band > 0) {
+            const up: c_int = @intFromFloat(@round(band));
+            _ = c.SDL_SetWindowPosition(window, vp.screen.x, vp.screen.y - up);
+            _ = c.SDL_SetWindowSize(window, vp.screen.w, vp.screen.h + up);
+            vp.picture_at = .{ 0, @intFromFloat(@round(band * vp.density)) };
+        }
+        return vp;
+    }
     // The slot holds it for the window's life, so SDL may keep the pointer.
     _ = c.SDL_SetWindowHitTest(window, viewportHitTest, vp);
     if (comptime builtin.target.os.tag == .macos) if (frame == .app) {
@@ -1641,11 +1782,41 @@ pub fn viewportDragMove(_: *SDLBackend, vp: *Viewport) bool {
 /// (macOS), the window switcher.
 pub fn viewportTitle(_: *SDLBackend, vp: *Viewport, text: []const u8) void {
     var buf: [128]u8 = undefined;
-    const z = std.fmt.bufPrintZ(&buf, "{s}", .{text[0..@min(text.len, buf.len - 1)]}) catch return;
+    const z = std.fmt.bufPrintSentinel(&buf, "{s}", .{text[0..@min(text.len, buf.len - 1)]}, 0) catch return;
     _ = c.SDL_SetWindowTitle(vp.window, z.ptr);
     if (comptime builtin.target.os.tag == .macos) fizzy_macos_viewport_windows_item(cocoaWindow(vp.window), z.ptr);
 }
 
+/// Whether `vp`'s window has the keyboard: it is the OS's key window.
+pub fn viewportHasKeyboard(vp: *const Viewport) bool {
+    return c.SDL_GetWindowFlags(vp.window) & c.SDL_WINDOW_INPUT_FOCUS != 0;
+}
+
+/// dvui's screens besides the main window (`dvui.screensSet`): each window's part of the frame that
+/// shows a floating window — not a menu's, a carried view's or an overlay's.
+pub fn viewportScreens(self: *SDLBackend, extra: ?dvui.Rect.Natural) void {
+    var rects: [max_viewports + 1]dvui.Rect.Natural = undefined;
+    var n: usize = 0;
+    const s = dvui.windowNaturalScale();
+    for (&self.viewport_slots) |*slot| {
+        const vp = if (slot.*) |*v| v else continue;
+        if (vp.passive or vp.menu or vp.overlay) continue;
+        rects[n] = .{ .x = vp.frame.x / s, .y = vp.frame.y / s, .w = vp.frame.w / s, .h = vp.frame.h / s };
+        n += 1;
+    }
+    // Last, so a window's band holding a floating window wins over it (`dvui.screenFor`).
+    if (extra) |r| {
+        rects[n] = r;
+        n += 1;
+    }
+    dvui.screensSet(rects[0..n]);
+}
+
+pub fn viewportMaxSize(_: *SDLBackend, vp: *Viewport, w: f32, h: f32) void {
+    _ = c.SDL_SetWindowMaximumSize(vp.window, @intFromFloat(@floor(w / vp.density)), @intFromFloat(@floor(h / vp.density)));
+    platform.win32_titlebar.allowMaximize(vp.window, w == 0 and h == 0);
+}
+
 /// The least the OS may resize `vp`'s window to: `size` physical pixels of the frame, its float's
 /// least.
 pub fn viewportMinSize(_: *SDLBackend, vp: *Viewport, w: f32, h: f32) void {
@@ -1656,6 +1827,11 @@ extern fn fizzy_macos_viewport_glass(nswindow: ?*anyopaque, main: ?*anyopaque, i
 extern fn fizzy_macos_viewport_dress(nswindow: ?*anyopaque, main: ?*anyopaque) void;
 extern fn fizzy_macos_viewport_plain(nswindow: ?*anyopaque) void;
 extern fn fizzy_macos_viewport_reshadow(nswindow: ?*anyopaque) void;
+extern fn fizzy_macos_window_off_active_space(nswindow: ?*anyopaque) c_int;
+extern fn fizzy_macos_window_at_pointer() ?*anyopaque;
+extern fn fizzy_macos_app_window_at_pointer() ?*anyopaque;
+extern fn fizzy_macos_window_bring_forward(nswindow: ?*anyopaque) void;
+extern fn fizzy_macos_viewport_still(nswindow: ?*anyopaque) void;
 extern fn fizzy_macos_viewport_menu(nswindow: ?*anyopaque, main: ?*anyopaque, material: c_long, radius: f64, dialog: c_int) c_int;
 extern fn fizzy_macos_viewport_menu_attached(nswindow: ?*anyopaque) void;
 extern fn fizzy_macos_viewport_order_above(nswindow: ?*anyopaque, other: ?*anyopaque) void;
@@ -1724,6 +1900,25 @@ pub fn viewportLiquidGlass(_: *SDLBackend, vp: *Viewport, look: platform.window.
 
 /// Where `vp`'s window is now, in the main window's part of the frame: physical pixels from the
 /// main window's top left, wherever either window has been moved since it opened.
+/// Whether `vp`'s window — its title bar's band too — lies wholly inside the main window, with the
+/// main window on the Space being shown (`viewports.mainHolds`).
+pub fn viewportMainHolds(self: *SDLBackend, vp: *const Viewport) bool {
+    if (comptime builtin.target.os.tag == .macos) if (fizzy_macos_window_off_active_space(cocoaWindow(self.window)) != 0) return false;
+    var x: c_int = 0;
+    var y: c_int = 0;
+    var w: c_int = 0;
+    var h: c_int = 0;
+    _ = c.SDL_GetWindowPosition(vp.window, &x, &y);
+    _ = c.SDL_GetWindowSize(vp.window, &w, &h);
+    var mx: c_int = 0;
+    var my: c_int = 0;
+    var mw: c_int = 0;
+    var mh: c_int = 0;
+    _ = c.SDL_GetWindowPosition(self.window, &mx, &my);
+    _ = c.SDL_GetWindowSize(self.window, &mw, &mh);
+    return x >= mx and y >= my and x + w <= mx + mw and y + h <= my + mh;
+}
+
 pub fn viewportInMain(self: *SDLBackend, vp: *const Viewport) viewport_map.Rect {
     // Where it was last put, not SDL's idea of it: on Windows it may have been moved in one step
     // behind SDL's back (`viewportPlace`), and only the app moves it.
@@ -1775,6 +1970,11 @@ fn density(self: *SDLBackend) f32 {
 /// OS keeps sending a held pointer to the window that took the press, so a view carried out of a
 /// float that is out went on landing in the float's part of the frame over the main window, and
 /// one carried from the main window never reached the float's window.
+///
+/// macOS: a pointer's motion with no button held too, when a viewport's window is in front of the
+/// one AppKit sent it to. AppKit sends mouse-moved events to the key window wherever the pointer
+/// is, and SDL reports them as that window's: hovering a float's window in front of the main one
+/// lit up the main window's widgets under it (the user).
 fn heldAcrossWindows(self: *SDLBackend, event: c.SDL_Event) bool {
     switch (event.type) {
         c.SDL_EVENT_MOUSE_MOTION => if (event.motion.which == c.SDL_TOUCH_MOUSEID) return false,
@@ -1786,7 +1986,14 @@ fn heldAcrossWindows(self: *SDLBackend, event: c.SDL_Event) bool {
     } else false;
     if (!any) return false;
     if (event.type == c.SDL_EVENT_MOUSE_BUTTON_UP) return true;
-    return c.SDL_GetGlobalMouseState(null, null) != 0;
+    if (c.SDL_GetGlobalMouseState(null, null) != 0) return true;
+    if (comptime builtin.target.os.tag == .macos) if (event.type == c.SDL_EVENT_MOUSE_MOTION) {
+        const from = c.SDL_GetWindowFromID(event.motion.windowID) orelse return false;
+        const front = fizzy_macos_window_at_pointer() orelse return false;
+        if (front == cocoaWindow(from)) return false;
+        for (&self.viewport_slots) |*slot| if (slot.*) |*vp| if (cocoaWindow(vp.window) == front) return true;
+    };
+    return false;
 }
 
 /// Where in the frame the pointer is, by the window of fizzy's it is over on the desktop: a
@@ -1811,7 +2018,7 @@ fn heldPoint(self: *SDLBackend) dvui.Point.Physical {
     // Over the viewport the press landed on, that one: where two viewports' windows overlap, the
     // OS gave the press to the one on top, which the order of the slots below does not know — a
     // press on the second of two overlapping floats' windows was read in the first's band.
-    if (self.press_window) |pw| if (self.viewportOf(pw)) |vp| if (!vp.passive and !vp.see_through) {
+    if (self.press_window) |pw| if (self.viewportOf(pw)) |vp| if (!vp.passive and !vp.see_through and !platform.window.windowUnseen(vp.window)) {
         const full = c.SDL_GetWindowFlags(vp.window) & c.SDL_WINDOW_FULLSCREEN != 0;
         const s = if (full) liveScreen(vp) else vp.screen;
         if (gx >= @as(f32, @floatFromInt(s.x)) and gy >= @as(f32, @floatFromInt(s.y)) and
@@ -1830,6 +2037,10 @@ fn heldPoint(self: *SDLBackend) dvui.Point.Physical {
     for (&self.viewport_slots) |*slot| {
         const vp = if (slot.*) |*v| v else continue;
         if (vp.passive or vp.see_through) continue;
+        // Nobody sees it, on another Space: the pointer is not over it, wherever it lies there.
+        // Read as over it, a float dragged in the main window's full screen Space vanished into the
+        // band of a window left on the desktop as it crossed where that window lies (the user).
+        if (platform.window.windowUnseen(vp.window)) continue;
         // In a fullscreen Space of its own, a window is where the OS put it, and under nothing:
         // read as under the main window, or where it was before it went, every press and release
         // in it landed over the main window — hovering worked, clicking did nothing (the user).
@@ -1925,17 +2136,19 @@ fn viewportFollowWindow(vp: *Viewport) void {
     var h: c_int = 0;
     _ = c.SDL_GetWindowPosition(vp.window, &x, &y);
     _ = c.SDL_GetWindowSize(vp.window, &w, &h);
+    // A window of the OS's own frame: its part of the frame below the title bar's band.
+    const band: f32 = if (vp.native) platform.macos_monitor.titlebarStrip(vp.window, 0, 0) else 0;
     // Standing still on its way into or out of full screen: its float goes where the picture is.
     if (platform.window.windowSpacePicture(vp.window)) |p| {
         const at: viewport_map.ScreenRect = .{
             .x = x + @as(c_int, @intFromFloat(@round(p.x))),
-            .y = y + @as(c_int, @intFromFloat(@round(p.y))),
+            .y = y + @as(c_int, @intFromFloat(@round(p.y + band))),
             .w = @intFromFloat(@round(p.w)),
-            .h = @intFromFloat(@round(p.h)),
+            .h = @intFromFloat(@round(@max(1, p.h - band))),
         };
         vp.picture_at = .{
             @intFromFloat(@max(0, @round(p.x * vp.density))),
-            @intFromFloat(@max(0, @round(p.y * vp.density))),
+            @intFromFloat(@max(0, @round((p.y + band) * vp.density))),
         };
         if (std.meta.eql(at, vp.screen)) return;
         vp.screen = at;
@@ -1943,8 +2156,9 @@ fn viewportFollowWindow(vp: *Viewport) void {
         vp.os_placed = true;
         return;
     }
-    vp.picture_at = .{ 0, 0 };
-    const now: viewport_map.ScreenRect = .{ .x = x, .y = y, .w = w, .h = h };
+    const b: c_int = @intFromFloat(@round(band));
+    vp.picture_at = .{ 0, @intFromFloat(@round(band * vp.density)) };
+    const now: viewport_map.ScreenRect = .{ .x = x, .y = y + b, .w = w, .h = @max(1, h - b) };
     // Where the app put it: its own doing, reported back.
     if (std.meta.eql(now, vp.screen)) return;
     // Placing a window is asynchronous on X11: just after the app put it somewhere, what it says
@@ -2000,7 +2214,7 @@ pub fn setCursor(self: *SDLBackend, cursor: dvui.enums.Cursor) void {
         if (new_state == false) return;
     }
 
-    const enum_int = @intFromEnum(cursor);
+    const enum_int = @backingInt(cursor);
     const tried = self.cursor_backing_tried[enum_int];
     if (!tried) {
         self.cursor_backing_tried[enum_int] = true;
@@ -2051,11 +2265,17 @@ pub fn textInputRect(self: *SDLBackend, rect: ?dvui.Rect.Natural) void {
     if (rect) |rect_frame| {
         var r = rect_frame;
         if (vp) |v| {
-            // From the frame into the viewport's window: its band offset, in points.
+            // From the frame into the viewport's window: its band offset, in points, and where its
+            // picture lies in the window (below a title band, or on its way into full screen).
             const d = c.SDL_GetWindowPixelDensity(v.window);
-            r.x -= v.frame.x / (if (d > 0) d else 1);
-            r.y -= v.frame.y / (if (d > 0) d else 1);
-        }
+            const dd = if (d > 0) d else 1;
+            r.x += (@as(f32, @floatFromInt(v.picture_at[0])) - v.frame.x) / dd;
+            r.y += (@as(f32, @floatFromInt(v.picture_at[1])) - v.frame.y) / dd;
+        } else if (self.places_main_picture) if (self.mainPicture()) |p| {
+            // The main window's frame lies at its picture (`main_picture`): below the title band.
+            r.x += p.x;
+            r.y += p.y;
+        };
         // This is the offset from r.x in window coords, supposed to be the
         // location of the cursor I think so that the IME window can be put
         // at the cursor location.  We will use 0 for now, might need to
@@ -2095,6 +2315,9 @@ pub fn deinit(self: *SDLBackend) void {
             if (slot.*) |*v| self.viewportClose(v);
         }
         self.gpu.destroy();
+        // Not followed through Spaces from here: the monitor's pump, and a block queued as a way
+        // out of full screen ended, read a window SDL had destroyed while it quit (two crashes).
+        if (comptime builtin.target.os.tag == .macos) platform.macos_monitor.unwatch(self.window);
         c.SDL_DestroyWindow(self.window);
         if (self.sdl_quit) {
             quit_signals.uninstall();
@@ -2106,13 +2329,19 @@ pub fn deinit(self: *SDLBackend) void {
 
 /// The main window shows nothing: hidden, minimized, occluded (macOS: on another Space, or wholly
 /// covered; `platform.window.windowUnseen`), or its last frame reached no drawable.
+/// Whether nobody sees this frame: the main window hidden, occluded, minimized or held, and no
+/// window of a viewport's shown it either (`viewport_seen`). A float's window in a full screen
+/// Space of its own leaves the main one on another Space, unseen: counted by it alone, every frame
+/// of the float's way slept out to a sixtieth of a second, and it ran at 56 frames a second where
+/// the main window's ran at the display's 120 (the user, measured).
 pub fn unseen(self: *SDLBackend) bool {
-    return platform.window.windowUnseen(self.window) or !self.gpu.presented;
+    return (platform.window.windowUnseen(self.window) or !self.gpu.presented) and !self.viewport_seen;
 }
 
 pub fn renderPresent(self: *SDLBackend) void {
     // First, so it runs last: after the viewports' own transaction below is committed into it.
     defer if (self.present_hook) |hook| hook(self);
+    self.viewport_seen = false;
     // macOS: a window put somewhere new this frame goes there in the transaction its picture is
     // presented in, so the two change together (`placeWindow`). Before the pictures are copied
     // into the windows, so a resized window's drawable is already its new size. A window's first
@@ -2122,11 +2351,31 @@ pub fn renderPresent(self: *SDLBackend) void {
     var transacted: [max_viewports]bool = @splat(false);
     var any = false;
     if (comptime builtin.target.os.tag == .macos) {
+        if (self.places_main_picture) {
+            var w: c_int = 0;
+            var h: c_int = 0;
+            _ = c.SDL_GetWindowSize(self.window, &w, &h);
+            if (self.main_shadow_size[0] != w or self.main_shadow_size[1] != h) {
+                self.main_shadow_size = .{ w, h };
+                self.main_shadow_frames = 2;
+            }
+            if (self.main_shadow_frames > 0) {
+                self.main_shadow_frames -= 1;
+                fizzy_macos_viewport_reshadow(cocoaWindow(self.window));
+            }
+        }
         for (&self.viewport_slots, 0..) |*slot, i| {
             const vp = if (slot.*) |*v| v else continue;
-            if (vp.app_frame and vp.shown) {
-                if (vp.shadow_size[0] != vp.screen.w or vp.shadow_size[1] != vp.screen.h) {
-                    vp.shadow_size = .{ vp.screen.w, vp.screen.h };
+            if ((vp.app_frame or vp.native) and vp.shown) {
+                // By the window's size, as the main window's: on its way into or out of full screen
+                // it stands still at that size while its picture grows (`vp.screen`), and asked to
+                // each frame of it, the window server worked the shadow of a full-screen window out
+                // again from its pixels every frame.
+                var ww: c_int = 0;
+                var wh: c_int = 0;
+                _ = c.SDL_GetWindowSize(vp.window, &ww, &wh);
+                if (vp.shadow_size[0] != ww or vp.shadow_size[1] != wh) {
+                    vp.shadow_size = .{ ww, wh };
                     vp.shadow_frames = 2;
                 }
                 if (vp.shadow_frames > 0) {
@@ -2176,7 +2425,14 @@ pub fn renderPresent(self: *SDLBackend) void {
     // a float's or a dialog's window keeps its picture until it is over. AppKit hands their layers
     // drawables back slowly while the main window goes through a Space transition, and waiting on
     // them every frame halved the move's rate with one open.
+    // Or another float's window moving itself: one left on the Space it leaves is held as the main
+    // window is (`mainHeld`). Presented into while a sibling's way ran, every frame waited on its
+    // drawable, and the moving window's way ran at 55 frames a second, the main window's at 120.
     const main_moving = platform.window.windowMovingItself(self.window);
+    var moving_vp: ?*Viewport = null;
+    for (&self.viewport_slots) |*slot| if (slot.*) |*v| if (v.shown and platform.window.windowMovingItself(v.window)) {
+        moving_vp = v;
+    };
     for (&self.viewport_slots, 0..) |*slot, i| {
         const vp = if (slot.*) |*v| v else continue;
         const target = vp.pending orelse continue;
@@ -2185,8 +2441,9 @@ pub fn renderPresent(self: *SDLBackend) void {
         // for up to a second: skipped, once it has been shown (it is created hidden, and covered
         // then by its own account).
         if (vp.shown and c.SDL_GetWindowFlags(vp.window) & (c.SDL_WINDOW_MINIMIZED | c.SDL_WINDOW_OCCLUDED) != 0) continue;
-        if (vp.shown and main_moving and !platform.window.windowMovingItself(vp.window)) continue;
+        if (vp.shown and (main_moving or moving_vp != null) and vp != moving_vp and !platform.window.windowMovingItself(vp.window)) continue;
         const presented = self.gpu.presentInto(vp.window, target, vp.picture_at);
+        if (presented and !platform.window.windowUnseen(vp.window)) self.viewport_seen = true;
         if (vp.shown) continue;
         if (presented) {
             first_frame[i] = true;
@@ -2200,13 +2457,15 @@ pub fn renderPresent(self: *SDLBackend) void {
     // others reaches the screen a composite or more after the size it was drawn for, as an edge
     // with nothing on it or a frame cut off (docs/WINDOWS_LIVE_RESIZE.md).
     self.gpu.present(self.clear_window_on_begin, builtin.target.os.tag == .windows and self.inLiveResize());
-    // Shown once there is a frame in it (or empty, above). Not made key: the window it came out of
-    // keeps the keyboard until the viewport is clicked.
+    // Shown once there is a frame in it (or empty, above). Not made key — the window it came out of
+    // keeps the keyboard until the viewport is clicked — but for a window of the OS's own frame
+    // (`.native`), which opens key, as a window an app opens does.
     for (&self.viewport_slots, first_frame, map_empty) |*slot, show, empty| {
         if (!show and !empty) continue;
         const vp = if (slot.*) |*v| v else continue;
         if (!vp.mapped) {
-            _ = c.SDL_SetHint(c.SDL_HINT_WINDOW_ACTIVATE_WHEN_SHOWN, "0");
+            // Only while the app is active: one opened behind another app's window took its keyboard.
+            _ = c.SDL_SetHint(c.SDL_HINT_WINDOW_ACTIVATE_WHEN_SHOWN, if (vp.native and appActive()) "1" else "0");
             _ = c.SDL_ShowWindow(vp.window);
             _ = c.SDL_ResetHint(c.SDL_HINT_WINDOW_ACTIVATE_WHEN_SHOWN);
             vp.mapped = true;
@@ -2234,6 +2493,9 @@ pub fn renderPresent(self: *SDLBackend) void {
             if (!vp.over_main) continue;
             vp.over_main = false;
             if (!vp.mapped or vp.passive or vp.menu) continue;
+            // An ordinary window of the app's (`ViewportFrame.native`): in front where it opened, and
+            // ordered from there as the person orders it.
+            if (vp.native) continue;
             fizzy_macos_viewport_over_main(cocoaWindow(vp.window), main_ns);
             self.stack_stale = true;
         }
@@ -2317,6 +2579,23 @@ pub fn begin(self: *SDLBackend, arena: std.mem.Allocator) !void {
     if (self.begin_hook) |hook| hook(self);
     // Its step for this frame taken (`begin_hook`): where the main window's picture is now.
     self.main_picture = if (platform.window.windowSpacePicture(self.window)) |p| .{ .x = p.x, .y = p.y, .w = p.w, .h = p.h } else null;
+    // A plain dvui app's: below the title bar, all the time (`platform.macos_monitor.titlebarStrip`).
+    if (comptime builtin.target.os.tag == .macos) if (self.places_main_picture) {
+        var p: viewport_map.Rect = self.main_picture orelse whole: {
+            var w: c_int = 0;
+            var h: c_int = 0;
+            _ = c.SDL_GetWindowSize(self.window, &w, &h);
+            break :whole .{ .w = @floatFromInt(w), .h = @floatFromInt(h) };
+        };
+        const band = platform.macos_monitor.titlebarStrip(self.window, 0, 0);
+        p.y += band;
+        p.h = @max(1, p.h - band);
+        self.main_picture = p;
+    };
+    self.gpu.window_offset = .{ 0, 0 };
+    if (self.places_main_picture) if (self.pictureInWindow()) |p| {
+        self.gpu.window_offset = .{ p.at.x, p.at.y };
+    };
     // A float's window standing still on its way into or out of full screen: its picture has
     // taken this frame's step (`begin_hook`), and the float follows it there — as it did the
     // window's moves — and back to the window as the way ends.
@@ -2335,14 +2614,15 @@ pub fn begin(self: *SDLBackend, arena: std.mem.Allocator) !void {
 /// full-screen size, the app drawn growing or shrinking in it. dvui is told the window is the
 /// picture's size (`windowSize`, `pixelSize`), the frame is laid down where the picture is
 /// (`pictureInWindow`, `core.gfx.FrameTarget`) and the pointer is read against it (`mainOnScreen`,
-/// the main window's motion). Null on no such way.
+/// the main window's motion). Null on no such way — but for a plain dvui app's window
+/// (`places_main_picture`), whose picture is always set: the window below its title band.
 fn mainPicture(self: *const SDLBackend) ?viewport_map.Rect {
     return self.main_picture;
 }
 
 /// Where the main window's frame is laid down in it this frame, physical, and all of it: its
-/// picture, while it stands still on its way into or out of full screen (`main_picture`). Null:
-/// the frame is the window.
+/// picture, while it stands still on its way into or out of full screen (`main_picture`), and
+/// always for a plain dvui app's window, below its title band. Null: the frame is the window.
 pub fn pictureInWindow(self: *SDLBackend) ?struct { at: dvui.Rect.Physical, all: dvui.Rect.Physical } {
     if (comptime builtin.target.os.tag != .macos) return null;
     const p = self.mainPicture() orelse return null;
@@ -2371,6 +2651,11 @@ fn mainHeld(self: *SDLBackend) bool {
     // Its own way into or out of full screen is drawn whatever AppKit says of it on the way.
     if (platform.window.windowMovingItself(self.window)) return false;
     if (c.SDL_GetWindowFlags(self.window) & c.SDL_WINDOW_OCCLUDED != 0) return true;
+    // On a Space nobody is looking at, as while a float's window has a full screen Space of its
+    // own: waited on there, its drawable came a second late, Metal's timeout, and the frame with it
+    // (the user, traced). Only that, not every way of being unseen: a window shown undrawn for its
+    // first frame (`showUndrawn`) is unseen too, and held, it would never draw one.
+    if (fizzy_macos_window_off_active_space(cocoaWindow(self.window)) != 0) return true;
     for (&self.viewport_slots) |*slot| {
         const vp = if (slot.*) |*v| v else continue;
         if (vp.shown and platform.window.windowMovingItself(vp.window)) return true;
@@ -2659,7 +2944,7 @@ comptime {
 }
 
 fn touchButton(slot: u4) dvui.enums.Button {
-    return @enumFromInt(@intFromEnum(dvui.enums.Button.touch0) + @as(u8, slot));
+    return @fromBackingInt(@intCast(@backingInt(dvui.enums.Button.touch0) + @as(u8, slot)));
 }
 
 /// Lift every finger the window will not hear lift: it lost focus, is going to the background or
@@ -2985,16 +3270,16 @@ pub fn SDL_keymod_to_dvui(keymod: u16) dvui.enums.Mod {
     if (keymod == if (sdl3) c.SDL_KMOD_NONE else c.KMOD_NONE) return dvui.enums.Mod.none;
 
     var m: u16 = 0;
-    if (keymod & (if (sdl3) c.SDL_KMOD_LSHIFT else c.KMOD_LSHIFT) > 0) m |= @intFromEnum(dvui.enums.Mod.lshift);
-    if (keymod & (if (sdl3) c.SDL_KMOD_RSHIFT else c.KMOD_RSHIFT) > 0) m |= @intFromEnum(dvui.enums.Mod.rshift);
-    if (keymod & (if (sdl3) c.SDL_KMOD_LCTRL else c.KMOD_LCTRL) > 0) m |= @intFromEnum(dvui.enums.Mod.lcontrol);
-    if (keymod & (if (sdl3) c.SDL_KMOD_RCTRL else c.KMOD_RCTRL) > 0) m |= @intFromEnum(dvui.enums.Mod.rcontrol);
-    if (keymod & (if (sdl3) c.SDL_KMOD_LALT else c.KMOD_LALT) > 0) m |= @intFromEnum(dvui.enums.Mod.lalt);
-    if (keymod & (if (sdl3) c.SDL_KMOD_RALT else c.KMOD_RALT) > 0) m |= @intFromEnum(dvui.enums.Mod.ralt);
-    if (keymod & (if (sdl3) c.SDL_KMOD_LGUI else c.KMOD_LGUI) > 0) m |= @intFromEnum(dvui.enums.Mod.lcommand);
-    if (keymod & (if (sdl3) c.SDL_KMOD_RGUI else c.KMOD_RGUI) > 0) m |= @intFromEnum(dvui.enums.Mod.rcommand);
+    if (keymod & (if (sdl3) c.SDL_KMOD_LSHIFT else c.KMOD_LSHIFT) > 0) m |= @backingInt(dvui.enums.Mod.lshift);
+    if (keymod & (if (sdl3) c.SDL_KMOD_RSHIFT else c.KMOD_RSHIFT) > 0) m |= @backingInt(dvui.enums.Mod.rshift);
+    if (keymod & (if (sdl3) c.SDL_KMOD_LCTRL else c.KMOD_LCTRL) > 0) m |= @backingInt(dvui.enums.Mod.lcontrol);
+    if (keymod & (if (sdl3) c.SDL_KMOD_RCTRL else c.KMOD_RCTRL) > 0) m |= @backingInt(dvui.enums.Mod.rcontrol);
+    if (keymod & (if (sdl3) c.SDL_KMOD_LALT else c.KMOD_LALT) > 0) m |= @backingInt(dvui.enums.Mod.lalt);
+    if (keymod & (if (sdl3) c.SDL_KMOD_RALT else c.KMOD_RALT) > 0) m |= @backingInt(dvui.enums.Mod.ralt);
+    if (keymod & (if (sdl3) c.SDL_KMOD_LGUI else c.KMOD_LGUI) > 0) m |= @backingInt(dvui.enums.Mod.lcommand);
+    if (keymod & (if (sdl3) c.SDL_KMOD_RGUI else c.KMOD_RGUI) > 0) m |= @backingInt(dvui.enums.Mod.rcommand);
 
-    return @as(dvui.enums.Mod, @enumFromInt(m));
+    return @as(dvui.enums.Mod, @fromBackingInt(@intCast(m)));
 }
 
 pub fn SDL_keysym_to_dvui(keysym: i32) dvui.enums.Key {
@@ -3182,7 +3467,7 @@ const SdlLogPriorityType = blk: {
     const Opt = @typeInfo(c.SDL_LogOutputFunction);
     const FnPtr = if (Opt == .optional) @typeInfo(Opt.optional.child) else Opt;
     const FnT = @typeInfo(FnPtr.pointer.child).@"fn";
-    break :blk FnT.params[2].type.?;
+    break :blk FnT.param_types[2].?;
 };
 
 fn sdlLogCallback(userdata: ?*anyopaque, category: c_int, priority: SdlLogPriorityType, message: [*c]const u8) callconv(.c) void {
@@ -3332,7 +3617,9 @@ pub fn main(main_init: std.process.Init) !u8 {
         .org = init_opts.org,
         .icon = init_opts.icon,
         .hidden = init_opts.hidden,
-        .transparent = init_opts.transparent,
+        // Clear on macOS, over the backdrop a plain dvui app's window is dressed with
+        // (`platform.window.nativeTitleBar`): SDL fills an opaque window's view with black.
+        .transparent = init_opts.transparent or builtin.target.os.tag == .macos,
         .persist_window_geometry = init_opts.persist_window_geometry,
         .pref_path = init_opts.pref_path,
     });
@@ -3373,7 +3660,12 @@ pub fn main(main_init: std.process.Init) !u8 {
         // send all SDL events to dvui for processing
         try back.addAllEvents(&win);
 
+        // As `appIterate`: the floating windows in OS windows of their own, and a plain dvui app's
+        // main window dressed.
+        os_windows.beforeFrame();
         const res = try app.frameFn();
+        os_windows.afterFrame();
+        if (!platform.window.app_dresses_windows) back.dressPlainWindows();
 
         var end_micros = try win.end(.{});
         Health.current.frameEnd(c.SDL_GetTicksNS());
@@ -3479,7 +3771,9 @@ fn appInit(appstate: ?*?*anyopaque, argc: c_int, argv: ?[*:null]?[*:0]u8) callco
         .org = init_opts.org,
         .icon = init_opts.icon,
         .hidden = init_opts.hidden,
-        .transparent = init_opts.transparent,
+        // Clear on macOS, over the backdrop a plain dvui app's window is dressed with
+        // (`platform.window.nativeTitleBar`): SDL fills an opaque window's view with black.
+        .transparent = init_opts.transparent or builtin.target.os.tag == .macos,
         .persist_window_geometry = init_opts.persist_window_geometry,
         .pref_path = init_opts.pref_path,
     }) catch |err| {
@@ -3521,6 +3815,13 @@ fn appInit(appstate: ?*?*anyopaque, argc: c_int, argv: ?[*:null]?[*:0]u8) callco
             return c.SDL_APP_FAILURE;
         };
     }
+    // Through Spaces, zooms and live resizes, each step drawn in time with the window: for an app
+    // that has not installed it itself, with its own chrome, as fizzy does (`restoreWindowState`).
+    if (comptime builtin.target.os.tag == .macos) if (appState.back.begin_hook == null) {
+        appState.back.places_main_picture = true;
+        platform.macos_monitor.install(&appState.win, true);
+        platform.macos_monitor.launchComplete();
+    };
 
     return c.SDL_APP_CONTINUE;
 }
@@ -3620,6 +3921,9 @@ fn appIterate(_: ?*anyopaque) callconv(.c) c.SDL_AppResult {
         return c.SDL_APP_FAILURE;
     };
     os_windows.afterFrame();
+    // A plain dvui app's main window: the OS's own title bar, in the theme's colour. Fizzy's own
+    // windows are dressed by fizzy (`platform.window.setStyle`), which says so.
+    if (!platform.window.app_dresses_windows) appState.back.dressPlainWindows();
 
     live_resize_trace.overlay();
 
diff --git a/backend/src/os_windows.zig b/backend/src/os_windows.zig
index 7a2549d55..28011923e 100644
--- a/backend/src/os_windows.zig
+++ b/backend/src/os_windows.zig
@@ -1,25 +1,29 @@
-//! `dvui.osWindow` on this backend: each is a floating window in the one frame (dvui's fallback,
-//! as this backend makes no `dvui.Window` of its own for one), shown in an OS window of its own
-//! (`viewports`) that looks just as it does inside the main window — dvui's header and close
-//! button, no OS title bar (`Frame.app`). The app writes plain dvui; on a backend without OS
-//! windows the same floating window stays in the main window.
+//! dvui's floating windows on this backend — `dvui.osWindow`'s too, as this backend makes no
+//! `dvui.Window` of its own for one — each in the one frame, shown in an OS window of its own
+//! (`viewports`): the OS's own title bar — the window's title, its buttons, moving, resizing, full
+//! screen — in the theme's colour, and the floating window's content below it (`Frame.native`).
+//! The app writes plain dvui; on a backend without OS windows, or past `max_outs`, the same
+//! floating window stays in the main window, with dvui's own header and close button. Modal
+//! dialogs stay in the window they are over.
 //!
-//! dvui says which floating windows are OS windows as they draw (`named`, from
-//! `SDLBackend.osWindowFloating`). Around the app's frame (`SDLBackend.appIterate`, or an app's
-//! own loop):
+//! dvui asks as each begins whether it is in an OS window (`named`, from
+//! `SDLBackend.floatingWindowOs`), and its `windowHeader` hands that window its title (`titled`).
+//! The window the OS makes key is the one dvui's keyboard goes to (`beforeFrame`). Around the
+//! app's frame (`SDLBackend.appIterate`, or an app's own loop):
 //!
-//! - `beforeFrame`: a window the OS moved takes its floating window with it (`osPlaced`), and each
-//!   window's band is a screen of dvui's (`dvui.screensSet`), so dvui keeps the floating window in
-//!   it; one being resized holds the pointer in its band (`pinPointer`);
+//! - `beforeFrame`: each floating window takes its window's place and size, the OS's to change —
+//!   moved, resized, zoomed, full screen — never the other way, and each window's band is a screen
+//!   of dvui's (`dvui.screensSet`), so dvui keeps what opens in it there;
 //! - `afterFrame`: dvui's dialogs and toasts made (`Window.drawRetained`); a window whose floating
 //!   window was not drawn — closed — goes; each one named and not yet in a window gets one over
 //!   where it is (`viewports.open`), drawn in that window's band from the next frame; and each
-//!   window is put where its floating window is (`viewports.place`), told its header is where the
-//!   OS moves it from (`hints`), and handed its picture: every subwindow in its band, taken out of
-//!   the frame (`viewports.Picture`).
+//!   window is handed its picture: every subwindow in its band, taken out of the frame
+//!   (`viewports.Picture`). The OS's close clears the app's `open_flag`, as dvui's close button
+//!   would.
 //!
-//! dvui keeps where each floating window is (`_rect` in its data, by its id): moved into the
-//! window's band, and read back after the frame.
+//! dvui keeps where each floating window is (`_rect` in its data, by its id): set each frame to its
+//! window's part of the frame, in that window's band.
+const std = @import("std");
 const dvui = @import("dvui");
 const viewports = @import("viewports.zig");
 
@@ -33,27 +37,174 @@ const Out = struct {
     target: ?dvui.Texture.Target = null,
     /// Opened this frame: drawn in the main window still, in its band from the next.
     fresh: bool = true,
+    /// Its window's title, and least and most size (natural), as last given it.
+    title: [64:0]u8 = @splat(0),
+    min: dvui.Size = .{},
+    max: dvui.Size = .{},
 };
 var outs: [max_outs]?Out = @splat(null);
 
-/// The floating windows dvui named as OS windows this frame (`named`), with their headers
-/// (physical) and titles.
-const Named = struct { id: dvui.Id, header: dvui.Rect.Physical, title: [64:0]u8 };
+/// The floating windows dvui named as OS windows this frame (`named`), with their titles
+/// (`titled`), the flags their windows' close clears, and their least and most sizes.
+const Named = struct {
+    id: dvui.Id,
+    title: [64:0]u8 = @splat(0),
+    open_flag: ?*bool,
+    min: dvui.Size,
+    max: dvui.Size,
+    shown: bool = false,
+    /// Drawn as an OS window's, without dvui's frame or header, but no window opened for it yet:
+    /// one being torn off (`frameless`).
+    hold: bool = false,
+};
 var named_list: [max_outs]Named = undefined;
 var named_n: usize = 0;
 
-/// The pointer is pinned to a window's band by `beforeFrame`, to be let go once nothing holds it.
-var pinned = false;
-
-/// dvui drew floating window `id` for an OS window this frame (`dvui.osWindow`), moved by `header`.
-pub fn named(id: dvui.Id, header: dvui.Rect.Physical, title: ?[:0]const u8) void {
-    if (named_n == named_list.len) return;
-    var n: Named = .{ .id = id, .header = header, .title = @splat(0) };
-    const t = title orelse "";
-    const len = @min(t.len, n.title.len);
-    @memcpy(n.title[0..len], t[0..len]);
-    named_list[named_n] = n;
+/// The floating window that has the keyboard, as last read from the OS's key window: null for the
+/// main window's own subwindow.
+var keyed: ?dvui.Id = null;
+
+/// A floating window dragged by its header past every window of the app's (`tearFrame`) becomes a
+/// small card of itself at the pointer, in a carry window (`viewports.openCarry`): its header gone,
+/// its content live. Let go over the desktop, the card grows to its window's size where it opens,
+/// a title bar's place opening at its top (`Grow`), and it is in an OS window of its own there
+/// (`torn`), its content under the OS's title bar where the card's was. Moved by the OS wholly back
+/// into the main window, the window shrinks into its place there, dvui's header for the OS's title
+/// bar (`Merge`). A card, not the floating window at its size made up as an OS window: it never
+/// could look like one, and became one with a jump; a card that changes into the window is a change
+/// it shows (the user). dvui says nothing of a drag, so it is read from what dvui shows: the
+/// floating window that has the mouse, its rect moving while its size stays — moved by its header,
+/// not resized from an edge. Over another of the app's windows the held pointer already takes it
+/// into that window (`SDLBackend.heldPoint`).
+const Tear = struct {
+    id: dvui.Id,
+    /// Where on it the pointer took it, from its top left (physical, at its size).
+    grab: dvui.Point.Physical,
+    /// Its rect last frame (physical): moved at the same size, it is being moved.
+    last: dvui.Rect.Physical,
+    moving: bool = false,
+    /// When it went past the app's windows: drawn without its header from the frame after
+    /// (`frameless`), and shrinking into the card from then (`shrink_ns`).
+    out_ns: ?i128 = null,
+    /// Its picture this frame, at its size, without its header: what the card shows.
+    live: ?dvui.Texture.Target = null,
+    card: ?*viewports.Viewport = null,
+    card_target: ?dvui.Texture.Target = null,
+    /// The card this frame, in the main window's frame (physical); null over a window of the app's.
+    place: ?dvui.Rect.Physical = null,
+    /// The app's window it was last over, brought forward as it came over it.
+    over: ?*anyopaque = null,
+};
+var tear: ?Tear = null;
+
+/// The floating window drawn without its header — as an OS window's is — though it has no window
+/// yet (`named`, `titled`): the one being torn off, past the app's windows or growing into its own.
+var frameless: ?dvui.Id = null;
+
+/// Whether floating window `id` is drawn without its header though it has no window yet
+/// (`frameless`): `SDLBackend.floatingWindowOs` answers for it as for an OS window's.
+pub fn heldFrameless(id: dvui.Id) bool {
+    return frameless == id;
+}
+
+/// The card growing into the window let go over the desktop (`tearFrame`): from where it was to the
+/// window's frame, a title bar's place opening at its top, the window asked for as it gets there,
+/// and the card gone once that window shows.
+const Grow = struct {
+    id: dvui.Id,
+    card: *viewports.Viewport,
+    card_target: ?dvui.Texture.Target,
+    live: ?dvui.Texture.Target,
+    from: dvui.Rect.Physical,
+    /// The window's frame (physical): its title bar's band over its content.
+    to: dvui.Rect.Physical,
+    band: f32,
+    start_ns: i128,
+    /// The window asked for (`tearOff`), once the card has grown.
+    asked: bool = false,
+};
+var grow: ?Grow = null;
+
+/// A torn-off window moved wholly back into the main window (`beforeFrame`): its last picture
+/// shrinking from the window's frame to the floating window's place, the OS's title bar's band
+/// becoming dvui's header's, then the floating window there.
+const Merge = struct {
+    id: dvui.Id,
+    card: *viewports.Viewport,
+    card_target: ?dvui.Texture.Target = null,
+    snap: dvui.Texture.Target,
+    from: dvui.Rect.Physical,
+    band: f32,
+    to: dvui.Rect.Physical,
+    header: f32,
+    start_ns: i128,
+};
+var merge: ?Merge = null;
+
+/// How long the card takes to grow into its window, or a window to shrink back into the main one,
+/// and the floating window to shrink into the card as it goes past the app's windows.
+const grow_ns: i128 = 200 * std.time.ns_per_ms;
+const shrink_ns: i128 = 150 * std.time.ns_per_ms;
+/// The card: half its window's size, and no wider than this (natural).
+const card_scale: f32 = 0.5;
+const card_max_w: f32 = 360;
+
+/// The height of dvui's header (`dvui.windowHeader`: the heading font's line and its padding),
+/// physical: what the OS's title bar takes the place of.
+fn headerHeight() f32 {
+    return (dvui.Font.theme(.heading).lineHeight() + 10) * dvui.windowNaturalScale();
+}
+
+/// Torn off the window it was in by a drop over no window (`tearFrame`): shown in an OS window
+/// though it did not ask (`SDLBackend.floatingWindowOs`), opened where it was let go (`at`, once).
+/// Its window closed, it is an ordinary floating window again.
+const Torn = struct { id: dvui.Id, at: ?dvui.Rect.Physical };
+var torn_list: [max_outs]?Torn = @splat(null);
+
+/// Whether floating window `id` was torn off into an OS window of its own (`tearFrame`).
+pub fn torn(id: dvui.Id) bool {
+    for (torn_list) |slot| if (slot) |t| if (t.id == id) return true;
+    return false;
+}
+
+/// A window failed to open (no viewport left, or the OS refused one): none is promised (`named`)
+/// until one closes. Promised and never opened, a floating window stayed frameless in the main
+/// window, unmovable and unclosable.
+var open_failed = false;
+
+/// Floating window `id` begins: whether it is shown in an OS window of its own — it has one, or one
+/// can open for it — so dvui draws it without a frame of its own. Its window sized by the OS no
+/// smaller than `min` and no larger than `max` (natural).
+pub fn named(id: dvui.Id, open_flag: ?*bool, min: dvui.Size, max: dvui.Size) bool {
+    if (named_n == named_list.len) return false;
+    // An OS window has a close button, and only `open_flag` closes a floating window: one without
+    // stays in the main window, where dvui gives it no close button either.
+    if (open_flag == null) return false;
+    // One that will open: room in `outs` past those already asked for this frame, and viewports.
+    var free: usize = 0;
+    for (outs) |slot| free += @intFromBool(slot == null);
+    var waiting: usize = 0;
+    for (named_list[0..named_n]) |w| waiting += @intFromBool(w.shown and outOf(w.id) == null);
+    // Being torn off: as an OS window's, though none opens for it until it is let go (`frameless`).
+    const hold = frameless == id and outOf(id) == null and !torn(id);
+    const shown = hold or outOf(id) != null or (viewports.available() and !open_failed and waiting < free);
+    named_list[named_n] = .{ .id = id, .open_flag = open_flag, .min = min, .max = max, .shown = shown, .hold = hold };
     named_n += 1;
+    return shown;
+}
+
+/// `windowHeader` in floating window `id`: its title, for its OS window's title bar. Whether it has
+/// one (`named`), and the header draws nothing.
+pub fn titled(id: dvui.Id, header: []const u8) bool {
+    for (named_list[0..named_n]) |*w| if (w.id == id) {
+        // Cut at a character, never inside one: the OS takes the title as UTF-8.
+        var len = @min(header.len, w.title.len - 1);
+        while (len > 0 and len < header.len and header[len] & 0xC0 == 0x80) len -= 1;
+        @memcpy(w.title[0..len], header[0..len]);
+        w.title[len] = 0;
+        return w.shown;
+    };
+    return false;
 }
 
 fn natural(r: viewports.Rect, s: f32) dvui.Rect {
@@ -68,33 +219,335 @@ fn physical(r: dvui.Rect, s: f32) viewports.Rect {
 pub fn beforeFrame() void {
     named_n = 0;
     const s = dvui.windowNaturalScale();
-    var screens: [max_outs]dvui.Rect.Natural = undefined;
-    var n: usize = 0;
-    var pin: ?*viewports.Viewport = null;
     for (&outs) |*slot| {
         const o = if (slot.*) |*o| o else continue;
-        if (viewports.osPlaced(o.viewport)) |fr| dvui.dataSet(null, o.id, "_rect", natural(fr, s));
-        _ = viewports.osMoveEnded(o.viewport);
-        const r = dvui.dataGet(null, o.id, "_rect", dvui.Rect) orelse continue;
-        screens[n] = .{ .x = r.x, .y = r.y, .w = r.w, .h = r.h };
-        n += 1;
-        // Resized from its edges, it holds the pointer: read in its band till it lets go, even
-        // past its window's edge.
-        if (dvui.captured(o.id)) pin = o.viewport;
+        // Where its window is, and its size: the OS's — moved, resized, zoomed, full screen — and
+        // never the other way. Not grown to fit what it holds, as dvui sizes a floating window
+        // while its content changes (`_auto_size`).
+        _ = viewports.osPlaced(o.viewport);
+        // Torn off, and moved by the OS wholly into the main window: back in it, where it was let
+        // go, as a floating window of its own again (`torn`). Wholly, so a window only overlapping
+        // the main one stays a window.
+        if (viewports.osMoveEnded(o.viewport)) |end| if (!end.resized and torn(o.id) and viewports.mainHolds(o.viewport)) {
+            const content = viewports.inMain(o.viewport);
+            dvui.dataSet(null, o.id, "_rect", natural(content, s));
+            for (&torn_list) |*ts| if (ts.*) |tt| if (tt.id == o.id) {
+                ts.* = null;
+            };
+            // Shrinking into its place from its window, its last picture in a card over it
+            // (`Merge`); or there at once where no card can be made.
+            const band = viewports.titleBand();
+            const c: dvui.Rect.Physical = .{ .x = content.x, .y = content.y, .w = content.w, .h = content.h };
+            const from: dvui.Rect.Physical = .{ .x = c.x, .y = c.y - band, .w = c.w, .h = c.h + band };
+            if (merge == null and o.target != null and viewports.tears()) if (viewports.openCarry(viewRect(from))) |card| {
+                merge = .{ .id = o.id, .card = card, .snap = o.target.?, .from = from, .band = band, .to = c, .header = headerHeight(), .start_ns = dvui.currentWindow().frame_time_ns };
+                o.target = null;
+            };
+            viewports.close(o.viewport);
+            if (o.target) |t| t.destroyLater();
+            slot.* = null;
+            open_failed = false;
+            dvui.refresh(null, @src(), null);
+            continue;
+        };
+        dvui.dataSet(null, o.id, "_rect", natural(viewports.frameOf(o.viewport), s));
+        dvui.dataSet(null, o.id, "_auto_size", false);
+    }
+    viewports.publishScreens(park(s));
+    // The OS made another window key — clicked, or opened — so dvui's keyboard goes there: to its
+    // floating window, or the main window's own subwindow. Only as the key window changes, so a
+    // click in the main window that focuses one of its own floating windows stands.
+    if (viewports.appActive()) {
+        var key: ?dvui.Id = null;
+        for (outs) |slot| if (slot) |o| if (viewports.hasKeyboard(o.viewport)) {
+            key = o.id;
+        };
+        if (key != keyed) {
+            keyed = key;
+            dvui.focusSubwindow(key orelse dvui.currentWindow().data().id, null);
+            if (key) |id| dvui.raiseSubwindow(id);
+        }
+    }
+}
+
+/// A floating window shown only as a card (`Tear` past the app's windows, `Grow`) parked where
+/// nothing else is in the frame — left of the main window, as far as the bands are right of it — on
+/// a screen of dvui's of its own: dvui clips it to that screen, which is itself, and keeps it there.
+/// Where it was, dvui clipped it to the main window wherever its middle was over it — just past the
+/// window's edge, and growing into its window (the user). The card is placed by the pointer, not by
+/// where the floating window is. Set before the app draws; the screen, for `publishScreens`.
+fn park(s: f32) ?dvui.Rect.Natural {
+    const id = if (grow) |g| g.id else if (tear) |t| if (t.out_ns != null) t.id else return null else return null;
+    // Its window opened: in that window's band from here (`beforeFrame`), its first picture there.
+    if (outOf(id) != null) return null;
+    const r = dvui.dataGet(null, id, "_rect", dvui.Rect) orelse return null;
+    const at: dvui.Rect.Natural = .{ .x = -viewports.band_stride / s, .y = 0, .w = r.w, .h = r.h };
+    dvui.dataSet(null, id, "_rect", dvui.Rect{ .x = at.x, .y = at.y, .w = at.w, .h = at.h });
+    return at;
+}
+
+fn viewRect(r: dvui.Rect.Physical) viewports.Rect {
+    return .{ .x = r.x, .y = r.y, .w = r.w, .h = r.h };
+}
+
+/// The floating window being dragged this frame, if any, as a card past the app's windows (`Tear`),
+/// and a card growing into its window (`Grow`) or a window shrinking back (`Merge`). After the app
+/// has drawn, so its rect and drawing are this frame's.
+fn tearFrame() void {
+    if (!viewports.tears()) return;
+    const cw = dvui.currentWindow();
+    growFrame(cw);
+    mergeFrame(cw);
+    const held = viewports.pointerHeld();
+    var dragged: ?*dvui.Subwindows.Subwindow = null;
+    if (held) if (dvui.captureMouseGet()) |cm| for (cw.subwindows.stack.items) |*sw| {
+        if (sw.id != cm.id or !sw.used or sw.modal or sw.id == cw.data().id or outOf(sw.id) != null) continue;
+        dragged = sw;
+        break;
+    };
+    const sw = dragged orelse {
+        if (tear) |*t| {
+            if (!held and t.place != null and t.live != null and t.card != null and grow == null) {
+                // Let go over the desktop: the card grows into the window, its content where the
+                // floating window's would be under the pointer, its title bar's band over it.
+                const r = t.last;
+                const mouse = viewports.pointerInMain();
+                const band = viewports.titleBand();
+                const content: dvui.Rect.Physical = .{ .x = mouse.x - t.grab.x, .y = mouse.y - t.grab.y, .w = r.w, .h = r.h };
+                grow = .{
+                    .id = t.id,
+                    .card = t.card.?,
+                    .card_target = t.card_target,
+                    .live = t.live.?,
+                    .from = t.place.?,
+                    .to = .{ .x = content.x, .y = content.y - band, .w = content.w, .h = content.h + band },
+                    .band = band,
+                    .start_ns = cw.frame_time_ns,
+                };
+                t.card = null;
+                t.card_target = null;
+                t.live = null;
+                dvui.refresh(null, @src(), null);
+            } else if (frameless == t.id) frameless = null;
+            endTear(t);
+            tear = null;
+        }
+        return;
+    };
+    const r = sw.rect_pixels;
+    const mouse = cw.mouse_pt;
+    if (tear == null or tear.?.id != sw.id) {
+        if (tear) |*t| endTear(t);
+        tear = .{ .id = sw.id, .grab = .{ .x = mouse.x - r.x, .y = mouse.y - r.y }, .last = r };
+        return;
+    }
+    const t = &tear.?;
+    if (r.w != t.last.w or r.h != t.last.h) {
+        t.moving = false;
+    } else if (r.x != t.last.x or r.y != t.last.y) {
+        t.moving = true;
+    }
+    t.last = r;
+    // The app's window it is over in front, to show where it would land (the user): once, as it
+    // comes over each.
+    const over = viewports.windowAtPointer();
+    if (t.moving and over != t.over) if (over) |w| viewports.bringForward(w);
+    t.over = over;
+    if (!t.moving or over != null) {
+        // In a window of the app's: drawn there, as dvui draws it, its header back — from where the
+        // pointer took it, back over a window: dvui kept it at the edge it left by (`screenFor`)
+        // while the pointer went on, and it came back that far from the pointer (the user).
+        if (t.out_ns != null) {
+            const s = dvui.windowNaturalScale();
+            dvui.dataSet(null, t.id, "_rect", dvui.Rect{ .x = (mouse.x - t.grab.x) / s, .y = (mouse.y - t.grab.y) / s, .w = r.w / s, .h = r.h / s });
+            dvui.refresh(null, @src(), null);
+        }
+        t.out_ns = null;
+        if (frameless == t.id) frameless = null;
+        if (t.card) |c| viewports.carryShape(c, null, 0);
+        t.place = null;
+        return;
+    }
+    if (t.out_ns == null) {
+        // Past them: drawn without its header from the next frame, and the card from then. This
+        // frame as dvui drew it, header and all.
+        t.out_ns = cw.frame_time_ns;
+        frameless = t.id;
+        dvui.refresh(null, @src(), null);
+        return;
+    }
+    // Its picture without its header, at its size, taken out of the window dvui keeps it at the
+    // edge of (`screenFor`): there only at the pointer, as the card.
+    if (!livePicture(&t.live, sw)) return;
+    const ns = dvui.windowNaturalScale();
+    const small = @min(card_scale, card_max_w * ns / @max(1, r.w));
+    // From its size into the card, round the pointer, its header's place closing up as it goes.
+    const k = ease(cw.frame_time_ns - t.out_ns.?, shrink_ns);
+    const scale = 1 + (small - 1) * k;
+    if (k < 1) dvui.refresh(null, @src(), null);
+    // Where the pointer is on the desktop, in the main window's frame: a floating window pressed in
+    // another OS window's band was read in that band (`SDLBackend.heldPoint`), and its card and its
+    // window went a band's width off — 32,000 points — and back on screen as macOS put them (the user,
+    // traced).
+    const at = viewports.pointerInMain();
+    const card = whole(.{ .x = at.x - t.grab.x * scale, .y = at.y - t.grab.y * scale, .w = r.w * scale, .h = r.h * scale });
+    if (t.card == null) t.card = viewports.openCarry(viewRect(card)) orelse return;
+    drawCard(t.card.?, &t.card_target, t.live.?, card, headerHeight() * (1 - k) * scale, scale);
+    t.place = card;
+}
+
+/// `sw`'s drawing this frame into `slot`'s target at its size, taken out of the frame: smoothly
+/// sampled, for a card that shrinks it (sampled by the nearest pixel, its text crawled as the card
+/// moved, the user). Whether there is a picture.
+fn livePicture(slot: *?dvui.Texture.Target, sw: *dvui.Subwindows.Subwindow) bool {
+    const r = sw.rect_pixels;
+    const w: u32 = @intFromFloat(@max(1, @round(r.w)));
+    const h: u32 = @intFromFloat(@max(1, @round(r.h)));
+    if (slot.*) |target| if (target.width != w or target.height != h) {
+        target.destroyLater();
+        slot.* = null;
+    };
+    if (slot.* == null) slot.* = dvui.textureCreateTarget(.{ .width = w, .height = h, .interpolation = .linear }) catch return false;
+    const picture: viewports.Picture = .begin(slot.*.?, viewRect(r));
+    dvui.currentWindow().renderSubwindow(sw, .{ .take = true });
+    picture.end();
+    return true;
+}
+
+/// A card in carry window `card` at `at` (the main window's frame, physical): the window's colour,
+/// a band of it `strip` high at its top — a title bar's or a header's place — and `content` under
+/// it at the card's width; its corners the window's at `scale`.
+fn drawCard(card: *viewports.Viewport, card_target: *?dvui.Texture.Target, content: dvui.Texture.Target, at: dvui.Rect.Physical, strip: f32, scale: f32) void {
+    const placed = viewports.placeMain(card, viewRect(at));
+    const shown: dvui.Rect.Physical = .{ .x = placed.x, .y = placed.y, .w = placed.w, .h = placed.h };
+    viewports.carryShape(card, viewports.windowRadius() * dvui.windowNaturalScale() * scale, 1);
+    const w: u32 = @intFromFloat(@max(1, @round(shown.w)));
+    const h: u32 = @intFromFloat(@max(1, @round(shown.h)));
+    const target = viewports.sizedTarget(card_target, w, h) orelse return;
+    const picture: viewports.Picture = .begin(target, viewRect(shown));
+    {
+        const prev_clip = dvui.clipGet();
+        defer dvui.clipSet(prev_clip);
+        dvui.clipSet(shown);
+        shown.fill(.all(0), .{ .color = .{ .color = dvui.themeGet().color(.window, .fill) } });
+        if (dvui.Texture.fromTargetTemp(content)) |tex| {
+            const k = at.w / @max(1, @as(f32, @floatFromInt(content.width)));
+            const r: dvui.Rect.Physical = .{ .x = at.x, .y = @round(at.y + strip), .w = at.w, .h = @as(f32, @floatFromInt(content.height)) * k };
+            dvui.renderTexture(tex, .{ .r = r, .s = 1 }, .{}) catch {};
+        } else |_| {}
+    }
+    picture.end();
+    viewports.present(card, target);
+}
+
+/// The card growing into the window let go over the desktop (`Grow`): eased from where it was to
+/// the window's frame, the title bar's band opening at its top, the window asked for as it gets
+/// there, and the card gone once that window shows. The floating window, drawn without its header
+/// meanwhile (`frameless`), nowhere but in the card.
+fn growFrame(cw: *dvui.Window) void {
+    const g = if (grow) |*g| g else return;
+    var drawn = false;
+    for (cw.subwindows.stack.items) |*sw| if (sw.id == g.id) {
+        drawn = true;
+        if (outOf(sw.id)) |o| {
+            if (o.fresh) viewports.Picture.drop(sw);
+        } else _ = livePicture(&g.live, sw);
+    };
+    // Given up: the floating window closed on its way, or no window opened for it in a second past
+    // the card's growing (none to spare, or one it cannot have: no `open_flag` to close it by). The
+    // card goes, and the floating window is an ordinary one again; kept, the card stayed and every
+    // frame asked for the next.
+    if (!drawn or (g.asked and outOf(g.id) == null and cw.frame_time_ns - g.start_ns > grow_ns + std.time.ns_per_s)) {
+        endGrow(g);
+        return;
     }
-    // Only with windows of its own: an app keeping screens of its own (fizzy's floats) sets them.
-    if (n > 0) dvui.screensSet(screens[0..n]);
-    if (pin) |vp| {
-        viewports.pinPointer(.{ .viewport = vp });
-        pinned = true;
-    } else if (pinned) {
-        viewports.pinPointer(.none);
-        pinned = false;
+    const live = g.live orelse return;
+    const k = ease(cw.frame_time_ns - g.start_ns, grow_ns);
+    const at = whole(lerp(g.from, g.to, k));
+    const scale = at.w / @max(1, g.to.w);
+    drawCard(g.card, &g.card_target, live, at, g.band * k * scale, scale);
+    if (k >= 1 and !g.asked) {
+        g.asked = true;
+        tearOff(g.id, .{ .x = g.to.x, .y = g.to.y + g.band, .w = g.to.w, .h = g.to.h - g.band });
     }
+    // Its window on screen: the card goes, and the window is where it was.
+    if (outOf(g.id)) |o| if (!o.fresh and viewports.shown(o.viewport)) {
+        endGrow(g);
+        return;
+    };
+    dvui.refresh(null, @src(), null);
+}
+
+fn endGrow(g: *Grow) void {
+    viewports.close(g.card);
+    if (g.card_target) |ct| ct.destroyLater();
+    if (g.live) |live| live.destroyLater();
+    if (frameless == g.id) frameless = null;
+    // Asked for and never opened: not torn off after all.
+    if (outOf(g.id) == null) for (&torn_list) |*ts| if (ts.*) |tt| if (tt.id == g.id) {
+        ts.* = null;
+    };
+    grow = null;
+    dvui.refresh(null, @src(), null);
+}
+
+/// A torn-off window shrinking back into the main window (`Merge`): its last picture eased from the
+/// window's frame to the floating window's place, the OS's title bar's band becoming dvui's
+/// header's; the floating window drawn nowhere meanwhile, and there as the card goes.
+fn mergeFrame(cw: *dvui.Window) void {
+    const m = if (merge) |*m| m else return;
+    const k = ease(cw.frame_time_ns - m.start_ns, grow_ns);
+    if (k >= 1) {
+        viewports.close(m.card);
+        if (m.card_target) |ct| ct.destroyLater();
+        m.snap.destroyLater();
+        merge = null;
+        return;
+    }
+    for (cw.subwindows.stack.items) |*sw| if (sw.id == m.id) viewports.Picture.drop(sw);
+    const at = whole(lerp(m.from, m.to, k));
+    drawCard(m.card, &m.card_target, m.snap, at, m.band + (m.header - m.band) * k, 1);
+    dvui.refresh(null, @src(), null);
+}
+
+fn lerp(a: dvui.Rect.Physical, b: dvui.Rect.Physical, k: f32) dvui.Rect.Physical {
+    return .{ .x = a.x + (b.x - a.x) * k, .y = a.y + (b.y - a.y) * k, .w = a.w + (b.w - a.w) * k, .h = a.h + (b.h - a.h) * k };
+}
+
+/// How far `elapsed` is through `total`, eased out (cubic), 0 to 1.
+fn ease(elapsed: i128, total: i128) f32 {
+    const t: f32 = @floatCast(std.math.clamp(@as(f64, @floatFromInt(elapsed)) / @as(f64, @floatFromInt(total)), 0, 1));
+    return 1 - (1 - t) * (1 - t) * (1 - t);
+}
+
+/// `r` on whole pixels: a card at a fraction of one was drawn a little differently each frame,
+/// and shimmered as it moved.
+fn whole(r: dvui.Rect.Physical) dvui.Rect.Physical {
+    return .{ .x = @round(r.x), .y = @round(r.y), .w = @round(r.w), .h = @round(r.h) };
+}
+
+fn endTear(t: *Tear) void {
+    if (t.card) |c| viewports.close(c);
+    if (t.card_target) |target| target.destroyLater();
+    if (t.live) |live| live.destroyLater();
+    t.card = null;
+    t.card_target = null;
+    t.live = null;
+}
+
+/// Floating window `id` in an OS window of its own from the next frame, opened at `at` (the main
+/// window's frame, physical) rather than where dvui keeps it, at the window's edge.
+fn tearOff(id: dvui.Id, at: dvui.Rect.Physical) void {
+    for (&torn_list) |*slot| if (slot.* == null) {
+        slot.* = .{ .id = id, .at = at };
+        dvui.refresh(null, @src(), null);
+        return;
+    };
 }
 
 /// After the app's frame, before `dvui.Window.end`.
 pub fn afterFrame() void {
+    tearFrame();
     if (named_n == 0 and for (outs) |slot| {
         if (slot != null) break false;
     } else true) return;
@@ -116,11 +569,16 @@ pub fn afterFrame() void {
         }
         viewports.close(o.viewport);
         if (o.target) |t| t.destroyLater();
+        // Closed: an ordinary floating window again, next time it shows.
+        for (&torn_list) |*ts| if (ts.*) |tt| if (tt.id == o.id) {
+            ts.* = null;
+        };
         slot.* = null;
+        open_failed = false;
     }
 
     for (named_list[0..named_n]) |*w| {
-        if (outOf(w.id) != null) continue;
+        if (!w.shown or w.hold or outOf(w.id) != null) continue;
         if (!viewports.available()) break;
         const slot = for (&outs) |*slot| {
             if (slot.* == null) break slot;
@@ -131,8 +589,17 @@ pub fn afterFrame() void {
         // which would take it out of its window's band again.
         if (r.w < 1 or r.h < 1) continue;
         if (dvui.dataGet(null, w.id, "_auto_pos", bool) orelse true) continue;
-        const vp = viewports.open(physical(r, s), &w.title, .app) orelse break;
-        slot.* = .{ .id = w.id, .viewport = vp };
+        // Torn off: where it was let go.
+        var at = physical(r, s);
+        for (&torn_list) |*ts| if (ts.*) |*tt| if (tt.id == w.id) if (tt.at) |a| {
+            at = viewRect(a);
+            tt.at = null;
+        };
+        const vp = viewports.open(at, &w.title, .native) orelse {
+            open_failed = true;
+            break;
+        };
+        slot.* = .{ .id = w.id, .viewport = vp, .title = w.title };
         dvui.dataSet(null, w.id, "_rect", natural(viewports.frameOf(vp), s));
         dvui.refresh(null, @src(), null);
     }
@@ -143,31 +610,44 @@ pub fn afterFrame() void {
             o.fresh = false;
             continue;
         }
-        const r = dvui.dataGet(null, o.id, "_rect", dvui.Rect) orelse continue;
-        const shown = viewports.place(o.viewport, physical(r, s));
-        // The OS moves its window by its header, but for the close button — square at the
-        // header's height, at its right end where buttons go OK then Cancel, else its left
-        // (`dvui.windowHeader`) — and not from the floating window's own resize zones round its
-        // edge (`app_side`).
-        if (namedOf(o.id)) |w| {
-            const hd = w.header;
-            const keep_x = if (cw.button_order == .ok_cancel) hd.x + hd.w - hd.h else hd.x;
-            viewports.hints(o.viewport, .{
-                .drag = .{ .x = hd.x, .y = hd.y, .w = hd.w, .h = hd.h },
-                .keep = .{ .x = keep_x, .y = hd.y, .w = hd.h, .h = hd.h },
-                .glass = shown,
-                .edge = 0,
-                .app_side = 6 * s,
-                .app_corner = 15 * s,
-            });
+        // Its window's part of the frame: the floating window was given it (`beforeFrame`), and
+        // anything it did to its own size this frame is not handed back to the window.
+        const shown = viewports.frameOf(o.viewport);
+        // Its window's close: as the floating window's close button would, and gone next frame.
+        if (viewports.closeRequested(o.viewport)) if (namedOf(o.id)) |w| if (w.open_flag) |of| {
+            of.* = false;
+            dvui.refresh(null, @src(), null);
+        };
+        if (namedOf(o.id)) |n| {
+            if (!std.mem.eql(u8, &n.title, &o.title)) {
+                o.title = n.title;
+                viewports.setTitle(o.viewport, std.mem.sliceTo(&o.title, 0));
+            }
+            // The OS resizes it, within what the floating window allows — dvui's demo is no wider
+            // than 600, and its window maximizes no wider. Not what its content needs, which
+            // changes as it is resized (a pane collapsing) and fought the person.
+            if (!std.meta.eql(n.min, o.min)) {
+                o.min = n.min;
+                viewports.minSize(o.viewport, n.min.w * s, n.min.h * s);
+            }
+            if (!std.meta.eql(n.max, o.max)) {
+                o.max = n.max;
+                // None each way it has none (`dvui.max_float_safe`).
+                const none = dvui.max_float_safe;
+                viewports.maxSize(o.viewport, if (n.max.w >= none) 0 else n.max.w * s, if (n.max.h >= none) 0 else n.max.h * s);
+            }
         }
         const w: u32 = @intFromFloat(@max(1, @round(shown.w)));
         const h: u32 = @intFromFloat(@max(1, @round(shown.h)));
-        const target = viewports.sizedTarget(&o.target, w, h) orelse continue;
+        const target = viewports.keptTarget(o.viewport, &o.target, w, h) orelse continue;
         const area: dvui.Rect.Physical = .{ .x = shown.x, .y = shown.y, .w = shown.w, .h = shown.h };
         const picture: viewports.Picture = .begin(target, shown);
+        // Every subwindow over any of its part of the frame: the parts are a band apart, so one
+        // overlaps one at most. By its middle, a floating window larger than the window it was
+        // dragged into — dvui keeps it on that window's screen from its top left, the rest past the
+        // edge — had its middle past the part, was in no window's picture, and vanished (the user).
         for (cw.subwindows.stack.items) |*sw| {
-            if (area.contains(sw.rect_pixels.center())) dvui.currentWindow().renderSubwindow(sw, .{ .take = true });
+            if (!area.intersect(sw.rect_pixels).empty()) dvui.currentWindow().renderSubwindow(sw, .{ .take = true });
         }
         picture.end();
         viewports.present(o.viewport, target);
diff --git a/backend/src/platform/dialogs.zig b/backend/src/platform/dialogs.zig
index c800f95c9..fbb9ab3c1 100644
--- a/backend/src/platform/dialogs.zig
+++ b/backend/src/platform/dialogs.zig
@@ -182,7 +182,7 @@ fn GenericDialogCallback(cb: ?*anyopaque, files: [*c]const [*c]const u8, mode: D
     };
     var allocated: usize = 0;
     for (0..path_count) |i| {
-        zig_files[i] = alloc().dupeZ(u8, std.mem.span(files[i])) catch {
+        zig_files[i] = alloc().dupeSentinel(u8, std.mem.span(files[i]), 0) catch {
             dvui.log.err("Failed to dupe dialog result path", .{});
             for (zig_files[0..allocated]) |f| alloc().free(f);
             alloc().free(zig_files);
diff --git a/backend/src/platform/geometry.zig b/backend/src/platform/geometry.zig
index ab5276119..e40da2221 100644
--- a/backend/src/platform/geometry.zig
+++ b/backend/src/platform/geometry.zig
@@ -73,9 +73,12 @@ fn fileLoad(_: ?*anyopaque) ?Geometry {
     const gpa = std.heap.page_allocator;
     const data = std.Io.Dir.cwd().readFileAlloc(file_io, path, gpa, .limited(4096)) catch return null;
     defer gpa.free(data);
-    const z = gpa.dupeZ(u8, data) catch return null;
+    const z = gpa.dupeSentinel(u8, data, 0) catch return null;
     defer gpa.free(z);
-    const g = std.zon.parse.fromSlice(Geometry, gpa, z, null, .{ .ignore_unknown_fields = true }) catch return null;
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const g = std.zon.parse.fromSliceNoAlloc(Geometry, .{ .gpa = gpa, .arena = arena.allocator(), .source = z, .diagnostics = &diag, .ignore_unknown_fields = true }) catch return null;
     return if (g.valid()) g else null;
 }
 
@@ -131,7 +134,7 @@ pub fn capture(win: *dvui.Window) ?Geometry {
     switch (builtin.target.os.tag) {
         .macos => {
             const cocoa = cocoaWindowOf(win.backend.impl.window) orelse return null;
-            var out4: [4]f64 = .{0} ** 4;
+            var out4: [4]f64 = @splat(0);
             // The windowed frame — the one it had before a fullscreen Space, while it is in one.
             fizzy_macos_window_current_windowed_frame(cocoa, &out4);
             const g: Geometry = .{ .x = out4[0], .y = out4[1], .w = out4[2], .h = out4[3] };
diff --git a/backend/src/platform/linux_titlebar.zig b/backend/src/platform/linux_titlebar.zig
index 2b45246f3..5a7a61f91 100644
--- a/backend/src/platform/linux_titlebar.zig
+++ b/backend/src/platform/linux_titlebar.zig
@@ -64,6 +64,15 @@ pub fn frameInsets(window: *c.SDL_Window) Insets {
     return .{};
 }
 
+/// Whether the compositor blurs behind `window` at all (`blurBehind`), asking nothing of it: for
+/// the window materials the backend offers (`SDLBackend.materialKinds`).
+pub fn blurOffered(window: *c.SDL_Window) bool {
+    if (comptime builtin.target.os.tag != .linux) return false;
+    const props = c.SDL_GetWindowProperties(window);
+    const display = c.SDL_GetPointerProperty(props, c.SDL_PROP_WINDOW_WAYLAND_DISPLAY_POINTER, null) orelse return false;
+    return wayland_blur.offered(display);
+}
+
 /// The desktop's blur behind the window's frame (`wayland_blur`), inside the margin its shadow is
 /// drawn in (`frameInsets`), its corners rounded by `radius` points — or none, null. Whether the
 /// compositor blurs behind windows at all: Wayland with `ext-background-effect-v1` (GNOME 51,
diff --git a/backend/src/platform/macos/visual_effect_view.m b/backend/src/platform/macos/visual_effect_view.m
index 13a8a5a2b..ebd3ba7c4 100644
--- a/backend/src/platform/macos/visual_effect_view.m
+++ b/backend/src/platform/macos/visual_effect_view.m
@@ -1,5 +1,6 @@
 #import <AppKit/AppKit.h>
 #import <QuartzCore/CAGradientLayer.h>
+#import <QuartzCore/CAMetalLayer.h>
 #import <QuartzCore/CAShapeLayer.h>
 #import <QuartzCore/CATransaction.h>
 
@@ -107,6 +108,21 @@ - (NSView *)hitTest:(NSPoint)point {
 }
 @end
 
+/* A plain dvui app's window's backdrop (`fizzy_macos_window_plain_backdrop`): the window's colour
+ * under SDL's view, with the window's corners, in a window otherwise clear — the part of the window
+ * that follows its picture on its way into or out of full screen, as glass does
+ * (`fizzy_macos_window_glass_follow`). */
+@interface FizzyPlainBackdropView : NSView
+@property double radius;
+@end
+
+@implementation FizzyPlainBackdropView
+- (NSView *)hitTest:(NSPoint)point {
+    (void)point;
+    return nil;
+}
+@end
+
 /*
  * A float popped out of the main window into a window of its own (fizzy's viewports): its glass
  * shows the desktop behind it through vibrancy, as the main window's chrome does, so the float's
@@ -175,6 +191,49 @@ void fizzy_macos_viewport_plain(void *nswindow) {
     }
 }
 
+/* No show or close animation for `nswindow` (`viewportDress`): a window of the OS's own frame
+ * (`SDLBackend.ViewportFrame.native`), dressed by nothing else of fizzy's. */
+void fizzy_macos_viewport_still(void *nswindow) {
+    NSWindow *window = (__bridge NSWindow *)nswindow;
+    if (window != nil) [window setAnimationBehavior:NSWindowAnimationBehaviorNone];
+}
+
+/* Whether `nswindow` is shown on a Space other than the one the person is looking at
+ * (`SDLBackend.mainHeld`). */
+int fizzy_macos_window_off_active_space(void *nswindow) {
+    NSWindow *window = (__bridge NSWindow *)nswindow;
+    return window != nil && [window isVisible] && ![window isOnActiveSpace] ? 1 : 0;
+}
+
+/* The app's window the pointer is over, the front one where several are, of those that take the
+ * pointer: shown, on the Space being shown, not click-through (`SDLBackend.windowAtPointer`); null
+ * over none. Not the window in front under the pointer (`fizzy_macos_window_at_pointer`): a
+ * tear-off's card follows the pointer, and asked that, the card — or the glass the OS puts with it —
+ * answered, none of the app's ordinary windows, and the pointer read as over the desktop over a
+ * window of the app's (the user, traced). */
+void *fizzy_macos_app_window_at_pointer(void) {
+    const NSPoint p = [NSEvent mouseLocation];
+    for (NSWindow *w in [NSApp orderedWindows]) {
+        if (![w isVisible] || ![w isOnActiveSpace] || [w ignoresMouseEvents]) continue;
+        if (NSPointInRect(p, [w frame])) return (__bridge void *)w;
+    }
+    return NULL;
+}
+
+/* `nswindow` in front of the app's other windows, not made key: a window a drag is over
+ * (`os_windows`' tear-off), brought forward to show where it would land. */
+void fizzy_macos_window_bring_forward(void *nswindow) {
+    NSWindow *w = (__bridge NSWindow *)nswindow;
+    if (w != nil) [w orderFront:nil];
+}
+
+/* The app's window in front under the pointer, or nil where another app's is
+ * (`SDLBackend.heldAcrossWindows`). */
+void *fizzy_macos_window_at_pointer(void) {
+    const NSInteger n = [NSWindow windowNumberAtPoint:[NSEvent mouseLocation] belowWindowWithWindowNumber:0];
+    return (__bridge void *)[NSApp windowWithWindowNumber:n];
+}
+
 void fizzy_macos_viewport_reshadow(void *nswindow) {
     @autoreleasepool {
         NSWindow *window = (__bridge NSWindow *)nswindow;
@@ -1452,6 +1511,111 @@ static BOOL windowGlassPicture(NSWindow *window, NSRect *in_frame_view, double *
 /* The glass behind a float's window — its vibrancy, or its Liquid Glass — where the float is drawn:
  * only where its picture is while the window stands still on its way into or out of full screen,
  * all of the window otherwise. Each step of the way, and as it ends. */
+/* `nswindow` made a plain dvui app's (`SDLBackend.titleBand`): clear, SDL's Metal layer too, over a
+ * backdrop of `r`,`g`,`b` with corners of `radius` points — square in full screen. Again with a new
+ * colour as the theme changes. */
+static void make_layers_clear(NSView *view) {
+    if ([view.layer isKindOfClass:[CAMetalLayer class]]) view.layer.opaque = NO;
+    for (NSView *sub in view.subviews) make_layers_clear(sub);
+}
+
+/* Whether `nswindow` has the backdrop in its colour (`fizzy_macos_window_plain_backdrop`). */
+int fizzy_macos_window_has_plain_backdrop(void *nswindow) {
+    NSWindow *window = (__bridge NSWindow *)nswindow;
+    NSView *frame = [[window contentView] superview];
+    for (NSView *v in [frame subviews]) {
+        if ([v isKindOfClass:[FizzyPlainBackdropView class]]) return 1;
+    }
+    return 0;
+}
+
+void fizzy_macos_window_plain_backdrop(void *nswindow, double r, double g, double b, double radius) {
+    @autoreleasepool {
+        NSWindow *window = (__bridge NSWindow *)nswindow;
+        NSView *content = [window contentView];
+        NSView *frame = [content superview];
+        if (window == nil || content == nil || frame == nil) return;
+        if ([window isOpaque]) [window setOpaque:NO];
+        [window setBackgroundColor:[NSColor clearColor]];
+        /* The OS's shadow, and the 1-point outline that comes with it round a titled window: SDL
+         * makes a transparent window without one (`viewportDress`). */
+        if (![window hasShadow]) [window setHasShadow:YES];
+        make_layers_clear(content);
+        FizzyPlainBackdropView *backdrop = nil;
+        for (NSView *v in [frame subviews]) {
+            if ([v isKindOfClass:[FizzyPlainBackdropView class]]) backdrop = (FizzyPlainBackdropView *)v;
+        }
+        if (backdrop == nil) {
+            backdrop = [[FizzyPlainBackdropView alloc] initWithFrame:[frame bounds]];
+            /* Layer-hosting: its layer its own, which AppKit does not redraw over. */
+            [backdrop setLayer:[CALayer layer]];
+            [backdrop setWantsLayer:YES];
+            [backdrop setAutoresizingMask:NSViewWidthSizable | NSViewHeightSizable];
+            [frame addSubview:backdrop positioned:NSWindowBelow relativeTo:content];
+#if !__has_feature(objc_arc)
+            /* Held by the frame view now; this file is built without ARC. */
+            [backdrop release];
+#endif
+        }
+        backdrop.radius = radius;
+        [CATransaction begin];
+        [CATransaction setDisableActions:YES];
+        CGColorRef color = CGColorCreateSRGB(r, g, b, 1);
+        backdrop.layer.backgroundColor = color;
+        CGColorRelease(color);
+        const BOOL full = ([window styleMask] & NSWindowStyleMaskFullScreen) != 0;
+        backdrop.layer.cornerRadius = full ? 0 : radius;
+        backdrop.layer.masksToBounds = NO;
+        [CATransaction commit];
+        [window invalidateShadow];
+    }
+}
+
+/* The OS's shadow and 1-point outline round a titled window, drawn by the backdrop's own layer
+ * while `on` (`fizzy_macos_window_glass_follow`): a soft shadow below it, and an outline light on a
+ * dark window and dark on a light one. */
+static void backdropFrame(CALayer *layer, BOOL on, double radius, NSWindow *window) {
+    if (!on) {
+        if (layer.shadowOpacity != 0) layer.shadowOpacity = 0;
+        if (layer.borderWidth != 0) layer.borderWidth = 0;
+        return;
+    }
+    const BOOL dark = [[[window effectiveAppearance] bestMatchFromAppearancesWithNames:@[ NSAppearanceNameAqua, NSAppearanceNameDarkAqua ]] isEqualToString:NSAppearanceNameDarkAqua];
+    layer.masksToBounds = NO;
+    layer.shadowColor = CGColorGetConstantColor(kCGColorBlack);
+    layer.shadowOpacity = dark ? 0.6f : 0.35f;
+    layer.shadowRadius = 20;
+    layer.shadowOffset = CGSizeMake(0, -10);
+    CGPathRef path = CGPathCreateWithRoundedRect(layer.bounds, radius, radius, NULL);
+    layer.shadowPath = path;
+    CGPathRelease(path);
+    CGColorRef edge = CGColorCreateSRGB(dark ? 1 : 0, dark ? 1 : 0, dark ? 1 : 0, dark ? 0.18 : 0.22);
+    layer.borderColor = edge;
+    CGColorRelease(edge);
+    layer.borderWidth = 1;
+}
+
+/* SDL's view clipped to `picture` (in the frame view), rounded by `radius`, on a still window's way
+ * into or out of full screen; unclipped otherwise (`picture` empty). The OS rounds a window's
+ * content to its corners, but on that way the window is the screen's size and the picture only part
+ * of it: the picture's square corners stood past the backdrop's rounded ones (the user). */
+static void clip_content(NSView *content, NSView *frame, NSRect picture, double radius) {
+    if (NSIsEmptyRect(picture)) {
+        if (content.layer.mask != nil) content.layer.mask = nil;
+        return;
+    }
+    if (![content wantsLayer]) [content setWantsLayer:YES];
+    CAShapeLayer *mask = [content.layer.mask isKindOfClass:[CAShapeLayer class]] ? (CAShapeLayer *)content.layer.mask : nil;
+    if (mask == nil) {
+        mask = [CAShapeLayer layer];
+        content.layer.mask = mask;
+    }
+    mask.frame = content.layer.bounds;
+    CGPathRef path = CGPathCreateWithRoundedRect(NSRectToCGRect([frame convertRect:picture toView:content]), radius, radius, NULL);
+    mask.path = path;
+    CGPathRelease(path);
+}
+
 void fizzy_macos_window_glass_follow(void *nswindow) {
     @autoreleasepool {
         NSWindow *window = (__bridge NSWindow *)nswindow;
@@ -1459,10 +1623,35 @@ void fizzy_macos_window_glass_follow(void *nswindow) {
         NSView *frame = [content superview];
         if (content == nil || frame == nil) return;
         NSRect picture;
-        const BOOL still = windowGlassPicture(window, &picture, NULL);
+        double fullness = 0;
+        const BOOL still = windowGlassPicture(window, &picture, &fullness);
         [CATransaction begin];
         [CATransaction setDisableActions:YES];
+        const BOOL full = ([window styleMask] & NSWindowStyleMaskFullScreen) != 0;
         for (NSView *v in [frame subviews]) {
+            if ([v isKindOfClass:[FizzyPlainBackdropView class]]) {
+                /* The window's shape where the window is, through its way: its corners until it
+                 * stands at full screen. */
+                FizzyPlainBackdropView *backdrop = (FizzyPlainBackdropView *)v;
+                const NSRect want = still ? picture : [frame bounds];
+                if (!NSEqualRects([v frame], want)) [v setFrame:want];
+                /* Its corners square as it goes into full screen and round as it comes out, with its
+                 * picture (`fullness`), not at either end. */
+                const double radius = still ? backdrop.radius * (1.0 - fmin(fmax(fullness, 0.0), 1.0)) : (full ? 0 : backdrop.radius);
+                if (v.layer.cornerRadius != radius) v.layer.cornerRadius = radius;
+                clip_content(content, frame, still ? picture : NSZeroRect, radius);
+                /* The OS's shadow and outline again once it is out: AppKit's style changes on the
+                 * way turned them off (the user). */
+                if (!full && !still) {
+                    if (![window hasShadow]) [window setHasShadow:YES];
+                    [window invalidateShadow];
+                }
+                /* On its way into or out of full screen the window is the screen's size, and the OS
+                 * draws no shadow or outline round a full-screen window: the backdrop draws them
+                 * round itself, where the window seems to be, until it lands and the OS's are back. */
+                backdropFrame(v.layer, still, radius, window);
+                continue;
+            }
             if (![v isKindOfClass:[FizzyViewportGlassView class]]) continue;
             const NSRect want = still ? picture : [content frame];
             if (!NSEqualRects([v frame], want)) [v setFrame:want];
diff --git a/backend/src/platform/macos/window_monitor.m b/backend/src/platform/macos/window_monitor.m
index 48abcc21d..c5ea1db64 100644
--- a/backend/src/platform/macos/window_monitor.m
+++ b/backend/src/platform/macos/window_monitor.m
@@ -308,7 +308,11 @@ static void pump_tick_inner(void) {
         if (m->exit_origin_until > CACurrentMediaTime()) {
             restore_pre_fullscreen_origin_if_nudged((__bridge NSWindow *)m->window);
         }
-        if (m->anim_active) step_space_animation(m);
+        /* Not a still window's: its picture moves only in the app's frames
+         * (`fizzy_macos_window_space_step`), and stepped here between them too, its backdrop ran
+         * ahead of a picture drawn late — a frame of its own round the float, a band (the user,
+         * while recording the screen slowed the frames). */
+        if (m->anim_active && !m->still) step_space_animation(m);
         hold_landing(m);
         fizzy_macos_window_sync_content_views(m->window);
         fizzy_macos_window_pump_sync(m->window);
@@ -876,6 +880,9 @@ void fizzy_macos_window_space_stage(int stage, void *nswindow) {
             break;
         case 1: // didEnter
             finish_space_animation(m);
+            /* Its backdrop square, its corners the screen's: however it got here — AppKit's own way
+             * in, Split View — and not only the monitor's own animation. */
+            fizzy_macos_window_glass_follow(win);
             /* Full screen in AppKit's eyes from here: its frame view square now, not at whatever
              * next asks for a layout (`still_frame_square`). */
             if (m->still) relayout_frame((__bridge NSWindow *)win);
@@ -896,6 +903,8 @@ void fizzy_macos_window_space_stage(int stage, void *nswindow) {
             break;
         case 3: // didExit
             finish_space_animation(m);
+            /* Its corners back, however it came out: AppKit's own way out of Split View too. */
+            fizzy_macos_window_glass_follow(win);
             m->space_transition = NO;
             m->space_entering = NO;
             m->unzoom_animating = NO;
diff --git a/backend/src/platform/macos_monitor.zig b/backend/src/platform/macos_monitor.zig
index 9bf665b28..2cb2d59c4 100644
--- a/backend/src/platform/macos_monitor.zig
+++ b/backend/src/platform/macos_monitor.zig
@@ -378,7 +378,12 @@ export fn fizzy_macos_origin_nudged(cap_x: f64, cap_y: f64, cur_x: f64, cur_y: f
 /// here answers from AppKit's own state, and the window only keeps its content under the title bar
 /// through SDL's styles, for fizzy's chrome (`styleTitled`): without that it came back from each
 /// round trip a title bar shorter.
-pub fn install(win: *dvui.Window) void {
+///
+/// `still`: the window stands still at its full-screen size on its way into or out of full screen,
+/// its picture growing or shrinking in it (as a float's window, `watch`) — for an app whose frame
+/// the backend lays down where the picture is (`SDLBackend.places_main_picture`). Otherwise only a
+/// window of Liquid Glass does.
+pub fn install(win: *dvui.Window, still: bool) void {
     if (comptime builtin.target.os.tag != .macos) return;
     const back = win.backend.impl;
     const cocoa = cocoaWindowOf(back.window) orelse return;
@@ -388,6 +393,7 @@ pub fn install(win: *dvui.Window) void {
     back.present_hook = macosAppPresented;
     addWatched(.{ .window = back.window, .cocoa = cocoa, .follow_position = false });
     fizzy_macos_window_install_resize_observer(cocoa);
+    if (still) fizzy_macos_window_space_still(cocoa);
     // Draw each step of a live resize from inside it, presented with the Core Animation
     // transaction that resizes the window, so the new size and the frame drawn for it reach the
     // screen together (fizzy's SDL patches 0003-0004, `docs/MACOS_LIVE_RESIZE.md`). By name,
@@ -429,6 +435,13 @@ pub fn unwatch(window: *c.SDL_Window) void {
     if (comptime builtin.target.os.tag != .macos) return;
     const cocoa = cocoaWindowOf(window) orelse return;
     fizzy_macos_window_uninstall_monitor(cocoa);
+    // The main window, as the app quits: the pump's tick reads it without asking for its monitor
+    // (`fizzy_macos_window_pump_render`), and one more tick while SDL quits would draw into a
+    // window it has destroyed.
+    if (macos_monitor_window == window) {
+        macos_monitor_window = null;
+        macos_pump_ready = false;
+    }
     for (&watched) |*slot| {
         if (slot.*) |w| if (w.cocoa == cocoa) {
             slot.* = null;
@@ -461,8 +474,33 @@ pub const TitlebarState = struct {
 };
 
 pub fn titlebarState(win: *dvui.Window) TitlebarState {
+    return titlebarStateOf(win.backend.impl.window);
+}
+
+/// The band at the top of `window` its content keeps clear of the traffic lights, points: no less
+/// than `top_buffer` and `titlebar_height` — an app's own header (fizzy's) — and AppKit's title
+/// bar; `top_buffer` alone in a fullscreen Space; closing up and opening again with the window's
+/// way into and out of one. 0 and 0 for a plain dvui app's window, the band under the OS's title
+/// bar (`SDLBackend.places_main_picture`). `titlebar_height` off macOS.
+pub fn titlebarStrip(window: *c.SDL_Window, titlebar_height: f32, top_buffer: f32) f32 {
+    if (comptime builtin.target.os.tag != .macos) return titlebar_height;
+    const t = titlebarStateOf(window);
+    const in: window_layout.StripInputs = .{
+        .collapsed = t.collapsed,
+        .restoring_chrome = t.restoring_chrome,
+        .live_inset = t.live_inset,
+        .saved_inset = t.saved_inset,
+        .titlebar_height = titlebar_height,
+        .titlebar_top_buffer = top_buffer,
+    };
+    if (@import("window.zig").windowSpaceFullness(window)) |f| return window_layout.titlebarStripAtFullness(in, f);
+    return window_layout.chooseTitlebarStrip(in);
+}
+
+/// `titlebarState` of any watched window: the main one, or one of the OS's own frame.
+pub fn titlebarStateOf(window: *c.SDL_Window) TitlebarState {
     if (comptime builtin.target.os.tag != .macos) return .{};
-    const raw_ptr = cocoaWindowOf(win.backend.impl.window);
+    const raw_ptr = cocoaWindowOf(window);
     const inset = if (raw_ptr != null) fizzy_macos_window_titlebar_inset(raw_ptr) else 0;
     const saved = fizzy_macos_window_saved_titlebar_inset(raw_ptr);
     return .{
diff --git a/backend/src/platform/menu.zig b/backend/src/platform/menu.zig
index df41db01a..a75be5918 100644
--- a/backend/src/platform/menu.zig
+++ b/backend/src/platform/menu.zig
@@ -115,13 +115,13 @@ pub export fn FizzyMenuEnabled(section: c_int, tag: c_int) callconv(.c) bool {
     const h = hooks orelse return true;
     if (h.input_blocked(h.ctx)) return false;
     if (section < 0 or section > 2 or tag < 0) return true;
-    return h.enabled(h.ctx, .{ .section = @enumFromInt(section), .tag = @intCast(tag) });
+    return h.enabled(h.ctx, .{ .section = @fromBackingInt(@intCast(section)), .tag = @intCast(tag) });
 }
 
 pub export fn FizzyMenuTitle(section: c_int, tag: c_int) callconv(.c) ?[*:0]const u8 {
     const h = hooks orelse return null;
     if (section < 0 or section > 2 or tag < 0) return null;
-    return h.title(h.ctx, .{ .section = @enumFromInt(section), .tag = @intCast(tag) });
+    return h.title(h.ctx, .{ .section = @fromBackingInt(@intCast(section)), .tag = @intCast(tag) });
 }
 
 pub export fn FizzyMenuInputBlocked() callconv(.c) bool {
@@ -142,7 +142,7 @@ fn nsString(text: [*:0]const u8) objc.Object {
 
 /// A sentinel copy of `text` for AppKit, from the platform allocator; free with `freeZ`.
 fn dupeZ(text: []const u8) ?[:0]u8 {
-    return dialogs.allocator().dupeZ(u8, text) catch null;
+    return dialogs.allocator().dupeSentinel(u8, text, 0) catch null;
 }
 
 fn setImage(item: objc.Object, symbol: [*:0]const u8, description: [*:0]const u8) void {
@@ -398,7 +398,7 @@ fn applyKey(item: objc.Object, key: ?[]const u8, modifiers: c_ulong) void {
 
 /// The item chosen in `section` since the last call, if one was. Call once a frame, inside it.
 pub fn pollActivation(section: Section) ?Activation {
-    const tag = pending_tag[@intFromEnum(section)].swap(-1, .acq_rel);
+    const tag = pending_tag[@backingInt(section)].swap(-1, .acq_rel);
     if (tag < 0) return null;
     return .{
         .ref = .{ .section = section, .tag = @intCast(tag) },
diff --git a/backend/src/platform/wayland_blur.zig b/backend/src/platform/wayland_blur.zig
index ad95efbcc..a6e07a5e2 100644
--- a/backend/src/platform/wayland_blur.zig
+++ b/backend/src/platform/wayland_blur.zig
@@ -24,6 +24,14 @@ pub const Want = struct {
     radius: f32,
 };
 
+/// Whether the compositor blurs behind windows at all, as `behind` would say, setting nothing.
+pub fn offered(display: *anyopaque) bool {
+    if (comptime builtin.target.os.tag != .linux) return false;
+    const s = ready(display) orelse return false;
+    _ = s.lib.display_dispatch_queue_pending(s.display, s.queue);
+    return (s.effect_manager != null and s.effect_blur) or s.kde_manager != null;
+}
+
 /// Blur behind `surface` (a `wl_surface` of `display`, SDL's) as `want` says, or none: whether
 /// the compositor blurs behind windows at all — it has one of the protocols, and its blur is on.
 /// Cheap to call every frame: the region is sent only when it changes. The first call binds the
@@ -118,9 +126,9 @@ fn load() ?Lib {
     // SDL's own copy, already loaded for the window: never a second one.
     const handle = std.c.dlopen("libwayland-client.so.0", .{ .LAZY = true, .NOLOAD = true }) orelse return null;
     var lib: Lib = undefined;
-    inline for (@typeInfo(Lib).@"struct".fields) |f| {
-        const sym = std.c.dlsym(handle, "wl_" ++ f.name) orelse return null;
-        @field(lib, f.name) = @ptrCast(@alignCast(sym));
+    inline for (@typeInfo(Lib).@"struct".field_names, @typeInfo(Lib).@"struct".field_types, @typeInfo(Lib).@"struct".field_attrs) |f_name, _, _| {
+        const sym = std.c.dlsym(handle, "wl_" ++ f_name) orelse return null;
+        @field(lib, f_name) = @ptrCast(@alignCast(sym));
     }
     return lib;
 }
diff --git a/backend/src/platform/win32_titlebar.zig b/backend/src/platform/win32_titlebar.zig
index cf018c495..95c6ef737 100644
--- a/backend/src/platform/win32_titlebar.zig
+++ b/backend/src/platform/win32_titlebar.zig
@@ -53,7 +53,7 @@ pub fn applyChrome(win: *dvui.Window) void {
 
         _ = win32.graphics.dwm.DwmSetWindowAttribute(
             hwnd_h,
-            @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @enumFromInt(DWMWA_WINDOW_CORNER_PREFERENCE)),
+            @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @fromBackingInt(@intCast(DWMWA_WINDOW_CORNER_PREFERENCE))),
             &DWMWCP_ROUND,
             @sizeOf(u32),
         );
@@ -75,7 +75,7 @@ pub fn applyChrome(win: *dvui.Window) void {
     const backdrop_type: u32 = DWMSBT_TRANSIENTWINDOW;
     _ = win32.graphics.dwm.DwmSetWindowAttribute(
         hwnd_h,
-        @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @enumFromInt(DWMWA_SYSTEMBACKDROP_TYPE)),
+        @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @fromBackingInt(@intCast(DWMWA_SYSTEMBACKDROP_TYPE))),
         &backdrop_type,
         @sizeOf(u32),
     );
@@ -108,12 +108,50 @@ pub fn setDarkMode(win: *dvui.Window, dark: bool) void {
     const value: u32 = @intFromBool(dark);
     _ = win32.graphics.dwm.DwmSetWindowAttribute(
         @as(win32.foundation.HWND, @ptrCast(hwnd)),
-        @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @enumFromInt(DWMWA_USE_IMMERSIVE_DARK_MODE)),
+        @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @fromBackingInt(@intCast(DWMWA_USE_IMMERSIVE_DARK_MODE))),
         &value,
         @sizeOf(u32),
     );
 }
 
+/// The OS's caption on `window`, in `color` with its title in `text`, light or dark as the theme
+/// is (`window.nativeTitleBar`). Caption and text colours are Windows 11's; earlier, DWM's own.
+/// A window of the OS's own frame with a most size (`viewports.maxSize`) has no maximize button, as a
+/// Windows app with one has none: `SW_MAXIMIZE`, the button and a double-click on the caption fill
+/// the screen past the most SDL keeps a drag to. Given back once it has no most.
+pub fn allowMaximize(window: *c.SDL_Window, allow: bool) void {
+    if (comptime builtin.target.os.tag != .windows) return;
+    const raw = c.SDL_GetPointerProperty(c.SDL_GetWindowProperties(window), c.SDL_PROP_WINDOW_WIN32_HWND_POINTER, null) orelse return;
+    const h: win32.foundation.HWND = @ptrCast(raw);
+    const wm = win32.ui.windows_and_messaging;
+    const ws_maximizebox: isize = 0x00010000;
+    const style = wm.GetWindowLongPtrW(h, wm.GWL_STYLE);
+    const want = if (allow) style | ws_maximizebox else style & ~ws_maximizebox;
+    if (want == style) return;
+    _ = wm.SetWindowLongPtrW(h, wm.GWL_STYLE, want);
+    // SWP_NOSIZE | SWP_NOMOVE | SWP_NOZORDER | SWP_NOACTIVATE | SWP_FRAMECHANGED: the caption
+    // drawn again without the button.
+    _ = wm.SetWindowPos(h, null, 0, 0, 0, 0, @bitCast(@as(u32, 0x0001 | 0x0002 | 0x0004 | 0x0010 | 0x0020)));
+}
+
+pub fn nativeCaption(window: *c.SDL_Window, color: dvui.Color, text: dvui.Color, dark: bool) void {
+    if (builtin.target.os.tag != .windows) return;
+    const hwnd = c.SDL_GetPointerProperty(c.SDL_GetWindowProperties(window), c.SDL_PROP_WINDOW_WIN32_HWND_POINTER, null) orelse return;
+    const hwnd_h = @as(win32.foundation.HWND, @ptrCast(hwnd));
+    const dark_value: u32 = @intFromBool(dark);
+    _ = win32.graphics.dwm.DwmSetWindowAttribute(
+        hwnd_h,
+        @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @fromBackingInt(@intCast(DWMWA_USE_IMMERSIVE_DARK_MODE))),
+        &dark_value,
+        @sizeOf(u32),
+    );
+    // COLORREF: 0x00BBGGRR.
+    const caption: u32 = @as(u32, color.b) << 16 | @as(u32, color.g) << 8 | color.r;
+    const title: u32 = @as(u32, text.b) << 16 | @as(u32, text.g) << 8 | text.r;
+    _ = win32.graphics.dwm.DwmSetWindowAttribute(hwnd_h, win32.graphics.dwm.DWMWA_CAPTION_COLOR, &caption, @sizeOf(u32));
+    _ = win32.graphics.dwm.DwmSetWindowAttribute(hwnd_h, win32.graphics.dwm.DWMWA_TEXT_COLOR, &title, @sizeOf(u32));
+}
+
 /// No caption or border tint: the app draws its own title bar in the client area.
 pub fn clearCaptionColors(win: *dvui.Window) void {
     if (builtin.target.os.tag != .windows) return;
@@ -238,7 +276,7 @@ fn win32MicaSubclassProc(
         const backdrop_type: u32 = DWMSBT_TRANSIENTWINDOW;
         _ = win32.graphics.dwm.DwmSetWindowAttribute(
             hWnd,
-            @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @enumFromInt(DWMWA_SYSTEMBACKDROP_TYPE)),
+            @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @fromBackingInt(@intCast(DWMWA_SYSTEMBACKDROP_TYPE))),
             &backdrop_type,
             @sizeOf(u32),
         );
@@ -277,8 +315,8 @@ fn win32MicaSubclassProc(
 
         // Resize edges/corners only while not maximized.
         const frame: titlebar.Frame = if (win32.ui.windows_and_messaging.IsZoomed(hWnd) != 0) .{} else .{
-            .w = @max(win32.ui.windows_and_messaging.GetSystemMetrics(@as(win32.ui.windows_and_messaging.SYSTEM_METRICS_INDEX, @enumFromInt(SM_CXSIZEFRAME))), 4),
-            .h = @max(win32.ui.windows_and_messaging.GetSystemMetrics(@as(win32.ui.windows_and_messaging.SYSTEM_METRICS_INDEX, @enumFromInt(SM_CYSIZEFRAME))), 4),
+            .w = @max(win32.ui.windows_and_messaging.GetSystemMetrics(@as(win32.ui.windows_and_messaging.SYSTEM_METRICS_INDEX, @fromBackingInt(@intCast(SM_CXSIZEFRAME)))), 4),
+            .h = @max(win32.ui.windows_and_messaging.GetSystemMetrics(@as(win32.ui.windows_and_messaging.SYSTEM_METRICS_INDEX, @fromBackingInt(@intCast(SM_CYSIZEFRAME)))), 4),
         };
         // The caption-button codes are also what make the Win11 snap-layouts flyout appear on
         // the maximize button.
@@ -384,7 +422,7 @@ pub fn viewportChrome(hwnd: *anyopaque, main_hwnd: ?*anyopaque, dark: bool, radi
     const h: win32.foundation.HWND = @ptrCast(hwnd);
     const dwm = win32.graphics.dwm;
     const corner: u32 = if (radius_pt < 1) DWMWCP_DONOTROUND else if (radius_pt < 6) DWMWCP_ROUNDSMALL else DWMWCP_ROUND;
-    _ = dwm.DwmSetWindowAttribute(h, @enumFromInt(DWMWA_WINDOW_CORNER_PREFERENCE), &corner, @sizeOf(u32));
+    _ = dwm.DwmSetWindowAttribute(h, @fromBackingInt(@intCast(DWMWA_WINDOW_CORNER_PREFERENCE)), &corner, @sizeOf(u32));
     // No border and no caption colour, as the main window has none (`clearCaptionColors`): DWM
     // treats the window as framed (its caption taken away, `WM_NCCALCSIZE`) and tinted the strip
     // where a title bar would be — the accent colour, where Windows shows it on title bars — so
@@ -393,11 +431,11 @@ pub fn viewportChrome(hwnd: *anyopaque, main_hwnd: ?*anyopaque, dark: bool, radi
     _ = dwm.DwmSetWindowAttribute(h, dwm.DWMWA_BORDER_COLOR, &none, @sizeOf(u32));
     _ = dwm.DwmSetWindowAttribute(h, dwm.DWMWA_CAPTION_COLOR, &none, @sizeOf(u32));
     const dark_value: u32 = @intFromBool(dark);
-    _ = dwm.DwmSetWindowAttribute(h, @enumFromInt(DWMWA_USE_IMMERSIVE_DARK_MODE), &dark_value, @sizeOf(u32));
+    _ = dwm.DwmSetWindowAttribute(h, @fromBackingInt(@intCast(DWMWA_USE_IMMERSIVE_DARK_MODE)), &dark_value, @sizeOf(u32));
     // No DWM animation as it shows or closes: it appears and goes exactly where its float is drawn,
     // in the frame it changes in (macOS: `NSWindowAnimationBehaviorNone`).
     const no_transitions: u32 = 1;
-    _ = dwm.DwmSetWindowAttribute(h, @enumFromInt(DWMWA_TRANSITIONS_FORCEDISABLED), &no_transitions, @sizeOf(u32));
+    _ = dwm.DwmSetWindowAttribute(h, @fromBackingInt(@intCast(DWMWA_TRANSITIONS_FORCEDISABLED)), &no_transitions, @sizeOf(u32));
     _ = win32.ui.shell.SetWindowSubclass(h, viewportSubclassProc, viewport_subclass_id, @intFromPtr(loop));
     // No system menu: with the frame extended over the window, DWM draws the caption buttons
     // `WS_SYSMENU` brings, over the float's header (as `applyChrome` strips it from the main
@@ -445,7 +483,7 @@ pub fn viewportMenuChrome(hwnd: *anyopaque, dark: bool, radius_pt: f32) bool {
     const dwm = win32.graphics.dwm;
     const wm = win32.ui.windows_and_messaging;
     const corner: u32 = if (radius_pt < 1) DWMWCP_DONOTROUND else if (radius_pt < 6) DWMWCP_ROUNDSMALL else DWMWCP_ROUND;
-    _ = dwm.DwmSetWindowAttribute(h, @enumFromInt(DWMWA_WINDOW_CORNER_PREFERENCE), &corner, @sizeOf(u32));
+    _ = dwm.DwmSetWindowAttribute(h, @fromBackingInt(@intCast(DWMWA_WINDOW_CORNER_PREFERENCE)), &corner, @sizeOf(u32));
     // No border and no caption colour, as the main window has none (`clearCaptionColors`): DWM
     // treats the window as framed (its caption taken away, `WM_NCCALCSIZE`) and tinted the strip
     // where a title bar would be — the accent colour, where Windows shows it on title bars — so
@@ -454,9 +492,9 @@ pub fn viewportMenuChrome(hwnd: *anyopaque, dark: bool, radius_pt: f32) bool {
     _ = dwm.DwmSetWindowAttribute(h, dwm.DWMWA_BORDER_COLOR, &none, @sizeOf(u32));
     _ = dwm.DwmSetWindowAttribute(h, dwm.DWMWA_CAPTION_COLOR, &none, @sizeOf(u32));
     const dark_value: u32 = @intFromBool(dark);
-    _ = dwm.DwmSetWindowAttribute(h, @enumFromInt(DWMWA_USE_IMMERSIVE_DARK_MODE), &dark_value, @sizeOf(u32));
+    _ = dwm.DwmSetWindowAttribute(h, @fromBackingInt(@intCast(DWMWA_USE_IMMERSIVE_DARK_MODE)), &dark_value, @sizeOf(u32));
     const no_transitions: u32 = 1;
-    _ = dwm.DwmSetWindowAttribute(h, @enumFromInt(DWMWA_TRANSITIONS_FORCEDISABLED), &no_transitions, @sizeOf(u32));
+    _ = dwm.DwmSetWindowAttribute(h, @fromBackingInt(@intCast(DWMWA_TRANSITIONS_FORCEDISABLED)), &no_transitions, @sizeOf(u32));
     _ = win32.ui.shell.SetWindowSubclass(h, menuSubclassProc, menu_subclass_id, 0);
     // No system menu, whose caption buttons DWM would draw over the menu with the frame extended
     // (as for a float's window, `viewportChrome`); SDL's caption style stays, collapsed by its
@@ -491,7 +529,7 @@ fn menuSubclassProc(
     // Always active to DWM, so its backdrop stays Acrylic rather than the inactive fallback.
     if (uMsg == wm.WM_NCACTIVATE) return win32.ui.shell.DefSubclassProc(hWnd, uMsg, 1, lParam);
     // SDL sets the window's style again as it likes: never the system menu.
-    if (uMsg == wm.WM_STYLECHANGING and @as(isize, @bitCast(wParam)) == @intFromEnum(wm.GWL_STYLE)) {
+    if (uMsg == wm.WM_STYLECHANGING and @as(isize, @bitCast(wParam)) == @backingInt(wm.GWL_STYLE)) {
         const ss: *wm.STYLESTRUCT = @ptrFromInt(@as(usize, @bitCast(lParam)));
         ss.styleNew &= ~@as(u32, @intCast(viewport_ws_sysmenu));
     }
@@ -506,7 +544,7 @@ fn menuSubclassProc(
 /// every activation, as DWM wants (and as `win32MicaSubclassProc` does for the main window).
 fn applyViewportBackdrop(h: win32.foundation.HWND) bool {
     const backdrop_type: u32 = DWMSBT_TRANSIENTWINDOW;
-    const hr = win32.graphics.dwm.DwmSetWindowAttribute(h, @enumFromInt(DWMWA_SYSTEMBACKDROP_TYPE), &backdrop_type, @sizeOf(u32));
+    const hr = win32.graphics.dwm.DwmSetWindowAttribute(h, @fromBackingInt(@intCast(DWMWA_SYSTEMBACKDROP_TYPE)), &backdrop_type, @sizeOf(u32));
     _ = win32.graphics.dwm.DwmExtendFrameIntoClientArea(h, &win32_mica_margins);
     return hr >= 0;
 }
@@ -574,12 +612,12 @@ fn viewportSubclassProc(
         if (hWnd) |h| _ = applyViewportBackdrop(h);
     }
     // SDL sets the window's style again as it likes (`viewportChrome`): never the system menu.
-    if (uMsg == wm.WM_STYLECHANGING and @as(isize, @bitCast(wParam)) == @intFromEnum(wm.GWL_STYLE)) {
+    if (uMsg == wm.WM_STYLECHANGING and @as(isize, @bitCast(wParam)) == @backingInt(wm.GWL_STYLE)) {
         const ss: *wm.STYLESTRUCT = @ptrFromInt(@as(usize, @bitCast(lParam)));
         ss.styleNew &= ~@as(u32, @intCast(viewport_ws_sysmenu));
     }
     // Nor its taskbar button.
-    if (uMsg == wm.WM_STYLECHANGING and @as(isize, @bitCast(wParam)) == @intFromEnum(wm.GWL_EXSTYLE)) {
+    if (uMsg == wm.WM_STYLECHANGING and @as(isize, @bitCast(wParam)) == @backingInt(wm.GWL_EXSTYLE)) {
         const ss: *wm.STYLESTRUCT = @ptrFromInt(@as(usize, @bitCast(lParam)));
         ss.styleNew |= @as(u32, @intCast(viewport_ws_ex_appwindow));
     }
diff --git a/backend/src/platform/window.zig b/backend/src/platform/window.zig
index 63279fbe3..e95ed016e 100644
--- a/backend/src/platform/window.zig
+++ b/backend/src/platform/window.zig
@@ -190,7 +190,7 @@ fn setCloaked(win: *dvui.Window, cloaked: bool) void {
     const win32 = @import("win32");
     const value: u32 = @intFromBool(cloaked);
     // DWMWA_CLOAK.
-    _ = win32.graphics.dwm.DwmSetWindowAttribute(@ptrCast(hwnd), @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @enumFromInt(13)), &value, @sizeOf(u32));
+    _ = win32.graphics.dwm.DwmSetWindowAttribute(@ptrCast(hwnd), @as(win32.graphics.dwm.DWMWINDOWATTRIBUTE, @fromBackingInt(@intCast(13))), &value, @sizeOf(u32));
 }
 
 pub fn isMaximized(win: *dvui.Window) bool {
@@ -321,7 +321,12 @@ pub fn isFullscreenChromeHidden(win: *dvui.Window) bool {
 /// returns `WS_SYSMENU` and its caption buttons, and the backdrop's frame with it). Applying it all
 /// unconditionally every frame was a `SetWindowPos(SWP_FRAMECHANGED)` — a `WM_NCCALCSIZE` — a
 /// library load and a class-brush write each frame on Windows, and two style-mask writes on macOS.
+/// Whether the app dresses its windows itself (`setStyle`, `setBackground`), as fizzy does: then the
+/// backend leaves a plain dvui app's look (`nativeTitleBar`) off its main window.
+pub var app_dresses_windows = false;
+
 pub fn setStyle(win: *dvui.Window) void {
+    app_dresses_windows = true;
     if (builtin.target.os.tag == .macos) {
         const raw_ptr = c.SDL_GetPointerProperty(
             c.SDL_GetWindowProperties(win.backend.impl.window),
@@ -344,7 +349,7 @@ pub fn setStyle(win: *dvui.Window) void {
         // borderless, it was never titled.
         if (comptime own_backend) for (&win.backend.impl.viewport_slots) |*slot| {
             const vp = if (slot.*) |*v| v else continue;
-            if (vp.passive or vp.menu or vp.app_frame) continue;
+            if (vp.passive or vp.menu or vp.app_frame or vp.native) continue;
             const ns = c.SDL_GetPointerProperty(c.SDL_GetWindowProperties(vp.window), c.SDL_PROP_WINDOW_COCOA_WINDOW_POINTER, null) orelse continue;
             styleTitled(ns);
         };
@@ -408,6 +413,38 @@ fn styleTitled(raw_ptr: *anyopaque) void {
     }
 }
 
+extern fn fizzy_macos_window_has_plain_backdrop(nswindow: ?*anyopaque) c_int;
+extern fn fizzy_macos_window_plain_backdrop(nswindow: ?*anyopaque, r: f64, g: f64, b: f64, radius: f64) void;
+extern fn fizzy_macos_window_corner_radius() f64;
+
+/// The OS's own title bar on `window` — its title, its buttons — coloured as the window is
+/// (`color`, the theme's window fill), the app's content below it: how a plain dvui app's windows
+/// look on this backend (`SDLBackend.floatingWindowOs`, `SDLBackend.dressPlainWindows`). Fizzy's
+/// own windows draw their title bar themselves (`setStyle`). Cheap to call again: each setter
+/// is skipped when the window already has it.
+/// - macOS: fizzy's own shape (`styleTitled`), its content under a transparent title bar, but its
+///   title showing: the backend keeps that band clear and in the window's colour
+///   (`platform.macos_monitor.titlebarStrip`), and the window goes into and out of full screen as fizzy's does.
+/// - Windows: the caption in that colour (DWM, Windows 11), its text the theme's.
+/// - Linux: the window manager's own, as it draws it.
+pub fn nativeTitleBar(window: *c.SDL_Window, color: dvui.Color, text: dvui.Color, dark: bool) void {
+    switch (builtin.target.os.tag) {
+        .macos => {
+            const raw_ptr = c.SDL_GetPointerProperty(c.SDL_GetWindowProperties(window), c.SDL_PROP_WINDOW_COCOA_WINDOW_POINTER, null) orelse return;
+            styleTitled(raw_ptr);
+            const ns = objc.Object.fromId(raw_ptr);
+            if (ns.msgSend(c_long, "titleVisibility", .{}) != 0) ns.msgSend(void, "setTitleVisibility:", .{@as(c_long, 0)});
+            skin(raw_ptr, color, dark);
+            // Clear, over a backdrop in the window's colour that follows its picture on its way
+            // into or out of full screen, as fizzy's glass does.
+            const f = color.toRGBA();
+            fizzy_macos_window_plain_backdrop(raw_ptr, @as(f64, @floatFromInt(f[0])) / 255, @as(f64, @floatFromInt(f[1])) / 255, @as(f64, @floatFromInt(f[2])) / 255, fizzy_macos_window_corner_radius());
+        },
+        .windows => win32_titlebar.nativeCaption(window, color, text, dark),
+        else => {},
+    }
+}
+
 /// A window of fizzy's skinned as the app is: its background — what AppKit draws its title bar
 /// with, the one a fullscreen window reveals at the top among them — `color`, and its appearance
 /// light or dark by the app's theme, not the system's, so its title bar, traffic lights and
@@ -424,9 +461,17 @@ pub fn skin(raw_ptr: *anyopaque, color: dvui.Color, dark: bool) void {
         @as(f64, @floatFromInt(color.a)) / 255.0,
     });
     // This sets both the titlebar and the window background color — clear on a window of Liquid
-    // Glass (`liquidGlass`), whose colour is under its glass.
+    // Glass (`liquidGlass`), whose colour is under its glass, and on one with a backdrop in its
+    // colour (`nativeTitleBar`), whose colour is the backdrop's: on its way into or out of full
+    // screen the window stands at the screen's size while the backdrop follows its picture, and a
+    // background in the window's colour filled all of the screen round the picture (the user).
     const glass = fizzy_macos_window_has_liquid_glass(raw_ptr) != 0;
-    window.msgSend(void, "setBackgroundColor:", .{if (glass) NSColor.msgSend(objc.Object, "clearColor", .{}).value else new_color.value});
+    if (fizzy_macos_window_has_plain_backdrop(raw_ptr) != 0) {
+        const f = color.toRGBA();
+        fizzy_macos_window_plain_backdrop(raw_ptr, @as(f64, @floatFromInt(f[0])) / 255, @as(f64, @floatFromInt(f[1])) / 255, @as(f64, @floatFromInt(f[2])) / 255, fizzy_macos_window_corner_radius());
+    } else {
+        window.msgSend(void, "setBackgroundColor:", .{if (glass) NSColor.msgSend(objc.Object, "clearColor", .{}).value else new_color.value});
+    }
 
     // Set window NSAppearance so the app (title bar, traffic lights, vibrancy) matches dvui theme.
     if (objc.getClass("NSAppearance")) |NSAppearance| {
@@ -447,6 +492,7 @@ pub fn skin(raw_ptr: *anyopaque, color: dvui.Color, dark: bool) void {
 }
 
 pub fn setBackground(win: *dvui.Window, color: dvui.Color) void {
+    app_dresses_windows = true;
     if (builtin.target.os.tag == .macos) {
         const raw_ptr = c.SDL_GetPointerProperty(
             c.SDL_GetWindowProperties(win.backend.impl.window),
diff --git a/backend/src/viewports.zig b/backend/src/viewports.zig
index 63822e158..7bb23f0e4 100644
--- a/backend/src/viewports.zig
+++ b/backend/src/viewports.zig
@@ -43,6 +43,55 @@ pub fn openCarry(at: Rect) ?*Viewport {
     return dvui.currentWindow().backend.impl.viewportOpenCarry(at);
 }
 
+/// Whether a floating window dragged past the app's windows can tear off into one of its own
+/// (`os_windows`): macOS, where the window under the pointer can be asked, and only in an app that
+/// leaves its floating windows to the backend (`SDLBackend.floating_os_windows`): fizzy carries
+/// its own out (`Popout`). Windows and Linux need the same question of the window under the pointer
+/// (`pointerOverNoWindow`).
+pub fn tears() bool {
+    return builtin.target.os.tag == .macos and SDLBackend.floating_os_windows != .none;
+}
+
+/// Whether `vp`'s window lies wholly inside the main window, on the Space being shown
+/// (`os_windows`: a torn-off window let go there goes back in).
+pub fn mainHolds(vp: *const Viewport) bool {
+    return dvui.currentWindow().backend.impl.viewportMainHolds(vp);
+}
+
+/// Physical pixels from the frame's origin to the first viewport's band, and between bands.
+pub const band_stride = @import("viewport_map.zig").band_stride;
+
+/// Where the pointer is on the desktop, in the main window's frame (physical): whichever window a
+/// press began in (`SDLBackend.pointerInMain`).
+pub fn pointerInMain() dvui.Point.Physical {
+    return dvui.currentWindow().backend.impl.pointerInMain();
+}
+
+/// The OS's title bar over a window of its own frame, physical (`SDLBackend.titleBand`).
+pub fn titleBand() f32 {
+    return dvui.currentWindow().backend.impl.titleBand();
+}
+
+/// Whether the pointer is over no window of the app's (`SDLBackend.pointerOverNoWindow`).
+pub fn pointerOverNoWindow() bool {
+    return dvui.currentWindow().backend.impl.pointerOverNoWindow();
+}
+
+/// The app's window the pointer is over (`SDLBackend.windowAtPointer`), or null.
+pub fn windowAtPointer() ?*anyopaque {
+    return dvui.currentWindow().backend.impl.windowAtPointer();
+}
+
+/// `window` (`windowAtPointer`'s) in front of the app's other windows, not made key.
+pub fn bringForward(window: *anyopaque) void {
+    dvui.currentWindow().backend.impl.bringForward(window);
+}
+
+/// Whether a pointer button is held, wherever the pointer is.
+pub fn pointerHeld() bool {
+    return dvui.currentWindow().backend.impl.pointerHeld();
+}
+
 /// Whether one of the app's windows has the keyboard: the app is the active one.
 pub fn appActive() bool {
     return SDLBackend.appActive();
@@ -324,6 +373,15 @@ pub const Picture = struct {
         _ = dvui.renderTarget(self.rt);
     }
 
+    /// Subwindow `sw`'s drawing this frame out of the frame, drawn nowhere: a floating window shown
+    /// only as a picture taken of it before (`os_windows`' tear-off card). Its queues emptied as
+    /// `dvui.Window.renderSubwindow`'s `take` empties them.
+    pub fn drop(sw: *dvui.Subwindows.Subwindow) void {
+        sw.render_cmds = .empty;
+        sw.render_cmds_after = .empty;
+        sw.render_cmds_front = .{};
+    }
+
     /// Done: drawing goes to the frame's own target again.
     pub fn end(self: Picture) void {
         _ = dvui.renderTarget(self.prev);
@@ -341,6 +399,44 @@ pub fn sizedTarget(slot: *?dvui.Texture.Target, w: u32, h: u32) ?dvui.Texture.Ta
     return slot.*.?;
 }
 
+/// `sizedTarget` for `vp`'s picture: the same, but on its window's way into or out of full screen,
+/// its picture a new size every frame, the one in `slot` kept while `w` by `h` fits in it — made
+/// the display's size as the way begins, not anew each frame. The picture is drawn from its top
+/// left; `present` copies what the window holds.
+pub fn keptTarget(vp: *const Viewport, slot: *?dvui.Texture.Target, w: u32, h: u32) ?dvui.Texture.Target {
+    const moving = spaceFullness(vp) != null;
+    if (slot.*) |t| {
+        const fits = t.width >= w and t.height >= h;
+        const exact = t.width == w and t.height == h;
+        if (!fits or (!moving and !exact)) {
+            t.destroyLater();
+            slot.* = null;
+        }
+    }
+    if (slot.* == null) {
+        var tw = w;
+        var th = h;
+        if (moving) {
+            const d = displayInMain();
+            tw = @max(w, @as(u32, @intFromFloat(@max(0, @round(d.w)))));
+            th = @max(h, @as(u32, @intFromFloat(@max(0, @round(d.h)))));
+        }
+        slot.* = dvui.textureCreateTarget(.{ .width = tw, .height = th, .interpolation = .nearest }) catch return null;
+    }
+    return slot.*.?;
+}
+
+/// dvui's screens besides the main window's (`dvui.screensSet`): each window's part of the frame
+/// that shows a floating window, so what opens in it — a menu, a dialog — stays in that window.
+pub fn publishScreens(extra: ?dvui.Rect.Natural) void {
+    dvui.currentWindow().backend.impl.viewportScreens(extra);
+}
+
+/// The most the OS may resize `vp`'s window to, physical pixels: 0 each way for no most.
+pub fn maxSize(vp: *Viewport, w: f32, h: f32) void {
+    dvui.currentWindow().backend.impl.viewportMaxSize(vp, w, h);
+}
+
 /// Where `vp`'s window is now, in the main window's part of the frame (physical pixels from
 /// its top left): where its float goes when it comes back.
 pub fn inMain(vp: *const Viewport) Rect {
@@ -389,6 +485,11 @@ pub fn glass(vp: *Viewport, inset: f32, radius: f32, dark: bool) bool {
     return dvui.currentWindow().backend.impl.viewportGlass(vp, inset, radius, dark);
 }
 
+/// Whether `vp`'s window has the keyboard: it is the OS's key window.
+pub fn hasKeyboard(vp: *const Viewport) bool {
+    return SDLBackend.viewportHasKeyboard(vp);
+}
+
 /// The OS asked to close `vp`'s window.
 pub fn closeRequested(vp: *const Viewport) bool {
     return vp.close_requested;
diff --git a/backend/src/viewports_none.zig b/backend/src/viewports_none.zig
index 39fd24099..87a205714 100644
--- a/backend/src/viewports_none.zig
+++ b/backend/src/viewports_none.zig
@@ -60,6 +60,13 @@ pub const Picture = struct {
 pub fn sizedTarget(_: *?dvui.Texture.Target, _: u32, _: u32) ?dvui.Texture.Target {
     return null;
 }
+pub fn keptTarget(_: *const Viewport, _: *?dvui.Texture.Target, _: u32, _: u32) ?dvui.Texture.Target {
+    return null;
+}
+/// No windows besides the main one: dvui's own screen only.
+pub fn publishScreens(_: ?dvui.Rect.Natural) void {
+    dvui.screensSet(&.{});
+}
 pub fn inMain(_: *const Viewport) Rect {
     return .{};
 }
@@ -156,6 +163,7 @@ pub fn dragMove(_: *Viewport) bool {
     return false;
 }
 pub fn minSize(_: *Viewport, _: f32, _: f32) void {}
+pub fn maxSize(_: *Viewport, _: f32, _: f32) void {}
 pub fn setTitle(_: *Viewport, _: []const u8) void {}
 pub fn glass(_: *Viewport, _: f32, _: f32, _: bool) bool {
     return false;
diff --git a/build.zig b/build.zig
index b83c77d78..e9666ca7d 100644
--- a/build.zig
+++ b/build.zig
@@ -12,12 +12,13 @@ pub fn build(b: *std.Build) !void {
     const windows_msvc_libc_opt = b.option([]const u8, "windows-msvc-libc", "zig libc manifest for *-windows-msvc when cross-compiling; forwarded by packageall for Windows children") orelse null;
     const fetch_msvc_opt = b.option(bool, "fetch-msvc", "If *-windows-msvc libc is missing under .velopack-msvc/, run msvcup-setup first (downloads MSVC+SDK; requires network). Defaults to true on Windows hosts targeting *-windows-msvc.") orelse null;
 
-    const macos_sign_app_identity = b.option([]const u8, "macos-sign-app", "macOS codesign identity for the app bundle (e.g. 'Developer ID Application: NAME (TEAMID)')") orelse
-        b.graph.environ_map.get("FIZZY_MACOS_SIGN_APP");
-    const macos_sign_install_identity = b.option([]const u8, "macos-sign-installer", "macOS codesign identity for the installer pkg (e.g. 'Developer ID Installer: NAME (TEAMID)')") orelse
-        b.graph.environ_map.get("FIZZY_MACOS_SIGN_INSTALLER");
-    const macos_notary_profile = b.option([]const u8, "macos-notary-profile", "notarytool keychain profile name (run `xcrun notarytool store-credentials <name>` first)") orelse
-        b.graph.environ_map.get("FIZZY_MACOS_NOTARY_PROFILE");
+    // Options only, never the environment: Zig 0.17 caches the build's configuration without
+    // regard to it, so a variable read here would be seen once and then ignored.
+    // `scripts/release.sh` and `release.yml` turn the FIZZY_MACOS_* variables into these.
+    const macos_sign_app_identity = b.option([]const u8, "macos-sign-app", "macOS codesign identity for the app bundle (e.g. 'Developer ID Application: NAME (TEAMID)')");
+    const macos_sign_install_identity = b.option([]const u8, "macos-sign-installer", "macOS codesign identity for the installer pkg (e.g. 'Developer ID Installer: NAME (TEAMID)')");
+    const macos_notary_profile = b.option([]const u8, "macos-notary-profile", "notarytool keychain profile name (run `xcrun notarytool store-credentials <name>` first)");
+    const macos_sdk = b.option([]const u8, "macos-sdk", "macOS SDK path for an explicit -Dtarget=*-macos (default: `xcrun --sdk macosx --show-sdk-path`)");
 
     // Windows 10 1803 at least: AF_UNIX arrived there, and std offers it only to a target whose
     // minimum is that (`std.Io.net.has_unix_sockets`) — the control server's socket
@@ -39,6 +40,7 @@ pub fn build(b: *std.Build) !void {
         .macos_sign_app_identity = macos_sign_app_identity,
         .macos_sign_install_identity = macos_sign_install_identity,
         .macos_notary_profile = macos_notary_profile,
+        .macos_sdk = macos_sdk,
         // What fizzy-the-app ships in its web build beyond the built-ins. The browser cannot
         // load a plugin at runtime, so this is the one place a third-party plugin is named
         // in this repo — as build data, the way an app built on fizzy lists its own. By
@@ -200,8 +202,8 @@ pub fn addDvui(fizzy_dep: *std.Build.Dependency, root_module: *std.Build.Module,
     const b = fizzy_dep.builder;
     const exe = @import("build/exe.zig");
     const target = root_module.resolved_target orelse @panic("fizzy.addDvui: give the root module its target first");
-    const optimize = root_module.optimize orelse .Debug;
-    const macos_sdl_paths = try @import("build/common.zig").macosSdlPathsForExplicitTarget(b, target);
+    const optimize = root_module.optimize orelse .debug;
+    const macos_sdl_paths = try @import("build/common.zig").macosSdlPathsForExplicitTarget(b, target, null);
     const native = exe.nativeDvui(b, backend, target, optimize, .off, macos_sdl_paths);
     root_module.addImport("dvui", native.dvui);
     root_module.addImport("backend", native.backend);
diff --git a/build.zig.zon b/build.zig.zon
index 06b0c79a4..77e8a680f 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -8,7 +8,6 @@
         "build",
         "build.zig",
         "build.zig.zon",
-        "update.zig",
         "sdk",
         "backend",
         "assets",
@@ -18,7 +17,7 @@
     .fingerprint = 0x3311781b569a8e73,
     .name = .fizzy,
     .version = "0.2.0",
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .dependencies = .{
         .icons = .{
             .url = "https://github.com/fizzyedit/icons/archive/41e7d2162b121e3798438a7da25ff4648b204dc7.tar.gz",
@@ -34,31 +33,31 @@
             .path = "backend",
         },
         .assetpack = .{
-            .url = "https://github.com/foxnne/assetpack/archive/ac7592f3f5988857840d0df4610e1e1fad690e2e.tar.gz",
-            .hash = "assetpack-0.2.0-5DA2d1ZkAADJanNVdWrUBOGMhOzUENhrUiqXcHADxY2x",
+            .url = "https://github.com/foxnne/assetpack/archive/91eb632487d38e488a342e5755f55a9955c57807.tar.gz",
+            .hash = "assetpack-0.2.0-5DA2d2NkAADexrzqfFqkTks3i1fR9GKSfd5X5hI7Z9vn",
         },
         // App-only. Plugins depend on `sdk/` (not this root package) so they never see
         // Velopack — see AGENTS.md.
         .velopack_zig = .{
-            .url = "https://github.com/graphl-tech/velopack-zig/archive/0c2f20635a97fde38cc8000e9fb1a75f891cf37d.tar.gz",
-            .hash = "velopack_zig-0.0.1-LzeGcengAACU1f33uDAuLKlWXtek0KCC6i_b3XWeJMjd",
+            .url = "https://github.com/graphl-tech/velopack-zig/archive/3d553b7efb3b9443ac4ad2bffdf85d5ae328177e.tar.gz",
+            .hash = "velopack_zig-0.1.0-bbBwERkwAQBxx5LimM-B5UQrwoqltUUvrthOlyuDbscm",
             .lazy = true,
         },
         .dvui_singleton_app = .{
             .path = "libs/dvui-singleton-app",
         },
         .md4zig = .{
-            .url = "git+https://github.com/fizzyedit/md4zig#2d0a687d28be9849b9abe3453bfb7c9f22ffcda1",
-            .hash = "md4zig-0.1.0-iiatj7oOBgCcrw8ee3UISfYe2LsKVEf7O3osC85HthPX",
+            .url = "git+https://github.com/fizzyedit/md4zig#eb5241c9e46cd0a507c0c7a85b01afe2b51e58a8",
+            .hash = "md4zig-0.1.0-iiatj6AQBgBP6PiK2c4MRhjNK2ZXjVg94GvbIEv5WEl7",
         },
         .nightwatch = .{
-            .url = "git+https://github.com/neurocyte/nightwatch#cac3b9edb3a59f5b3a290cf3b76044ad9b09ef28",
-            .hash = "nightwatch-1.0.0-uXzeHyOgAgCvaBhschfx3LA48n01bLYOVBQUXYjvrREM",
+            .url = "git+https://github.com/neurocyte/nightwatch#023e79f52bde36ac8fa4c967bd8333b14efb93cc",
+            .hash = "nightwatch-1.0.0-uXzeH1ALAwAr6LLM0H1Z0aBO_a5gpxQ1YsXpdlh3Xv6U",
             .lazy = true,
         },
         .zf = .{
-            .url = "git+https://github.com/natecraddock/zf#c35c421f84895193246db06c40683c1a30e616ef",
-            .hash = "zf-0.11.0-OIRy8X-RAAAwaRXHMYpj2uvBnuGTZWEE_3V7acqHQNtW",
+            .url = "git+https://github.com/natecraddock/zf#e00f9e978b6a7126d1b35fa8ffd49b62042ad6f3",
+            .hash = "zf-0.11.0-OIRy8XCRAAB6FiMwIrtD6FqlagnFwpI6YyOu7bXeYH5J",
         },
     },
 }
diff --git a/build/app.zig b/build/app.zig
index 4698b9b79..10429f692 100644
--- a/build/app.zig
+++ b/build/app.zig
@@ -48,6 +48,8 @@ pub const Options = struct {
     macos_sign_app_identity: ?[]const u8 = null,
     macos_sign_install_identity: ?[]const u8 = null,
     macos_notary_profile: ?[]const u8 = null,
+    /// `-Dmacos-sdk`: the macOS SDK for an explicit `-Dtarget=*-macos`; null asks `xcrun`.
+    macos_sdk: ?[]const u8 = null,
 };
 
 pub fn build(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.builtin.OptimizeMode, opts: Options) !void {
@@ -264,7 +266,7 @@ pub fn readConfig(b: *std.Build, target: std.Build.ResolvedTarget, opts: Options
     // package dependency to resolve here. Their canonical `build.zig` is only for the
     // standalone (`cd plugins/<name> && zig build`) third-party-shape build.
 
-    const macos_sdl_paths = try common.macosSdlPathsForExplicitTarget(b, target);
+    const macos_sdl_paths = try common.macosSdlPathsForExplicitTarget(b, target, opts.macos_sdk);
     const zig_out_subdir = common.zigOutSubdirForTarget(b, target);
     const zig_out_install_dir: std.Build.InstallDir = .{ .custom = zig_out_subdir };
 
@@ -286,10 +288,8 @@ pub fn readConfig(b: *std.Build, target: std.Build.ResolvedTarget, opts: Options
         .fetch_if_missing = fetch_msvc,
     });
 
-    var effective_win_libc: ?[]const u8 = win_libc.libc_path;
-    if (effective_win_libc == null) {
-        if (cross_win_msvc) effective_win_libc = b.libc_file;
-    }
+    // Only `-Dwindows-msvc-libc` or the managed `.velopack-msvc/` tree: Zig 0.17 has no global `--libc`.
+    const effective_win_libc: ?[]const u8 = win_libc.libc_path;
 
     // Velopack in the dev/install exe is opt-in (`-Dvelopack=true`). Release
     // packaging (`zig build package`) still links Velopack when the ABI supports
@@ -352,7 +352,8 @@ pub fn readConfig(b: *std.Build, target: std.Build.ResolvedTarget, opts: Options
     // An app's version is its own: it passes `.app_version` (its build root is not this
     // package's, so its VERSION file is out of reach here), else 0.0.0.
     const app_version: []const u8 = if (app_version_opt) |v| v else if (opts.own) |own| blk: {
-        const raw = b.build_root.handle.readFileAlloc(b.graph.io, own.version_file, b.allocator, std.Io.Limit.limited(256)) catch |e| std.debug.panic("read VERSION: {}", .{e});
+        b.dependOnFileContents(b.path(own.version_file));
+        const raw = std.Io.Dir.cwd().readFileAlloc(b.graph.io, b.root.joinString(b.allocator, own.version_file) catch @panic("OOM"), b.allocator, std.Io.Limit.limited(256)) catch |e| std.debug.panic("read VERSION: {}", .{e});
         version_owned = raw;
         break :blk std.mem.trimEnd(u8, raw, "\r\n");
     } else "0.0.0";
@@ -429,8 +430,6 @@ pub fn readConfig(b: *std.Build, target: std.Build.ResolvedTarget, opts: Options
     const workbench_opts = b.addOptions();
     workbench_opts.addOption(bool, "file_tree", workbench_file_tree);
 
-    common.addUpdateStep(b);
-
     const msvcup_before_compile: ?*std.Build.Step.Run = if (vz) |v| velopack.addMsvcupSetupStep(b, v, ".velopack-msvc") else null;
     const msvcup_setup_step = b.step("msvcup-setup", "Download MSVC SDK into .velopack-msvc/ via velopack-zig (writes zig-libc-*.ini)");
     if (msvcup_before_compile) |m| msvcup_setup_step.dependOn(&m.step);
@@ -508,7 +507,6 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
     const zig_out_subdir = cfg.zig_out_subdir;
     const zig_out_install_dir = cfg.zig_out_install_dir;
     const target_is_windows_msvc = cfg.target_is_windows_msvc;
-    const cross_win_msvc = cfg.cross_win_msvc;
     const effective_win_libc = cfg.effective_win_libc;
     const velopack_supported_for_target = cfg.velopack_supported_for_target;
     const velopack_enabled = cfg.velopack_enabled;
@@ -615,7 +613,19 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
         });
         // A running fizzy holds its executable on Windows: set it aside first, or the install fails.
         if (b.graph.host.result.os.tag == .windows and target.result.os.tag == .windows) {
-            const aside = SetAsideRunningExe.create(b, b.getInstallPath(zig_out_install_dir, exe.out_filename));
+            const aside_exe = b.addExecutable(.{
+                .name = "set-aside",
+                .root_module = b.createModule(.{
+                    .root_source_file = b.path("build/set_aside.zig"),
+                    .target = b.graph.host,
+                    .optimize = .fast,
+                }),
+            });
+            const aside = b.addRunArtifact(aside_exe);
+            aside.setName("set aside a running executable");
+            aside.addDirectoryArg(common.installDirPath(zig_out_install_dir));
+            aside.addArg(exe.out_filename);
+            aside.has_side_effects = true;
             aside.step.dependOn(&exe.step);
             install_artifact.step.dependOn(&aside.step);
         }
@@ -840,6 +850,9 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
         // the OS's form and the app's. std-only (see glass_look.zig); `LiquidField` and `Popout`
         // apply it.
         .{ "fizzy-glass-look-tests", "core/gfx/glass_look.zig" },
+        // What the app's windows are made of, and the fallback to what the backend can show.
+        // std-only but for `publish`/`get`, which reach dvui and are not under test here.
+        .{ "fizzy-material-tests", "core/material.zig" },
         // The in-app menu bar's order: fizzy's menus, then plugins', then Help. std-only (see
         // menu_order.zig); `Menu.draw` walks it.
         .{ "fizzy-menu-order-tests", "src/editor/menu_order.zig" },
@@ -1242,7 +1255,7 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
     // off for the msvc ABI regardless of host (cross or native Windows).
     integration_tests.root_module.link_libcpp = !target_is_windows_msvc;
     if (velopack_enabled) if (vz) |v| {
-        try velopack.linkVelopack(b, v, integration_tests, .{ .target = target, .optimize = optimize });
+        try velopack.linkVelopack(b, v, integration_tests, .{ .target = target, .optimize = optimize, .c_modules = &.{app_module_test} });
     };
 
     test_integration_step.dependOn(&b.addRunArtifact(integration_tests).step);
@@ -1270,7 +1283,7 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
         if (target.result.os.tag == .windows) demo_tests.root_module.linkSystemLibrary("comctl32", .{});
         demo_tests.root_module.link_libcpp = !target_is_windows_msvc;
         if (velopack_enabled) if (vz) |v| {
-            try velopack.linkVelopack(b, v, demo_tests, .{ .target = target, .optimize = optimize });
+            try velopack.linkVelopack(b, v, demo_tests, .{ .target = target, .optimize = optimize, .c_modules = &.{app_module_test} });
         };
         test_integration_step.dependOn(&b.addRunArtifact(demo_tests).step);
         check_integration_step.dependOn(&demo_tests.step);
@@ -1422,7 +1435,7 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
             bench_replay.root_module.linkSystemLibrary("comctl32", .{});
         }
         if (velopack_enabled) if (vz) |v| {
-            try velopack.linkVelopack(b, v, bench_replay, .{ .target = target, .optimize = optimize });
+            try velopack.linkVelopack(b, v, bench_replay, .{ .target = target, .optimize = optimize, .c_modules = &.{app_module_test} });
         };
 
         const check_bench_replay_step = b.step("check-bench-replay", "Compile fizzy bench-replay without running it");
@@ -1628,12 +1641,13 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
         };
 
         if (effective_win_libc) |ini| {
-            if (cross_win_msvc) b.libc_file = null;
             const libc_lp: std.Build.LazyPath = .{ .cwd_relative = ini };
             velopack.applyWindowsMsvcLibcRecursive(b, roots[0..n], libc_lp);
 
+            // Absolute, and already declared to the configure cache where it was resolved
+            // (`velopack.resolveWindowsMsvcLibc`).
             const ini_exists = blk: {
-                b.build_root.handle.access(b.graph.io, ini, .{}) catch break :blk false;
+                std.Io.Dir.cwd().access(b.graph.io, ini, .{}) catch break :blk false;
                 break :blk true;
             };
             if (ini_exists) {
@@ -1681,45 +1695,3 @@ fn addTestBinaryArgs(
         } else try addTestBinaryArgs(b, run, seen, dep);
     }
 }
-
-/// Windows will not let a file a running process was started from be written or deleted, but it
-/// will let it be renamed. So before the install, an installed executable that is running (it
-/// cannot be opened for writing) is renamed aside, to `<name>.<time>.old` beside it. The running
-/// app goes on from the renamed file; with Restart when rebuilt on it sees the new one land and
-/// restarts into it, and the next launch deletes what was set aside
-/// (`ExecutableWatcher.removeSetAside`). An executable nothing runs is left for the install to
-/// replace as it always has. Only on a Windows host, the one with the lock, and only once the
-/// compile has succeeded, so a failed build leaves the running app's file where it was.
-const SetAsideRunningExe = struct {
-    step: std.Build.Step,
-    path: []const u8,
-
-    fn create(b: *std.Build, path: []const u8) *SetAsideRunningExe {
-        const self = b.allocator.create(SetAsideRunningExe) catch @panic("OOM");
-        self.* = .{
-            .step = std.Build.Step.init(.{ .id = .custom, .name = "set aside a running executable", .owner = b, .makeFn = make }),
-            .path = path,
-        };
-        return self;
-    }
-
-    fn make(step: *std.Build.Step, _: std.Build.Step.MakeOptions) anyerror!void {
-        const self: *SetAsideRunningExe = @fieldParentPtr("step", step);
-        const io = step.owner.graph.io;
-        const cwd = std.Io.Dir.cwd();
-        var file = cwd.openFile(io, self.path, .{ .mode = .read_write }) catch |err| switch (err) {
-            error.FileNotFound => return,
-            else => {
-                // Held: a running app. Renamed, the install's path is free.
-                const aside = try std.fmt.allocPrint(step.owner.allocator, "{s}.{d}.old", .{ self.path, std.Io.Clock.real.now(io).nanoseconds });
-                std.Io.Dir.renameAbsolute(self.path, aside, io) catch |rename_err| {
-                    std.log.warn("{s} is in use and could not be set aside ({t}); the install will fail until it quits", .{ self.path, rename_err });
-                    return;
-                };
-                std.log.info("{s} is running: set aside as {s}", .{ self.path, std.fs.path.basename(aside) });
-                return;
-            },
-        };
-        file.close(io);
-    }
-};
diff --git a/build/common.zig b/build/common.zig
index b77d1971b..763b495eb 100644
--- a/build/common.zig
+++ b/build/common.zig
@@ -1,8 +1,6 @@
 const std = @import("std");
 
 const plugin = @import("fizzy_sdk").plugin;
-const update = @import("../update.zig");
-const GitDependency = update.GitDependency;
 
 /// Install `{id}.{ext}` flat under a `plugins/` directory (no `lib` prefix).
 pub fn attachBuiltinPluginInstall(
@@ -15,31 +13,16 @@ pub fn attachBuiltinPluginInstall(
     parent.dependOn(&plugin.installBuiltinPlugin(b, dylib, id, plugins_dir).step);
 }
 
-pub fn addUpdateStep(b: *std.Build) void {
-    const step = b.step("update", "update git dependencies");
-    step.makeFn = updateStep;
-}
-
-fn updateStep(step: *std.Build.Step, _: std.Build.Step.MakeOptions) !void {
-    const deps = &.{
-        GitDependency{
-            .url = "https://github.com/foxnne/zig-objc",
-            .branch = "main",
-        },
-        GitDependency{
-            .url = "https://github.com/kristoff-it/zigwin32",
-            .branch = "fix/zig16",
-        },
-        GitDependency{
-            .url = "https://github.com/foxnne/zig-lib-icons",
-            .branch = "dvui",
-        },
-        GitDependency{
-            .url = "https://github.com/foxnne/dvui-dev",
-            .branch = "main",
-        },
+/// Where `dir` is under the install prefix, resolved when the build runs: Zig 0.17 has no
+/// install path at configure time.
+pub fn installDirPath(dir: std.Build.InstallDir) std.Build.LazyPath {
+    return switch (dir) {
+        .prefix => .{ .relative = .{ .base = .install_prefix } },
+        .lib => .{ .relative = .{ .base = .install_lib } },
+        .bin => .{ .relative = .{ .base = .install_bin } },
+        .header => .{ .relative = .{ .base = .install_include } },
+        .custom => |sub| .{ .relative = .{ .base = .install_prefix, .sub_path = sub } },
     };
-    try update.update_dependency(step.owner.allocator, step.owner.graph.io, deps);
 }
 
 /// Installed artifacts go under `zig-out/<this>/…` so `packageall` and parallel targets never clobber each other.
@@ -74,12 +57,12 @@ pub const MacosSdlPaths = struct {
     lib: std.Build.LazyPath,
 };
 
-fn resolveMacosSdkPath(b: *std.Build) ![]const u8 {
-    if (b.graph.environ_map.get("SDKROOT")) |sdk| {
+/// `-Dmacos-sdk`, else `xcrun`. Not `SDKROOT`: Zig 0.17 caches the build's configuration without
+/// regard to the environment.
+fn resolveMacosSdkPath(b: *std.Build, explicit: ?[]const u8) ![]const u8 {
+    if (explicit) |sdk| {
         const trimmed = std.mem.trim(u8, sdk, " \t\r\n");
-        if (trimmed.len > 0) {
-            return b.dupePath(trimmed);
-        }
+        if (trimmed.len > 0) return b.dupePath(trimmed);
     }
 
     const argv: []const []const u8 = &.{
@@ -99,7 +82,7 @@ fn resolveMacosSdkPath(b: *std.Build) ![]const u8 {
     }
     switch (run.term) {
         .exited => |code| if (code != 0) {
-            std.log.err("SDL on macOS: explicit -Dtarget=*-macos needs an SDK path. xcrun exited with code {d}. Install Xcode Command Line Tools or set SDKROOT.", .{code});
+            std.log.err("SDL on macOS: explicit -Dtarget=*-macos needs an SDK path. xcrun exited with code {d}. Install Xcode Command Line Tools or pass -Dmacos-sdk=<path>.", .{code});
             return error.MacosSdkPath;
         },
         else => {
@@ -112,15 +95,31 @@ fn resolveMacosSdkPath(b: *std.Build) ![]const u8 {
     return b.dupePath(path);
 }
 
-pub fn macosSdlPathsForExplicitTarget(b: *std.Build, target: std.Build.ResolvedTarget) !?MacosSdlPaths {
+pub fn macosSdlPathsForExplicitTarget(b: *std.Build, target: std.Build.ResolvedTarget, macos_sdk: ?[]const u8) !?MacosSdlPaths {
     if (target.result.os.tag != .macos) return null;
     if (b.graph.host.result.os.tag != .macos) return null;
     if (target.query.isNative()) return null;
 
-    const sdk = try resolveMacosSdkPath(b);
+    const sdk = try resolveMacosSdkPath(b, macos_sdk);
     return MacosSdlPaths{
         .include = .{ .cwd_relative = b.pathJoin(&.{ sdk, "usr/include" }) },
         .framework = .{ .cwd_relative = b.pathJoin(&.{ sdk, "System/Library/Frameworks" }) },
         .lib = .{ .cwd_relative = b.pathJoin(&.{ sdk, "usr/lib" }) },
     };
 }
+
+/// Declare to Zig 0.17's configure cache that the build read whether `rel` exists: the file itself
+/// when it does, and otherwise the nearest directory that exists, since the maker cannot load a
+/// configuration that depends on a path inside a missing directory ("configuration failed:
+/// FileSystemFailure"). Making the file changes that directory, so the build still reconfigures.
+pub fn dependOnPathExistence(b: *std.Build, rel: []const u8) void {
+    b.root.access(b.graph.io, rel, .{}) catch {
+        var dir = std.fs.path.dirname(rel);
+        while (dir) |d| : (dir = std.fs.path.dirname(d)) {
+            b.root.access(b.graph.io, d, .{}) catch continue;
+            return b.dependOnDirectoryMetadata(b.path(d));
+        }
+        return b.dependOnDirectoryMetadata(b.path("."));
+    };
+    b.dependOnFileMetadata(b.path(rel));
+}
diff --git a/build/exe.zig b/build/exe.zig
index 86cd52b6b..a29af3d61 100644
--- a/build/exe.zig
+++ b/build/exe.zig
@@ -227,7 +227,7 @@ pub fn addFizzyExecutableForTarget(
 
     const exe = b.addExecutable(.{
         .name = app_name,
-        .root_module = b.addModule("App", .{
+        .root_module = b.createModule(.{ // private: one per target, and 0.17 refuses a second public "App"
             .target = resolved_target,
             .optimize = optimize,
             // `b.path`, not `.cwd_relative`: this resolves against *fizzy's* build root, which
@@ -246,17 +246,17 @@ pub fn addFizzyExecutableForTarget(
     exe.root_module.addImport("app_icon", app_icon_module);
     exe.root_module.addImport("build_opts", sdk.buildOptsModule(build_opts));
 
-    if (optimize != .Debug) {
+    if (optimize != .debug) {
         switch (resolved_target.result.os.tag) {
             .windows => {
-                exe.subsystem = .Windows;
+                exe.subsystem = .windows;
                 // MSVC's libcmt links `WinMainCRTStartup` (needs `WinMain`) for /SUBSYSTEM:WINDOWS.
                 // Fizzy exposes `main`, so force the C `main` entry which works for either subsystem.
                 if (resolved_target.result.abi == .msvc) {
                     exe.entry = .{ .symbol_name = "mainCRTStartup" };
                 }
             },
-            else => exe.subsystem = .Posix,
+            else => exe.subsystem = .posix,
         }
     }
 
@@ -410,6 +410,10 @@ pub fn addFizzyExecutableForTarget(
             app_module.addImport("win32", win32);
         }
         exe.root_module.linkSystemLibrary("comctl32", .{});
+        // MSVC's C runtime names the POSIX calls `_getcwd`, `_chdir`, …; `oldnames.lib` supplies
+        // the plain names, which dvui's tinyfiledialogs and fizzy's own startup use. Zig 0.16
+        // linked it for every *-windows-msvc exe; 0.17 does not.
+        if (resolved_target.result.abi == .msvc) exe.root_module.linkSystemLibrary("oldnames", .{});
 
         // Embed the resource script (fizzy's: assets/windows/fizzy.rc -> fizzy.ico) into the
         // exe so Explorer, Taskbar, Alt-Tab and the Velopack-generated Start Menu shortcut all
@@ -427,7 +431,7 @@ pub fn addFizzyExecutableForTarget(
         resolved_target.result.abi == .msvc;
     exe.root_module.link_libcpp = !exe_is_windows_msvc;
     if (velopack_enabled) if (vz) |v| {
-        try velopack.linkVelopack(b, v, exe, .{ .target = resolved_target, .optimize = optimize, .include_modules = &.{app_module} });
+        try velopack.linkVelopack(b, v, exe, .{ .target = resolved_target, .optimize = optimize, .c_modules = &.{app_module} });
     };
 
     return .{
diff --git a/build/msvc.zig b/build/msvc.zig
index a4ec853c3..d2407dedd 100644
--- a/build/msvc.zig
+++ b/build/msvc.zig
@@ -1,8 +1,25 @@
 const std = @import("std");
 
-pub fn applyMsvcTranslateCShim(b: *std.Build, roots: []const *std.Build.Step.Compile) !void {
-    var seen = std.AutoHashMap(*std.Build.Step.TranslateC, void).init(b.allocator);
-    defer seen.deinit();
+/// A C translation that some module's root comes from, for a `*-windows-msvc` target: Zig's own
+/// `Step.TranslateC`, or a Run of the `translate-c` package's tool, which is how dvui translates
+/// its headers on Zig 0.17. Found through the module graph: a module's generated root names the
+/// step that makes it, by index, as `std.Build` itself finds it.
+const Translation = union(enum) {
+    step: *std.Build.Step.TranslateC,
+    tool: *std.Build.Step.Run,
+
+    fn ptrBits(t: Translation) u16 {
+        return switch (t) {
+            .step => |tc| tc.target.result.ptrBitWidth(),
+            // `--target=<arch>-windows-msvc`; every MSVC arch but x86 is 64-bit.
+            .tool => |run| if (std.mem.startsWith(u8, toolTarget(run).?, "x86-")) 32 else 64,
+        };
+    }
+};
+
+fn msvcTranslations(b: *std.Build, roots: []const *std.Build.Step.Compile) ![]Translation {
+    var seen: std.AutoHashMapUnmanaged(*std.Build.Step, void) = .empty;
+    var out: std.ArrayList(Translation) = .empty;
     for (roots) |root_compile| {
         const graph = root_compile.root_module.getGraph();
         for (graph.modules) |mod| {
@@ -11,24 +28,57 @@ pub fn applyMsvcTranslateCShim(b: *std.Build, roots: []const *std.Build.Step.Com
                 .generated => |g| g,
                 else => continue,
             };
-            const dep_step = gen.file.step;
-            if (dep_step.id != .translate_c) continue;
-            const tc: *std.Build.Step.TranslateC = @fieldParentPtr("step", dep_step);
-            const gop = try seen.getOrPut(tc);
-            if (gop.found_existing) continue;
-            const rt = tc.target.result;
-            if (rt.os.tag != .windows or rt.abi != .msvc) continue;
-            // `-I` searches before `-isystem`, so this shim wins over MSVC's <stdint.h>.
-            tc.addIncludePath(b.path("src/backend/msvc_translatec_shim"));
-            // Pre-define SIZE_MAX so MSVC's stdint.h `#ifndef SIZE_MAX` block — which would
-            // otherwise install a `0xff…ui64` literal — skips itself. Belt-and-suspenders
-            // to the shim: covers the case where another header includes <stdint.h> through
-            // a path that bypasses our shim.
-            tc.defineCMacro("SIZE_MAX", switch (rt.ptrBitWidth()) {
-                32 => "4294967295U",
-                64 => "18446744073709551615ULL",
-                else => "UINT_MAX",
-            });
+            const owner = b.graph.generated_files.items[@backingInt(gen.index)];
+            if ((try seen.getOrPut(b.allocator, owner)).found_existing) continue;
+            if (owner.cast(std.Build.Step.TranslateC)) |tc| {
+                const rt = tc.target.result;
+                if (rt.os.tag == .windows and rt.abi == .msvc) try out.append(b.allocator, .{ .step = tc });
+            } else if (owner.cast(std.Build.Step.Run)) |run| {
+                const target = toolTarget(run) orelse continue;
+                if (std.mem.endsWith(u8, target, "-windows-msvc")) try out.append(b.allocator, .{ .tool = run });
+            }
+        }
+    }
+    return out.items;
+}
+
+/// The `--target=` a Run of the `translate-c` tool was given, or null for any other Run.
+fn toolTarget(run: *std.Build.Step.Run) ?[]const u8 {
+    if (run.argv.items.len == 0) return null;
+    switch (run.argv.items[0]) {
+        .artifact => |a| if (!std.mem.eql(u8, a.artifact.name, "translate-c")) return null,
+        else => return null,
+    }
+    for (run.argv.items) |arg| switch (arg) {
+        .bytes => |bytes| if (std.mem.startsWith(u8, bytes, "--target=")) return bytes["--target=".len..],
+        else => {},
+    };
+    return null;
+}
+
+pub fn applyMsvcTranslateCShim(b: *std.Build, roots: []const *std.Build.Step.Compile) !void {
+    const shim = b.path("src/backend/msvc_translatec_shim");
+    for (try msvcTranslations(b, roots)) |t| {
+        // Pre-define SIZE_MAX so MSVC's stdint.h `#ifndef SIZE_MAX` block — which would
+        // otherwise install a `0xff…ui64` literal — skips itself. Belt-and-suspenders
+        // to the shim: covers the case where another header includes <stdint.h> through
+        // a path that bypasses our shim.
+        const size_max = switch (t.ptrBits()) {
+            32 => "4294967295U",
+            64 => "18446744073709551615ULL",
+            else => "UINT_MAX",
+        };
+        switch (t) {
+            .step => |tc| {
+                // `-I` searches before `-isystem`, so this shim wins over MSVC's <stdint.h>.
+                tc.addIncludePath(shim);
+                tc.defineCMacro("SIZE_MAX", size_max);
+            },
+            // The tool passes what it does not know to the C front end, after its own `--` too.
+            .tool => |run| {
+                run.addPrefixedDirectoryArg("-I", shim);
+                run.addArg(b.fmt("-DSIZE_MAX={s}", .{size_max}));
+            },
         }
     }
 }
@@ -43,8 +93,9 @@ pub fn applyMsvcIncludesToReachableTranslateC(
     roots: []const *std.Build.Step.Compile,
     libc_ini_path: []const u8,
 ) !void {
-    // `libc_ini_path` is absolute (resolved via `b.pathFromRoot`), so any Dir works as the base.
-    const data = try b.build_root.handle.readFileAlloc(b.graph.io, libc_ini_path, b.allocator, .unlimited);
+    // `libc_ini_path` is absolute (resolved against the build root).
+    b.dependOnFileContents(b.graph.cwdRelativePath(libc_ini_path));
+    const data = try std.Io.Dir.cwd().readFileAlloc(b.graph.io, libc_ini_path, b.allocator, .unlimited);
 
     var include_dir: ?[]const u8 = null;
     var sys_include_dir: ?[]const u8 = null;
@@ -66,42 +117,33 @@ pub fn applyMsvcIncludesToReachableTranslateC(
     const shared_dir = try std.fs.path.join(b.allocator, &.{ sdk_inc_root, "shared" });
     const winrt_dir = try std.fs.path.join(b.allocator, &.{ sdk_inc_root, "winrt" });
 
-    var seen_translate_c = std.AutoHashMap(*std.Build.Step.TranslateC, void).init(b.allocator);
-    defer seen_translate_c.deinit();
-
-    for (roots) |root_compile| {
-        const graph = root_compile.root_module.getGraph();
-        for (graph.modules) |mod| {
-            const root_src = mod.root_source_file orelse continue;
-            const gen = switch (root_src) {
-                .generated => |g| g,
-                else => continue,
-            };
-            const dep_step = gen.file.step;
-            if (dep_step.id != .translate_c) continue;
-
-            const tc: *std.Build.Step.TranslateC = @fieldParentPtr("step", dep_step);
-            const gop = try seen_translate_c.getOrPut(tc);
-            if (gop.found_existing) continue;
-
-            const rt = tc.target.result;
-            if (rt.os.tag == .windows and rt.abi == .msvc) {
-                // `translate-c` has no API to pass `--libc <ini>`, so `-lc` makes Zig
-                // auto-detect a system MSVC/SDK install — which fails on a Windows host
-                // that has no Visual Studio (we use the .velopack-msvc/ tree instead) with
-                // `WindowsSdkNotFound`. Drop `-lc` here: every MSVC/UCRT/SDK include dir is
-                // added explicitly below, so the headers still resolve, and the consuming
-                // exe links libc itself — the translated bindings don't need their own.
-                tc.link_libc = false;
-                // Shim + SIZE_MAX define are applied separately by `applyMsvcTranslateCShim`.
-                // Order matters: MSVC's own headers first (override Windows SDK declarations
-                // when both exist), then UCRT, then the Windows SDK trio.
-                tc.addSystemIncludePath(.{ .cwd_relative = sys_include_dir.? });
-                tc.addSystemIncludePath(.{ .cwd_relative = include_dir.? });
-                tc.addSystemIncludePath(.{ .cwd_relative = um_dir });
-                tc.addSystemIncludePath(.{ .cwd_relative = shared_dir });
-                tc.addSystemIncludePath(.{ .cwd_relative = winrt_dir });
-            }
-        }
-    }
+    for (try msvcTranslations(b, roots)) |t| switch (t) {
+        .step => |tc| {
+            // `translate-c` has no API to pass `--libc <ini>`, so `-lc` makes Zig
+            // auto-detect a system MSVC/SDK install — which fails on a Windows host
+            // that has no Visual Studio (we use the .velopack-msvc/ tree instead) with
+            // `WindowsSdkNotFound`. Drop `-lc` here: every MSVC/UCRT/SDK include dir is
+            // added explicitly below, so the headers still resolve, and the consuming
+            // exe links libc itself — the translated bindings don't need their own.
+            tc.link_libc = false;
+            // Shim + SIZE_MAX define are applied separately by `applyMsvcTranslateCShim`.
+            // Order matters: MSVC's own headers first (override Windows SDK declarations
+            // when both exist), then UCRT, then the Windows SDK trio.
+            tc.addSystemIncludePath(.{ .cwd_relative = sys_include_dir.? });
+            tc.addSystemIncludePath(.{ .cwd_relative = include_dir.? });
+            tc.addSystemIncludePath(.{ .cwd_relative = um_dir });
+            tc.addSystemIncludePath(.{ .cwd_relative = shared_dir });
+            tc.addSystemIncludePath(.{ .cwd_relative = winrt_dir });
+        },
+        // The `translate-c` tool takes the libc file itself and finds MSVC's include dirs in
+        // it. Its own flag, so it goes before the `--` that hands the rest to the C front end.
+        .tool => |run| {
+            const libc_arg: std.Build.Step.Run.Arg = .{ .bytes = b.fmt("--libc={s}", .{libc_ini_path}) };
+            const dashdash = for (run.argv.items, 0..) |arg, i| switch (arg) {
+                .bytes => |bytes| if (std.mem.eql(u8, bytes, "--")) break i,
+                else => {},
+            } else run.argv.items.len;
+            try run.argv.insert(b.graph.arena, dashdash, libc_arg);
+        },
+    };
 }
diff --git a/build/package.zig b/build/package.zig
index c96858943..a6711c82a 100644
--- a/build/package.zig
+++ b/build/package.zig
@@ -1,4 +1,5 @@
 const std = @import("std");
+const build_common = @import("common.zig");
 // Vendored Velopack glue — see build/velopack.zig header (never `@import("velopack_zig")`).
 const velopack = @import("velopack.zig");
 const exe = @import("exe.zig");
@@ -80,7 +81,7 @@ pub fn addSteps(opts: Options) *std.Build.Step {
         // release builds. Use `cmd /c exit 0` as the no-op and keep the
         // dependency on exe_for_package via the step graph.
         const host_is_windows = b.graph.host.result.os.tag == .windows;
-        const skip_strip = host_is_windows or optimize == .Debug or cross_for_strip;
+        const skip_strip = host_is_windows or optimize == .debug or cross_for_strip;
         const strip_release_sh = if (host_is_windows) blk: {
             const sh = b.addSystemCommand(&.{ "cmd", "/c", "exit", "0" });
             sh.step.dependOn(&exe_for_package.step);
@@ -91,12 +92,7 @@ pub fn addSteps(opts: Options) *std.Build.Step {
             break :blk sh;
         };
 
-        //const dotnet_tool_restore = velopack.addDotnetToolRestoreStep(b);
-        //const vpk_vendor_repair = velopack.addVpkVendorRepairStep(b);
-        //vpk_vendor_repair.step.dependOn(&dotnet_tool_restore.step);
-
-        const vpk_pkg_sh = b.addSystemCommand(&.{"dotnet"});
-        vpk_pkg_sh.addArg("vpk");
+        const vpk_pkg_sh = try velopack.addVpkRun(b, vz, target);
         // When packaging a foreign-OS bundle, vpk needs an OS directive (e.g. `vpk [win] pack ...`)
         // because by default it auto-detects from the host OS.
         if (cross_os) {
@@ -146,7 +142,7 @@ pub fn addSteps(opts: Options) *std.Build.Step {
             &strip_release_sh.step,
         );
         vpk_pkg_sh.addArg("--packDir");
-        vpk_pkg_sh.addArg(b.getInstallPath(.{ .custom = pack_input_subdir }, ""));
+        vpk_pkg_sh.addDirectoryArg(build_common.installDirPath(.{ .custom = pack_input_subdir }));
         switch (target.result.os.tag) {
             .windows => {
                 // Sets the installer's icon and the Start Menu shortcut icon. The
@@ -181,7 +177,7 @@ pub fn addSteps(opts: Options) *std.Build.Step {
                     // Without this, Apple's notary service rejects with "signature does not
                     // include a secure timestamp" / "hardened runtime not enabled".
                     vpk_pkg_sh.addArg("--signEntitlements");
-                    const entitlements_path = b.path("assets/macos/Fizzy.entitlements").getPath3(b, &vpk_pkg_sh.step).toString(b.allocator) catch |e| std.debug.panic("entitlements path: {}", .{e});
+                    const entitlements_path = b.root.joinString(b.allocator, "assets/macos/Fizzy.entitlements") catch |e| std.debug.panic("entitlements path: {}", .{e});
                     vpk_pkg_sh.addArg(entitlements_path);
                 }
                 if (macos_sign_install_identity) |id| {
@@ -200,15 +196,11 @@ pub fn addSteps(opts: Options) *std.Build.Step {
             },
             else => unreachable,
         }
-        vpk_pkg_sh.setEnvironmentVariable("DOTNET_ROLL_FORWARD", "Major");
         // Stream vpk's stdout/stderr live so failures surface their actual
         // diagnostic instead of just an exit-code-N message from the build
         // runner. With `addOutputDirectoryArg` in play, `infer_from_args`
         // can otherwise capture+drop stdio on certain runner configs.
         vpk_pkg_sh.stdio = .inherit;
-        try velopack.attachMksquashfsToVpkRun(b, vz, vpk_pkg_sh, target);
-
-        //vpk_pkg_sh.step.dependOn(&vpk_vendor_repair.step);
         vpk_pkg_sh.step.dependOn(pack_stage_tail);
 
         break :vpk vpk_pkg_out_dir;
@@ -246,7 +238,7 @@ pub fn addPackageAllStep(b: *std.Build, no_emit: bool) void {
     const msvc_options = [_][]const u8{ "windows-msvc-libc", "fetch-msvc" };
     var common: std.ArrayList([]const u8) = .empty;
     var msvc_only: std.ArrayList([]const u8) = .empty;
-    switch (b.release_mode) {
+    switch (b.graph.release_mode) {
         .off => {},
         .any => common.append(b.allocator, "--release") catch @panic("OOM"),
         else => |mode| common.append(b.allocator, b.fmt("--release={s}", .{@tagName(mode)})) catch @panic("OOM"),
@@ -256,7 +248,7 @@ pub fn addPackageAllStep(b: *std.Build, no_emit: bool) void {
         const name = entry.key_ptr.*;
         if (isOneOf(name, &target_options)) continue;
         const list = if (isOneOf(name, &msvc_options)) &msvc_only else &common;
-        switch (entry.value_ptr.value) {
+        switch (entry.value_ptr.*) {
             .flag => list.append(b.allocator, b.fmt("-D{s}", .{name})) catch @panic("OOM"),
             .scalar => |v| list.append(b.allocator, b.fmt("-D{s}={s}", .{ name, v })) catch @panic("OOM"),
             .list => |l| for (l.items) |v| list.append(b.allocator, b.fmt("-D{s}={s}", .{ name, v })) catch @panic("OOM"),
@@ -292,7 +284,7 @@ pub fn addPackageAllStep(b: *std.Build, no_emit: bool) void {
         if (std.mem.endsWith(u8, triple, "-windows-msvc")) zig_pkg_run.addArgs(msvc_only.items);
         // This build's own build file, from the cwd this build was run in (inherited): a
         // relative path option (`-Dapp-icon=…`) is relative to that cwd, as it was here.
-        zig_pkg_run.addArgs(&.{ "--build-file", b.pathFromRoot("build.zig") });
+        zig_pkg_run.addArgs(&.{ "--build-file", b.root.joinString(b.allocator, "build.zig") catch @panic("OOM") });
         if (prev_step) |p| zig_pkg_run.step.dependOn(p);
         prev_step = &zig_pkg_run.step;
     }
diff --git a/build/set_aside.zig b/build/set_aside.zig
new file mode 100644
index 000000000..16648d6d6
--- /dev/null
+++ b/build/set_aside.zig
@@ -0,0 +1,32 @@
+//! Set aside a running fizzy's executable before the build installs over it: run by a Run step
+//! on a Windows host, where a running program holds its file and the install fails. Renamed, the
+//! path is free, and the running app keeps its open file. Zig 0.17's build has no custom steps.
+//!
+//! Usage: `set_aside <install dir> <file name>`. Nothing installed yet, or not held: nothing to do.
+const std = @import("std");
+
+pub fn main(init: std.process.Init) !void {
+    const arena = init.arena.allocator();
+    const io = init.io;
+    const args = try init.minimal.args.toSlice(arena);
+    if (args.len != 3) {
+        std.debug.print("usage: set_aside <install dir> <file name>\n", .{});
+        std.process.exit(2);
+    }
+    const path = try std.fs.path.join(arena, &.{ args[1], args[2] });
+    const cwd = std.Io.Dir.cwd();
+    var file = cwd.openFile(io, path, .{ .mode = .read_write }) catch |err| switch (err) {
+        error.FileNotFound => return,
+        else => {
+            // Held: a running app. Renamed, the install's path is free.
+            const aside = try std.fmt.allocPrint(arena, "{s}.{d}.old", .{ path, std.Io.Clock.real.now(io).nanoseconds });
+            std.Io.Dir.rename(cwd, path, cwd, aside, io) catch |rename_err| {
+                std.log.warn("{s} is in use and could not be set aside ({t}); the install will fail until it quits", .{ path, rename_err });
+                return;
+            };
+            std.log.info("{s} is running: set aside as {s}", .{ path, std.fs.path.basename(aside) });
+            return;
+        },
+    };
+    file.close(io);
+}
diff --git a/build/velopack.zig b/build/velopack.zig
index e8f27a068..4fbe629dc 100644
--- a/build/velopack.zig
+++ b/build/velopack.zig
@@ -1,8 +1,11 @@
 //! Vendored Velopack build glue for the fizzy app build.
 //!
-//! Mirrors `~/dev/velopack-zig/build.zig`; keep in sync if that repo's layout changes.
+//! Mirrors graphl-tech/velopack-zig's `build.zig`; keep in sync if that repo's layout changes.
+//! Vendored rather than `@import("velopack_zig")`, which would make the lazy dependency eager in
+//! every consumer (AGENTS.md, "Keep the plugin build free of app-only dependencies").
 const std = @import("std");
 const builtin = @import("builtin");
+const common = @import("common.zig");
 
 /// The resolved `velopack_zig` dependency (from `b.lazyDependency("velopack_zig", .{})`).
 /// `vz.builder` is velopack-zig's own builder — the equivalent of velopack-zig's internal
@@ -10,6 +13,8 @@ const builtin = @import("builtin");
 pub const Dep = *std.Build.Dependency;
 
 var trim_velopack_tool: ?*std.Build.Step.Compile = null;
+var run_env_tool: ?*std.Build.Step.Compile = null;
+var c_modules_given: std.AutoHashMapUnmanaged(*std.Build.Module, void) = .empty;
 var dotnet_restore_cache: std.AutoHashMapUnmanaged(*std.Build, *std.Build.Step.Run) = .{};
 
 fn cachedDotnetToolRestore(b: *std.Build) *std.Build.Step.Run {
@@ -31,19 +36,63 @@ fn trimVelopackLibTool(vz: Dep) *std.Build.Step.Compile {
         .root_module = own.createModule(.{
             .root_source_file = vz.path("tools/trim_velopack_lib.zig"),
             .target = own.graph.host,
-            .optimize = .Debug,
+            .optimize = .debug,
         }),
     });
     trim_velopack_tool = t;
     return t;
 }
 
+/// velopack-zig's `tools/run_env.zig`: runs a command with environment changes applied when it
+/// runs. Zig 0.17's `Run.setEnvironmentVariable` copies the whole configure-time environment into
+/// the cached configuration, so a variable set later never reaches the command; and
+/// `Run.addPathDir` is gone. Every command here that needs its environment changed goes through it.
+fn runEnvTool(vz: Dep) *std.Build.Step.Compile {
+    if (run_env_tool) |t| return t;
+    const own = vz.builder;
+    const t = own.addExecutable(.{
+        .name = "run-env",
+        .root_module = own.createModule(.{
+            .root_source_file = vz.path("tools/run_env.zig"),
+            .target = own.graph.host,
+            .optimize = .debug,
+        }),
+    });
+    run_env_tool = t;
+    return t;
+}
+
+/// `dotnet vpk`, for `vpk pack` and the arguments the caller adds: with `DOTNET_ROLL_FORWARD`
+/// (vpk targets an older .NET than is typically installed) and, for a Linux target, the bundled
+/// `mksquashfs` on its PATH (for the AppImage).
+pub fn addVpkRun(b: *std.Build, vz: Dep, target: std.Build.ResolvedTarget) !*std.Build.Step.Run {
+    const run = b.addRunArtifact(runEnvTool(vz));
+    run.addArgs(&.{ "--env", "DOTNET_ROLL_FORWARD=Major" });
+    if (target.result.os.tag == .linux) if (try buildMksquashfs(vz)) |m| {
+        run.addArg("--path");
+        run.addDirectoryArg(m.bin_dir);
+    };
+    run.addArgs(&.{ "--", "dotnet", "vpk" });
+    return run;
+}
+
+/// `Velopack.h` as a Zig module, through translate-c: Zig 0.17 removed `@cImport`. Imported as
+/// `velopack_c` by the modules `linkVelopack` is given.
+fn velopackCModule(b: *std.Build, vz: Dep, target: std.Build.ResolvedTarget, optimize: std.builtin.OptimizeMode) *std.Build.Module {
+    const tc = b.addTranslateC(.{
+        .root_source_file = vz.builder.dependency("velopack", .{}).path("include/Velopack.h"),
+        .target = target,
+        .optimize = optimize,
+    });
+    return tc.createModule();
+}
+
 pub const LinkVelopackOptions = struct {
     target: std.Build.ResolvedTarget,
     optimize: std.builtin.OptimizeMode,
-    /// Other modules that `@cImport` `Velopack.h` — the `app` module's updater does, and an
-    /// include path on the exe's root module does not reach another module's C imports.
-    include_modules: []const *std.Build.Module = &.{},
+    /// Modules that call Velopack's C API (the `app` module's updater does): each gets
+    /// `Velopack.h` as the `velopack_c` import.
+    c_modules: []const *std.Build.Module = &.{},
 };
 
 /// Add include path + the correct prebuilt static lib + Windows ws2_32/bcrypt +
@@ -57,8 +106,11 @@ pub fn linkVelopack(
     const velopack_dep = vz.builder.dependency("velopack", .{});
     const target = opts.target;
 
-    compile.root_module.addIncludePath(velopack_dep.path("include"));
-    for (opts.include_modules) |m| m.addIncludePath(velopack_dep.path("include"));
+    // Once per module: the integration, demo and bench tests share one `app` module.
+    for (opts.c_modules) |m| {
+        const gop = c_modules_given.getOrPut(b.allocator, m) catch @panic("OOM");
+        if (!gop.found_existing) m.addImport("velopack_c", velopackCModule(b, vz, target, opts.optimize));
+    }
 
     const lib_name = switch (target.result.os.tag) {
         .linux => switch (target.result.cpu.arch) {
@@ -114,43 +166,20 @@ pub fn linkVelopack(
 }
 
 pub const MksquashfsBuild = struct {
-    step: *std.Build.Step,
-    bin_dir: []const u8,
+    /// The directory holding `mksquashfs`, resolved when the build runs.
+    bin_dir: std.Build.LazyPath,
 };
 
-/// Build the bundled mksquashfs for Linux AppImage packaging. Returns null on
-/// non-Linux hosts and on the first build before the lazy `squashfs` dep is fetched.
-pub fn buildMksquashfs(b: *std.Build, vz: Dep) !?MksquashfsBuild {
+/// Build the bundled mksquashfs for Linux AppImage packaging. Returns null on Windows hosts and
+/// on the first build before the lazy `squashfs` dep is fetched.
+pub fn buildMksquashfs(vz: Dep) !?MksquashfsBuild {
     const own = vz.builder;
     if (own.graph.host.result.os.tag == .windows) return null;
-
     const dep = own.lazyDependency("squashfs", .{
         .target = own.graph.host,
-        .optimize = .ReleaseFast,
+        .optimize = .fast,
     }) orelse return null;
-
-    const mksquashfs_art = dep.artifact("mksquashfs");
-    const install_mksquashfs = b.addInstallArtifact(mksquashfs_art, .{
-        .dest_dir = .{ .override = .{ .custom = "velopack-mksquashfs" } },
-    });
-
-    return MksquashfsBuild{
-        .step = &install_mksquashfs.step,
-        .bin_dir = b.getInstallPath(.{ .custom = "velopack-mksquashfs" }, ""),
-    };
-}
-
-/// Wire the bundled mksquashfs into a `vpk pack` Run for Linux targets (no-op otherwise).
-pub fn attachMksquashfsToVpkRun(
-    b: *std.Build,
-    vz: Dep,
-    run: *std.Build.Step.Run,
-    target: std.Build.ResolvedTarget,
-) !void {
-    if (target.result.os.tag != .linux) return;
-    const built = (try buildMksquashfs(b, vz)) orelse return;
-    run.addPathDir(built.bin_dir);
-    run.step.dependOn(built.step);
+    return .{ .bin_dir = dep.artifact("mksquashfs").getEmittedBin().dirname() };
 }
 
 /// Install MSVC + Windows SDK into `<build_root>/<install_dir>` and emit zig-libc-*.ini,
@@ -161,33 +190,38 @@ pub fn addMsvcupSetupStep(
     install_dir: ?[]const u8,
 ) *std.Build.Step.Run {
     const resolved_install_dir: []const u8 = if (install_dir) |p|
-        if (std.fs.path.isAbsolute(p)) b.dupePath(p) else b.pathFromRoot(p)
+        if (std.fs.path.isAbsolute(p)) b.dupePath(p) else (b.root.joinString(b.allocator, p) catch @panic("OOM"))
     else
-        b.pathFromRoot(".velopack-msvc");
+        (b.root.joinString(b.allocator, ".velopack-msvc") catch @panic("OOM"));
 
-    const env_path = vz.path("tools/msvcup.env").getPath3(b, null).toString(b.allocator) catch |e|
+    const env_path = vz.builder.root.joinString(b.allocator, "tools/msvcup.env") catch |e|
         std.debug.panic("velopack: resolve msvcup.env: {}", .{e});
-    const gen_path = vz.path("tools/gen_zig_libc_msvc.zig").getPath3(b, null).toString(b.allocator) catch |e|
+    const gen_path = vz.builder.root.joinString(b.allocator, "tools/gen_zig_libc_msvc.zig") catch |e|
         std.debug.panic("velopack: resolve gen_zig_libc_msvc.zig: {}", .{e});
 
-    const run: *std.Build.Step.Run = switch (builtin.target.os.tag) {
-        .windows => blk: {
-            const script_path = vz.path("tools/setup-msvc.ps1").getPath3(b, null).toString(b.allocator) catch |e|
+    // Through `run_env`, not `setEnvironmentVariable` (see `runEnvTool`).
+    const run = b.addRunArtifact(runEnvTool(vz));
+    run.addArgs(&.{
+        "--env", b.fmt("VELOPACK_ZIG_ENV_FILE={s}", .{env_path}),
+        "--env", b.fmt("VELOPACK_ZIG_GEN_SCRIPT={s}", .{gen_path}),
+        "--env", b.fmt("VELOPACK_ZIG_ZIG={s}", .{b.graph.zig_exe}),
+        "--",
+    });
+    switch (builtin.target.os.tag) {
+        .windows => {
+            const script_path = vz.builder.root.joinString(b.allocator, "tools/setup-msvc.ps1") catch |e|
                 std.debug.panic("velopack: resolve setup-msvc.ps1: {}", .{e});
-            break :blk b.addSystemCommand(&.{
+            run.addArgs(&.{
                 "powershell", "-NoProfile", "-ExecutionPolicy",   "Bypass",
                 "-File",      script_path,  resolved_install_dir,
             });
         },
-        else => blk: {
-            const script_path = vz.path("tools/setup-msvc.sh").getPath3(b, null).toString(b.allocator) catch |e|
+        else => {
+            const script_path = vz.builder.root.joinString(b.allocator, "tools/setup-msvc.sh") catch |e|
                 std.debug.panic("velopack: resolve setup-msvc.sh: {}", .{e});
-            break :blk b.addSystemCommand(&.{ "bash", script_path, resolved_install_dir });
+            run.addArgs(&.{ "bash", script_path, resolved_install_dir });
         },
-    };
-    run.setEnvironmentVariable("VELOPACK_ZIG_ENV_FILE", env_path);
-    run.setEnvironmentVariable("VELOPACK_ZIG_GEN_SCRIPT", gen_path);
-    run.setEnvironmentVariable("VELOPACK_ZIG_ZIG", b.graph.zig_exe);
+    }
     return run;
 }
 
@@ -213,7 +247,8 @@ pub fn resolveWindowsMsvcLibc(
         return .{ .libc_path = null, .needs_setup = false };
 
     if (opts.explicit_path) |p| {
-        const abs = if (std.fs.path.isAbsolute(p)) b.dupePath(p) else b.pathFromRoot(p);
+        const abs = if (std.fs.path.isAbsolute(p)) b.dupePath(p) else (b.root.joinString(b.allocator, p) catch @panic("OOM"));
+        b.dependOnFileContents(b.graph.cwdRelativePath(abs));
         return .{ .libc_path = abs, .needs_setup = false };
     }
 
@@ -224,13 +259,14 @@ pub fn resolveWindowsMsvcLibc(
     };
     const rel = b.fmt("{s}/zig-libc-{s}.ini", .{ opts.install_dir_name, arch_suffix });
 
+    common.dependOnPathExistence(b, rel);
     const exists = blk: {
-        b.build_root.handle.access(b.graph.io, rel, .{}) catch break :blk false;
+        b.root.access(b.graph.io, rel, .{}) catch break :blk false;
         break :blk true;
     };
 
-    if (exists) return .{ .libc_path = b.pathFromRoot(rel), .needs_setup = false };
-    if (opts.fetch_if_missing) return .{ .libc_path = b.pathFromRoot(rel), .needs_setup = true };
+    if (exists) return .{ .libc_path = (b.root.joinString(b.allocator, rel) catch @panic("OOM")), .needs_setup = false };
+    if (opts.fetch_if_missing) return .{ .libc_path = (b.root.joinString(b.allocator, rel) catch @panic("OOM")), .needs_setup = true };
     return .{ .libc_path = null, .needs_setup = false };
 }
 
diff --git a/build/web.zig b/build/web.zig
index 52790322e..126cd4bc1 100644
--- a/build/web.zig
+++ b/build/web.zig
@@ -1,4 +1,5 @@
 const std = @import("std");
+const common = @import("common.zig");
 const helpers = @import("../plugins/shared/build/helpers.zig");
 const core_mod = @import("fizzy_sdk").core_module;
 const plugins = @import("plugins.zig");
@@ -66,7 +67,7 @@ pub fn addSteps(
             .optimize = optimize,
             .link_libc = false,
             .single_threaded = true,
-            .strip = optimize == .ReleaseFast or optimize == .ReleaseSmall,
+            .strip = optimize == .fast or optimize == .small,
         }),
     });
     web_exe.entry = .disabled;
@@ -204,7 +205,8 @@ pub fn addSteps(
     for (web_plugin_dirs) |wp| {
         const dir = wp.dir;
         const zon_path = b.pathJoin(&.{ dir, "plugin.zig.zon" });
-        b.build_root.handle.access(b.graph.io, zon_path, .{}) catch {
+        common.dependOnPathExistence(b, zon_path);
+        b.root.access(b.graph.io, zon_path, .{}) catch {
             std.debug.print("fizzy web: plugin checkout '{s}' not found; the web build goes without it\n", .{dir});
             continue;
         };
@@ -309,7 +311,11 @@ pub fn addSteps(
     }
     for (web_pages.items) |page| {
         const web_dir = b.pathJoin(&.{ page.dir, "web" });
-        var d = b.build_root.handle.openDir(b.graph.io, web_dir, .{ .iterate = true }) catch continue;
+        var d = b.root.openDir(b.graph.io, web_dir, .{ .iterate = true }) catch {
+            common.dependOnPathExistence(b, web_dir);
+            continue;
+        };
+        b.dependOnDirectoryContents(b.path(web_dir));
         defer d.close(b.graph.io);
         var it = d.iterate();
         while (it.next(b.graph.io) catch null) |entry| {
@@ -361,7 +367,8 @@ fn stampStorage(b: *std.Build) std.Build.LazyPath {
         else => std.debug.panic("-Dweb-storage={s}: only a-z, 0-9, '-' and '_'", .{name}),
     };
     const token = "__FIZZY_WEB_STORAGE__";
-    const html = b.build_root.handle.readFileAlloc(b.graph.io, "web/index.html", b.allocator, .unlimited) catch |err|
+    b.dependOnFileContents(b.path("web/index.html"));
+    const html = std.Io.Dir.cwd().readFileAlloc(b.graph.io, b.root.joinString(b.allocator, "web/index.html") catch @panic("OOM"), b.allocator, .unlimited) catch |err|
         std.debug.panic("web/index.html: {t}", .{err});
     if (std.mem.indexOf(u8, html, token) == null) std.debug.panic("web/index.html: no {s} to stamp", .{token});
     const stamped = std.mem.replaceOwned(u8, b.allocator, html, token, name) catch @panic("OOM");
@@ -391,7 +398,9 @@ fn demoTapes(b: *std.Build) std.Build.LazyPath {
     tool.root_module.addImport("demos", demos);
     const run = b.addRunArtifact(tool);
     const out = run.addOutputDirectoryArg("demos");
-    var dir = b.build_root.handle.openDir(b.graph.io, "docs/demos", .{ .iterate = true }) catch |err|
+    // Declared, so a demo added or removed reconfigures the build.
+    b.dependOnDirectoryContents(b.path("docs/demos"));
+    var dir = b.root.openDir(b.graph.io, "docs/demos", .{ .iterate = true }) catch |err|
         std.debug.panic("docs/demos: {t}", .{err});
     defer dir.close(b.graph.io);
     var it = dir.iterate();
diff --git a/core/Fling.zig b/core/Fling.zig
index a8e87c415..03fc0f049 100644
--- a/core/Fling.zig
+++ b/core/Fling.zig
@@ -48,7 +48,7 @@ last_drag_ns: i128 = 0,
 // `touchend`, so the last-frame estimate reads a near-random speed. These fields track
 // the recent (position, time) history so release velocity can be averaged over a fixed
 // time window instead — immune to a dropped final move and to frame-timing jitter.
-hist: [hist_cap]TimedSample = [_]TimedSample{.{}} ** hist_cap,
+hist: [hist_cap]TimedSample = @splat(.{}),
 hist_head: usize = 0,
 hist_len: usize = 0,
 hist_pos: f32 = 0,
diff --git a/core/core.zig b/core/core.zig
index 901025514..368bd8724 100644
--- a/core/core.zig
+++ b/core/core.zig
@@ -76,6 +76,9 @@ pub const anchor = @import("replay").anchor;
 pub const screens = @import("screens.zig");
 /// Glass the OS draws in place of the app's: a view drag's, as Liquid Glass on macOS 26.
 pub const native_glass = @import("native_glass.zig");
+/// What the app's windows are made of, as the backend can show it: the one material every glass
+/// in the app and every OS window follows.
+pub const material = @import("material.zig");
 
 /// Generic momentum/fling helper (pan, scrub, cover-flow).
 pub const Fling = @import("Fling.zig");
diff --git a/core/corners.zig b/core/corners.zig
index 6e71485c9..2b30f5251 100644
--- a/core/corners.zig
+++ b/core/corners.zig
@@ -26,7 +26,7 @@ pub const control: f32 = 10;
 pub const row: f32 = 4;
 pub const small: f32 = 6;
 
-const publish_id: dvui.Id = @enumFromInt(0x6669_7a7a_636f_726e); // "fizzcorn"
+const publish_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_636f_726e)); // "fizzcorn"
 const publish_key = "_corner_roundness";
 
 /// Host only, each frame: the Corner roundness setting, 0 (square) to 1 (twice as round).
diff --git a/core/darwin_spawn.zig b/core/darwin_spawn.zig
index c84824165..bcf9cf0b0 100644
--- a/core/darwin_spawn.zig
+++ b/core/darwin_spawn.zig
@@ -175,7 +175,7 @@ fn buildArgv(gpa: std.mem.Allocator, items: []const []const u8) ![:null]?[*:0]co
         gpa.free(argv);
     }
     for (items, 0..) |item, i| {
-        argv[i] = (try gpa.dupeZ(u8, item)).ptr;
+        argv[i] = (try gpa.dupeSentinel(u8, item, 0)).ptr;
         built = i + 1;
     }
     return argv;
diff --git a/core/dialogs.zig b/core/dialogs.zig
index 169d1d21b..52cdfca54 100644
--- a/core/dialogs.zig
+++ b/core/dialogs.zig
@@ -800,7 +800,7 @@ pub fn dialog(src: std.builtin.SourceLocation, opts: DialogOptions) dvui.IdMutex
         dvui.dataSet(opts.window, id, "_max_size", ms);
     }
     dvui.dataSet(opts.window, id, "_open", true);
-    dvui.dataSet(opts.window, id, "_header_kind", @intFromEnum(opts.header_kind));
+    dvui.dataSet(opts.window, id, "_header_kind", @backingInt(opts.header_kind));
 
     return id_mutex;
 }
@@ -908,10 +908,10 @@ pub fn dialogWindow(id: dvui.Id) anyerror!void {
         defer vbox.deinit();
 
         const header_kind: DialogHeaderKind = switch (dvui.dataGet(null, id, "_header_kind", u8) orelse 0) {
-            @intFromEnum(DialogHeaderKind.none) => .none,
-            @intFromEnum(DialogHeaderKind.info) => .info,
-            @intFromEnum(DialogHeaderKind.warning) => .warning,
-            @intFromEnum(DialogHeaderKind.err) => .err,
+            @backingInt(DialogHeaderKind.none) => .none,
+            @backingInt(DialogHeaderKind.info) => .info,
+            @backingInt(DialogHeaderKind.warning) => .warning,
+            @backingInt(DialogHeaderKind.err) => .err,
             else => .none,
         };
 
@@ -1706,7 +1706,7 @@ fn bubbleSpinnerPaintCheck(rs: dvui.RectScale, grow: f32, alpha: f32) void {
 /// Subwindow id used for save-complete toasts. Distinct from the canvas subwindow so
 /// `Workspace.drawCanvas`'s `toastsShow` won't render them — instead `Editor.drawSaveToasts`
 /// iterates this id and renders centered cards matching the loading-overlay style.
-pub const save_toast_subwindow_id: dvui.Id = @enumFromInt(0xF12_5A4E_71D0_5A4E);
+pub const save_toast_subwindow_id: dvui.Id = @fromBackingInt(@intCast(0xF12_5A4E_71D0_5A4E));
 
 /// Custom toast display for save-complete events. Visually matches `Editor.drawLoadingOverlay`:
 /// content-fill @ 0.85 background, drop shadow, checkmark icon + "Saved <basename>" label.
diff --git a/core/gfx/FrameTarget.zig b/core/gfx/FrameTarget.zig
index dbfb8706c..461209214 100644
--- a/core/gfx/FrameTarget.zig
+++ b/core/gfx/FrameTarget.zig
@@ -65,7 +65,7 @@ const skip_unread = builtin.target.cpu.arch == .wasm32;
 /// should not flip it on and off, and glass coming back finds it still there.
 const linger_frames: u32 = 60;
 
-const unseen_id: dvui.Id = @enumFromInt(0x6669_7a7a_756e_736e); // "fizzunsn"
+const unseen_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_756e_736e)); // "fizzunsn"
 const unseen_key = "_frame_unseen";
 
 /// Mark the frame running as one nobody will see — a demo catching up (`automation.Player.frames`)
@@ -90,7 +90,7 @@ pub fn unseen() bool {
     return dvui.dataGet(null, unseen_id, unseen_key, bool) orelse false;
 }
 
-const want_id: dvui.Id = @enumFromInt(0x6669_7a7a_6672_6d77); // "fizzfrmw"
+const want_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_6672_6d77)); // "fizzfrmw"
 const want_key = "_frame_target_wanted";
 
 /// Something will read what is under it this frame (a frost, `BlurBackdrop`) — keep the frame in
diff --git a/core/gfx/LiquidField.zig b/core/gfx/LiquidField.zig
index 45eb62d10..b216613a5 100644
--- a/core/gfx/LiquidField.zig
+++ b/core/gfx/LiquidField.zig
@@ -258,7 +258,7 @@ fn enabled() bool {
     return dvui.dataGet(null, enabled_id, "_liquid_field", bool) orelse true;
 }
 
-const enabled_id: dvui.Id = @enumFromInt(0x6c69_7166);
+const enabled_id: dvui.Id = @fromBackingInt(@intCast(0x6c69_7166));
 
 /// Whether the window is opaque behind its content — no desktop material shows through it (Linux,
 /// the web) — published each frame by the app. The glass is as see-through as what it covers
@@ -337,7 +337,7 @@ pub fn draw(self: *const LiquidField, frost: dvui.Texture, covered: dvui.Rect.Ph
     if (!h.begin(id, &textures, textures.len, u.vec4s(), uniform_vec4s)) return false;
     defer h.end();
     for ([_]programs.Blend{ .punch, .add }) |pass| {
-        h.blend(@intFromEnum(pass));
+        h.blend(@backingInt(pass));
         self.quads(groups, pass == .add, frost);
     }
     return true;
diff --git a/core/gfx/image.zig b/core/gfx/image.zig
index 6f8c214d3..99564b2fb 100644
--- a/core/gfx/image.zig
+++ b/core/gfx/image.zig
@@ -187,7 +187,7 @@ pub fn checkerboardTile(width: u32, height: u32, even: [4]u8, odd: [4]u8) ?dvui.
     const size_f: dvui.Size = .{ .w = @floatFromInt(width), .h = @floatFromInt(height) };
     for (buf, 0..) |*p, i| {
         const rgba = if (math.checker(size_f, i)) even else odd;
-        p.* = @bitCast(rgba);
+        p.* = .{ .r = rgba[0], .g = rgba[1], .b = rgba[2], .a = rgba[3] };
     }
 
     return dvui.textureCreate(buf, .{
@@ -209,7 +209,7 @@ pub fn cachedTexture(source: dvui.ImageSource) dvui.ImageSource {
         .imageFile => |f| f,
         else => return source,
     };
-    const id: dvui.Id = @enumFromInt(@as(u64, @intFromPtr(file.bytes.ptr)) ^ file.bytes.len);
+    const id: dvui.Id = @fromBackingInt(@intCast(@as(u64, @intFromPtr(file.bytes.ptr)) ^ file.bytes.len));
     if (dvui.dataGet(null, id, "_image_texture_key", u64)) |key| {
         if (dvui.textureGetCached(key)) |tex| return .{ .texture = tex };
     }
@@ -426,8 +426,8 @@ pub fn blitData(src_pixels: [][4]u8, src_width: usize, src_height: usize, dst_pi
                 const bot_c = dvui.Color{ .r = bot_px[0], .g = bot_px[1], .b = bot_px[2], .a = bot_px[3] };
                 const tpm = dvui.Color.PMA.fromColor(top_c);
                 const bpm = dvui.Color.PMA.fromColor(bot_c);
-                const out_pma = math.blendPmaSrcOver(@bitCast(tpm), @bitCast(bpm));
-                top_px.* = @as(dvui.Color.PMA, @bitCast(out_pma)).toColor().toRGBA();
+                const out_pma = math.blendPmaSrcOver(std.mem.toBytes(tpm), std.mem.toBytes(bpm));
+                top_px.* = std.mem.bytesToValue(dvui.Color.PMA, &out_pma).toColor().toRGBA();
             }
         }
 
@@ -551,3 +551,11 @@ pub fn writeToJpgPpi(source: dvui.ImageSource, path: []const u8, ppi: u16) !void
     try enc.writeWithQuality(flat.data, flat.w, flat.h, 90);
     try writer.end();
 }
+
+test "blitData blends a transparent blit over what it covers" {
+    // Nothing in fizzy calls `blitData`, so this test is what compiles it (pixi does call it).
+    var into = [_][4]u8{.{ 0, 0, 0, 0 }};
+    var from = [_][4]u8{.{ 255, 0, 0, 255 }};
+    blitData(&into, 1, 1, &from, .{ .x = 0, .y = 0, .w = 1, .h = 1 }, true);
+    try std.testing.expectEqual([4]u8{ 255, 0, 0, 255 }, into[0]);
+}
diff --git a/core/gfx/liquid_glass.zig b/core/gfx/liquid_glass.zig
index 50b5fb199..b898c4ec8 100644
--- a/core/gfx/liquid_glass.zig
+++ b/core/gfx/liquid_glass.zig
@@ -441,7 +441,7 @@ fn paneKey(r: dvui.Rect.Physical, radii: Radii, scale: f32, mod: dvui.Color, loo
 }
 
 fn meshId(key: u64) dvui.Id {
-    return @enumFromInt(key);
+    return @fromBackingInt(@intCast(key));
 }
 
 fn cachedMesh(key: u64) ?dvui.Triangles {
diff --git a/core/gfx/perf.zig b/core/gfx/perf.zig
index 6965b43b5..3578b54a0 100644
--- a/core/gfx/perf.zig
+++ b/core/gfx/perf.zig
@@ -23,7 +23,7 @@ pub inline fn nanoTimestamp() i128 {
 }
 
 /// Enable perf recording in Debug and ReleaseSafe builds.
-pub const record: bool = builtin.mode == .Debug or builtin.mode == .ReleaseSafe;
+pub const record: bool = builtin.mode == .debug or builtin.mode == .safe;
 
 /// Lightweight drawing-specific counters active in ALL build modes.
 pub var draw_event_count: u32 = 0;
diff --git a/core/gfx/programs.zig b/core/gfx/programs.zig
index 73b527c77..f7e027196 100644
--- a/core/gfx/programs.zig
+++ b/core/gfx/programs.zig
@@ -120,7 +120,7 @@ pub const Hooks = extern struct {
     end: *const fn () callconv(.c) void,
 };
 
-const publish_id: dvui.Id = @enumFromInt(0x6669_7a7a_7072_6f67); // "fizzprog"
+const publish_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_7072_6f67)); // "fizzprog"
 const publish_key = "_programs";
 
 /// Host only, once a frame: publish this backend's programs, if it has any.
@@ -241,7 +241,7 @@ pub const Program = struct {
             },
             .asked => {},
         }
-        return switch (@as(Status, @enumFromInt(h.status(self.id)))) {
+        return switch (@as(Status, @fromBackingInt(@intCast(h.status(self.id))))) {
             .ready => blk: {
                 if (!self.logged) {
                     self.logged = true;
@@ -349,7 +349,7 @@ const Job = struct {
         const h = hooks() orelse return;
         if (!h.begin(self.program, &self.textures, self.n_textures, self.uniforms.ptr, @intCast(self.uniforms.len))) return;
         defer h.end();
-        h.blend(@intFromEnum(self.blend));
+        h.blend(@backingInt(self.blend));
         dvui.renderTriangles(self.triangles, self.tex) catch {};
     }
 };
diff --git a/core/gfx/water_surface.zig b/core/gfx/water_surface.zig
index c42c2f2dd..01d267bfc 100644
--- a/core/gfx/water_surface.zig
+++ b/core/gfx/water_surface.zig
@@ -40,8 +40,8 @@ const max_height: f32 = 1.85;
 const max_vel: f32 = 10.5;
 
 pub const WaterSurface = struct {
-    height: [grid_n]f32 = .{0} ** grid_n,
-    vel: [grid_n]f32 = .{0} ** grid_n,
+    height: [grid_n]f32 = @splat(0),
+    vel: [grid_n]f32 = @splat(0),
 
     /// Re-anchor the field when the focused slot shifts by `slots` (so in-flight
     /// ripples keep travelling with the shelf). `new[i] = old[i + slots*cols]`.
diff --git a/core/hitch.zig b/core/hitch.zig
index 0ad354e37..efeeb7936 100644
--- a/core/hitch.zig
+++ b/core/hitch.zig
@@ -16,7 +16,7 @@ pub const Phase = enum {
     draw,
 };
 
-const phase_count = @typeInfo(Phase).@"enum".fields.len;
+const phase_count = @typeInfo(Phase).@"enum".field_names.len;
 
 pub var enabled: bool = false;
 var threshold_ns: u64 = 16 * std.time.ns_per_ms;
@@ -47,7 +47,7 @@ pub const Timer = struct {
     pub fn end(self: Timer) void {
         self.prof.end();
         if (!enabled) return;
-        phase_ns[@intFromEnum(self.phase)] +%= @intCast(now() - self.start);
+        phase_ns[@backingInt(self.phase)] +%= @intCast(now() - self.start);
     }
 };
 
@@ -73,12 +73,12 @@ pub fn frameEnd() void {
         .{
             frame_index,
             ms(total),
-            ms(phase_ns[@intFromEnum(Phase.watchers)]),
-            ms(phase_ns[@intFromEnum(Phase.loading_jobs)]),
-            ms(phase_ns[@intFromEnum(Phase.rebuild_workspaces)]),
-            ms(phase_ns[@intFromEnum(Phase.plugin_hooks)]),
-            ms(phase_ns[@intFromEnum(Phase.draw)]),
-            ms(total -| accounted -| phase_ns[@intFromEnum(Phase.draw)]),
+            ms(phase_ns[@backingInt(Phase.watchers)]),
+            ms(phase_ns[@backingInt(Phase.loading_jobs)]),
+            ms(phase_ns[@backingInt(Phase.rebuild_workspaces)]),
+            ms(phase_ns[@backingInt(Phase.plugin_hooks)]),
+            ms(phase_ns[@backingInt(Phase.draw)]),
+            ms(total -| accounted -| phase_ns[@backingInt(Phase.draw)]),
         },
     );
 }
diff --git a/core/material.zig b/core/material.zig
new file mode 100644
index 000000000..24eabd905
--- /dev/null
+++ b/core/material.zig
@@ -0,0 +1,74 @@
+//! What the app's windows are made of: an opaque window (`none`, the default), or one that shows
+//! what is behind it — through clear window colour (`transparent`), blurred (`blur`), frosted
+//! (`frost`), or as Liquid Glass (`liquid`) — and how much of the window's colour covers it
+//! (`opacity`). One for the app: every OS window the backend shows takes it, and every glass the
+//! app draws reads it (`get`), so they look as one.
+//!
+//! The backend says which kinds it can show; a kind asked for and not offered falls back to the
+//! best one below it that is (`Material.effective`). The app publishes the result each frame before
+//! anything draws (`publish`): in dvui's data, as `native_glass` is, so a plugin's glass reads the
+//! same value as fizzy's.
+//!
+//! `Material`, `Kind`, `Kinds` and `effective` are std-only (a unit-test root in `build/app.zig`);
+//! only `publish` and `get` reach dvui.
+const std = @import("std");
+
+pub const Material = struct {
+    kind: Kind = .none,
+    /// How much of the theme's window colour covers what is behind, 0 (clear) to 1. Ignored by
+    /// `none`; `transparent` at 1 looks as `none` does.
+    opacity: f32 = 1,
+
+    /// `kind`, or the best kind below it in `offered`: `none` at the least.
+    pub fn effective(self: Material, offered: Kinds) Material {
+        var k = @backingInt(self.kind);
+        while (k > 0) : (k -= 1) {
+            if (offered.has(@fromBackingInt(k))) return .{ .kind = @fromBackingInt(k), .opacity = self.opacity };
+        }
+        return .{ .kind = .none, .opacity = self.opacity };
+    }
+};
+
+/// From the plainest to the richest: what `Material.effective` falls back through.
+pub const Kind = enum(u8) { none, transparent, blur, frost, liquid };
+
+/// The kinds a backend offers. A backend offers a kind only if every surface it puts glass on can
+/// show it: a backend whose OS windows can only frost offers no `liquid`, so glass drawn in the app
+/// frosts too and the look stays one.
+pub const Kinds = packed struct {
+    none: bool = true,
+    transparent: bool = false,
+    blur: bool = false,
+    frost: bool = false,
+    liquid: bool = false,
+
+    pub fn has(self: Kinds, kind: Kind) bool {
+        return switch (kind) {
+            inline else => |k| @field(self, @tagName(k)),
+        };
+    }
+};
+
+const key = "core.material";
+
+/// The material this frame, as the backend can show it, set by the app before anything draws.
+pub fn publish(m: Material) void {
+    const dvui = @import("dvui");
+    dvui.dataSet(null, dvui.Id.update(.zero, key), "_material", m);
+}
+
+/// The material every glass draws in this frame (`publish`): `none` until the app says.
+pub fn get() Material {
+    const dvui = @import("dvui");
+    return dvui.dataGet(null, dvui.Id.update(.zero, key), "_material", Material) orelse .{};
+}
+
+test "effective falls back to the best kind offered below the one asked" {
+    const mac_old: Kinds = .{ .transparent = true, .blur = true, .frost = true };
+    try std.testing.expectEqual(Kind.frost, (Material{ .kind = .liquid }).effective(mac_old).kind);
+    try std.testing.expectEqual(Kind.blur, (Material{ .kind = .blur }).effective(mac_old).kind);
+    const windows: Kinds = .{ .transparent = true, .frost = true };
+    try std.testing.expectEqual(Kind.transparent, (Material{ .kind = .blur }).effective(windows).kind);
+    try std.testing.expectEqual(Kind.none, (Material{ .kind = .liquid }).effective(.{}).kind);
+    try std.testing.expectEqual(@as(f32, 0.4), (Material{ .kind = .liquid, .opacity = 0.4 }).effective(windows).opacity);
+}
diff --git a/core/math/direction.zig b/core/math/direction.zig
index e9309e68a..6b3ff7a4d 100644
--- a/core/math/direction.zig
+++ b/core/math/direction.zig
@@ -66,7 +66,7 @@ pub const Direction = enum(u8) {
                     if (vy > 0) d = 0b0000_0001 else if (vy < 0) d = 0b0000_0011;
                 }
 
-                return @as(Direction, @enumFromInt(d));
+                return @as(Direction, @fromBackingInt(@intCast(d)));
             },
 
             8 => {
@@ -84,7 +84,7 @@ pub const Direction = enum(u8) {
                     if (vy > 0) d = d | 0b0000_0001 else if (vy < 0) d = d | 0b0000_0011;
                 }
 
-                return @as(Direction, @enumFromInt(d));
+                return @as(Direction, @fromBackingInt(@intCast(d)));
             },
             else => @compileError("Direction size is unsupported"),
         };
@@ -107,17 +107,17 @@ pub const Direction = enum(u8) {
             d = d | 0b0000_0011;
         }
 
-        return @as(Direction, @enumFromInt(d));
+        return @as(Direction, @fromBackingInt(@intCast(d)));
     }
 
     /// Returns horizontal axis of the direction.
     pub fn x(self: Direction) f32 {
-        return @as(f32, @floatFromInt(@as(i8, @bitCast(@intFromEnum(self))) << 4 >> 6));
+        return @as(f32, @floatFromInt(@as(i8, @bitCast(@backingInt(self))) << 4 >> 6));
     }
 
     /// Returns vertical axis of the direction.
     pub fn y(self: Direction) f32 {
-        return @as(f32, @floatFromInt(@as(i8, @bitCast(@intFromEnum(self))) << 6 >> 6));
+        return @as(f32, @floatFromInt(@as(i8, @bitCast(@backingInt(self))) << 6 >> 6));
     }
 
     // /// Returns direction as a F32x4.
diff --git a/core/math/easing.zig b/core/math/easing.zig
index c62de4aa8..1aea311a5 100644
--- a/core/math/easing.zig
+++ b/core/math/easing.zig
@@ -59,8 +59,8 @@ test "square and flip are inverses through identity" {
 }
 
 test "ease pins endpoints regardless of curve" {
-    inline for (@typeInfo(EaseType).@"enum".fields) |f| {
-        const kind: EaseType = @enumFromInt(f.value);
+    inline for (@typeInfo(EaseType).@"enum".field_names, @typeInfo(EaseType).@"enum".field_values) |_, f_value| {
+        const kind: EaseType = @fromBackingInt(@intCast(f_value));
         try expectApproxEqAbs(@as(f32, 0.0), ease(0.0, 1.0, 0.0, kind), tolerance);
         try expectApproxEqAbs(@as(f32, 1.0), ease(0.0, 1.0, 1.0, kind), tolerance);
     }
diff --git a/core/motion.zig b/core/motion.zig
index dd52d5af9..00ae9cd5c 100644
--- a/core/motion.zig
+++ b/core/motion.zig
@@ -41,7 +41,7 @@ pub const default_speed: f32 = 0.5;
 /// How much faster the fastest speed is than as written, and the slowest slower.
 pub const speed_range: f32 = 2;
 
-const publish_id: dvui.Id = @enumFromInt(0x6669_7a7a_6d6f_7469); // "fizzmoti"
+const publish_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_6d6f_7469)); // "fizzmoti"
 const publish_key = "_motion";
 
 /// What the host publishes each frame.
diff --git a/core/profile.zig b/core/profile.zig
index 42979ad6b..60f9d28a7 100644
--- a/core/profile.zig
+++ b/core/profile.zig
@@ -397,7 +397,7 @@ var host_spans: ?*Spans = null;
 /// work on other threads.
 var frame_span: OpenSpan = .{};
 
-const publish_id: dvui.Id = @enumFromInt(0x6669_7a7a_7970_7266); // "fizzyprf"
+const publish_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_7970_7266)); // "fizzyprf"
 const publish_key = std.fmt.comptimePrint("_profiler{d}", .{abi});
 const lookback_key = std.fmt.comptimePrint("_profiler_lookback{d}", .{Lookback.abi});
 const causes_key = std.fmt.comptimePrint("_profiler_causes{d}", .{FrameCauses.abi});
@@ -867,7 +867,8 @@ test "a report says what each owner and scope cost, as ZON that reads back" {
     };
     var arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
     defer arena.deinit();
-    const r = try std.zon.parse.fromSliceAlloc(Report, arena.allocator(), try arena.allocator().dupeZ(u8, text), null, .{});
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const r = try std.zon.parse.fromSlice(Report, .{ .gpa = std.testing.allocator, .arena = arena.allocator(), .source = try arena.allocator().dupeSentinel(u8, text, 0), .diagnostics = &diag });
     // The plugin's own time is what it spent; fizzy's own is what was left once that is taken out.
     try std.testing.expectEqualStrings("text", r.owners[0].owner);
     try std.testing.expect(r.owners[0].self_ms >= 1.5);
diff --git a/core/profile/Gpu.zig b/core/profile/Gpu.zig
index f9966a4aa..6a2c7b547 100644
--- a/core/profile/Gpu.zig
+++ b/core/profile/Gpu.zig
@@ -27,7 +27,7 @@ target_switches: u32 = 0,
 /// totals do.
 pub fn since(self: Gpu, prev: Gpu) Gpu {
     var out: Gpu = .{};
-    inline for (std.meta.fields(Gpu)) |f| @field(out, f.name) = @field(self, f.name) -% @field(prev, f.name);
+    inline for (@typeInfo(Gpu).@"struct".field_names, @typeInfo(Gpu).@"struct".field_types, @typeInfo(Gpu).@"struct".field_attrs) |f_name, _, _| @field(out, f_name) = @field(self, f_name) -% @field(prev, f_name);
     return out;
 }
 
@@ -45,7 +45,7 @@ pub const Sum = struct {
     frames: u32 = 0,
 
     pub fn add(self: *Sum, g: Gpu) void {
-        inline for (std.meta.fields(Gpu)) |f| @field(self, f.name) += @field(g, f.name);
+        inline for (@typeInfo(Gpu).@"struct".field_names, @typeInfo(Gpu).@"struct".field_types, @typeInfo(Gpu).@"struct".field_attrs) |f_name, _, _| @field(self, f_name) += @field(g, f_name);
         self.frames += 1;
     }
 
@@ -54,7 +54,7 @@ pub const Sum = struct {
         if (self.frames == 0) return null;
         const n: f64 = @floatFromInt(self.frames);
         var out: PerFrame = .{};
-        inline for (std.meta.fields(Gpu)) |f| @field(out, f.name) = @as(f64, @floatFromInt(@field(self, f.name))) / n;
+        inline for (@typeInfo(Gpu).@"struct".field_names, @typeInfo(Gpu).@"struct".field_types, @typeInfo(Gpu).@"struct".field_attrs) |f_name, _, _| @field(out, f_name) = @as(f64, @floatFromInt(@field(self, f_name))) / n;
         return out;
     }
 };
diff --git a/core/screens.zig b/core/screens.zig
index f16d0b1d2..0c8de00eb 100644
--- a/core/screens.zig
+++ b/core/screens.zig
@@ -11,7 +11,7 @@
 //! carries its own copy of `core`, and its menus and tooltips must read the same as the app's.
 const dvui = @import("dvui");
 
-const key_id: dvui.Id = @enumFromInt(0x6669_7a7a_7363_726e); // "fizzscrn"
+const key_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_7363_726e)); // "fizzscrn"
 
 /// The screen `r` (natural) is on: the one set this frame (`dvui.screensSet`) its middle is in,
 /// else the main window's (`mainScreen`).
diff --git a/core/sizing_tests.zig b/core/sizing_tests.zig
index b5dca3bda..c892336bb 100644
--- a/core/sizing_tests.zig
+++ b/core/sizing_tests.zig
@@ -26,4 +26,7 @@ test {
     // The smooth union the dialogs' and floats' bubbles run together with: its tests are
     // arithmetic, but the file speaks in dvui's points.
     _ = @import("gfx/liquid_blob.zig");
+    // `blitData` is pixi's, not fizzy's: nothing else here compiles it, and it speaks in dvui
+    // colours.
+    _ = @import("gfx/image.zig");
 }
diff --git a/core/transport/NativeTransport.zig b/core/transport/NativeTransport.zig
index 5b8cf3262..4e336ee81 100644
--- a/core/transport/NativeTransport.zig
+++ b/core/transport/NativeTransport.zig
@@ -222,7 +222,7 @@ fn perform(job: *Job) vfs.Error!vfs.http.Response {
         .response_writer = &body.writer,
     }) catch return error.Http;
     const bytes = body.toOwnedSlice() catch return error.OutOfMemory;
-    return .{ .status = @intFromEnum(result.status), .body = bytes };
+    return .{ .status = @backingInt(result.status), .body = bytes };
 }
 
 fn cancel(ptr: *anyopaque, handle: vfs.http.Job) void {
diff --git a/core/vfs/Fs.zig b/core/vfs/Fs.zig
index cabe926e1..883f51fca 100644
--- a/core/vfs/Fs.zig
+++ b/core/vfs/Fs.zig
@@ -65,18 +65,18 @@ pub fn Result(comptime T: type) type {
     };
 }
 
-const errors = @typeInfo(Error).error_set.?;
+const errors = @typeInfo(Error).error_set.error_names.?;
 
 fn codeOf(err: Error) u8 {
     inline for (errors, 1..) |e, i| {
-        if (err == @field(Error, e.name)) return i;
+        if (err == @field(Error, e)) return i;
     }
     unreachable;
 }
 
 fn errorOf(code: u8) Error {
     inline for (errors, 1..) |e, i| {
-        if (code == i) return @field(Error, e.name);
+        if (code == i) return @field(Error, e);
     }
     return error.Io;
 }
diff --git a/core/vfs/zip.zig b/core/vfs/zip.zig
index 1244d4560..c4e8e6352 100644
--- a/core/vfs/zip.zig
+++ b/core/vfs/zip.zig
@@ -209,7 +209,7 @@ const dos_epoch_date: u16 = (1 << 5) | 1;
 
 fn readStruct(comptime T: type, bytes: []const u8, off: u64) ?T {
     if (off + @sizeOf(T) > bytes.len) return null;
-    var v: T = @bitCast(bytes[@intCast(off)..][0..@sizeOf(T)].*);
+    var v: T = std.mem.bytesToValue(T, bytes[@intCast(off)..][0..@sizeOf(T)]);
     if (@import("builtin").target.cpu.arch.endian() == .big) std.mem.byteSwapAllFields(T, &v);
     return v;
 }
diff --git a/core/widgets/BlurBackdrop.zig b/core/widgets/BlurBackdrop.zig
index 09eff8e21..31b846a6c 100644
--- a/core/widgets/BlurBackdrop.zig
+++ b/core/widgets/BlurBackdrop.zig
@@ -1131,7 +1131,7 @@ fn changedUnder(r: Rect.Physical) bool {
     return marks.now.hits(r) or marks.last.hits(r);
 }
 
-const marks_id: dvui.Id = @enumFromInt(0x6669_7a7a_756e_6472); // "fizzundr"
+const marks_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_756e_6472)); // "fizzundr"
 const marks_key = "_frost_under";
 
 /// The rects `underChanged` marked, this frame and the last. In the data store, so it lasts only
diff --git a/core/widgets/CanvasWidget.zig b/core/widgets/CanvasWidget.zig
index aed80f220..e3be9f2c1 100644
--- a/core/widgets/CanvasWidget.zig
+++ b/core/widgets/CanvasWidget.zig
@@ -683,7 +683,7 @@ pub fn updateTouchGesture(self: *CanvasWidget) void {
         const me = e.evt.mouse;
         if (!me.button.touch()) continue;
 
-        const slot_signed = @intFromEnum(me.button) - @intFromEnum(dvui.enums.Button.touch0);
+        const slot_signed = @backingInt(me.button) - @backingInt(dvui.enums.Button.touch0);
         if (slot_signed < 0 or slot_signed >= self.touches.len) continue;
         const slot: usize = @intCast(slot_signed);
 
@@ -1224,7 +1224,7 @@ pub fn processEvents(self: *CanvasWidget) void {
                     self.pan_fling_x.begin();
                     self.pan_fling_y.begin();
                     if (me.button.touch()) {
-                        const slot_signed = @intFromEnum(me.button) - @intFromEnum(dvui.enums.Button.touch0);
+                        const slot_signed = @backingInt(me.button) - @backingInt(dvui.enums.Button.touch0);
                         if (slot_signed >= 0 and slot_signed < self.touches.len) {
                             self.scroll_pan_touch_slot = @intCast(slot_signed);
                         }
@@ -1238,7 +1238,7 @@ pub fn processEvents(self: *CanvasWidget) void {
                         self.empty = .pending;
                         self.empty_is_touch = me.button.touch();
                         self.empty_slot = if (me.button.touch()) slot: {
-                            const s = @intFromEnum(me.button) - @intFromEnum(dvui.enums.Button.touch0);
+                            const s = @backingInt(me.button) - @backingInt(dvui.enums.Button.touch0);
                             break :slot if (s >= 0 and s < self.touches.len) @intCast(s) else 0;
                         } else 0;
                         self.empty_down = true;
diff --git a/core/widgets/Split.zig b/core/widgets/Split.zig
index 5d302410d..9d2a92fb6 100644
--- a/core/widgets/Split.zig
+++ b/core/widgets/Split.zig
@@ -918,8 +918,8 @@ test "a tray takes what it asks for while there is room" {
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const left: dvui.Id = @enumFromInt(0xA1);
-    const right: dvui.Id = @enumFromInt(0xA2);
+    const left: dvui.Id = @fromBackingInt(@intCast(0xA1));
+    const right: dvui.Id = @fromBackingInt(@intCast(0xA2));
     setSize(left, 100);
     setSize(right, 100);
 
@@ -934,8 +934,8 @@ test "a pull stops when the base is at its minimum and leaves the other tray" {
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const left: dvui.Id = @enumFromInt(0xB1);
-    const right: dvui.Id = @enumFromInt(0xB2);
+    const left: dvui.Id = @fromBackingInt(@intCast(0xB1));
+    const right: dvui.Id = @fromBackingInt(@intCast(0xB2));
     setSize(left, 200);
     setSize(right, 200);
 
@@ -951,8 +951,8 @@ test "a pull that asks for more than the whole budget still leaves the other tra
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const left: dvui.Id = @enumFromInt(0xC1);
-    const right: dvui.Id = @enumFromInt(0xC2);
+    const left: dvui.Id = @fromBackingInt(@intCast(0xC1));
+    const right: dvui.Id = @fromBackingInt(@intCast(0xC2));
     setSize(left, 200);
     setSize(right, 200);
 
@@ -967,8 +967,8 @@ test "push_out past min shrinks the tray behind" {
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const inner: dvui.Id = @enumFromInt(0xC3);
-    const outer: dvui.Id = @enumFromInt(0xC4);
+    const inner: dvui.Id = @fromBackingInt(@intCast(0xC3));
+    const outer: dvui.Id = @fromBackingInt(@intCast(0xC4));
     setSize(inner, 0);
     setSize(outer, 120);
 
@@ -984,8 +984,8 @@ test "push_out on the right does not close the left" {
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const left: dvui.Id = @enumFromInt(0xC5);
-    const right: dvui.Id = @enumFromInt(0xC6);
+    const left: dvui.Id = @fromBackingInt(@intCast(0xC5));
+    const right: dvui.Id = @fromBackingInt(@intCast(0xC6));
     setSize(left, 160);
     setSize(right, 0);
 
@@ -1000,8 +1000,8 @@ test "a pull with no flex left reclaims the opposite side" {
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const left: dvui.Id = @enumFromInt(0xC7);
-    const right: dvui.Id = @enumFromInt(0xC8);
+    const left: dvui.Id = @fromBackingInt(@intCast(0xC7));
+    const right: dvui.Id = @fromBackingInt(@intCast(0xC8));
     setSize(left, 0);
     setSize(right, 980);
 
@@ -1017,8 +1017,8 @@ test "conflicting minimums squeeze the base rather than inverting the layout" {
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const left: dvui.Id = @enumFromInt(0xD1);
-    const right: dvui.Id = @enumFromInt(0xD2);
+    const left: dvui.Id = @fromBackingInt(@intCast(0xD1));
+    const right: dvui.Id = @fromBackingInt(@intCast(0xD2));
     setSize(left, 100);
     setSize(right, 100);
 
@@ -1037,7 +1037,7 @@ test "a container smaller than the base leaves the trays nothing" {
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const only: dvui.Id = @enumFromInt(0xE1);
+    const only: dvui.Id = @fromBackingInt(@intCast(0xE1));
     setSize(only, 100);
 
     // base_min alone exceeds the container: room is zero, not negative.
@@ -1050,7 +1050,7 @@ test "a max below the min does not panic in the clamp" {
     defer t.deinit();
     _ = try dvui.testing.step(twoPaneFrame);
 
-    const only: dvui.Id = @enumFromInt(0xF1);
+    const only: dvui.Id = @fromBackingInt(@intCast(0xF1));
     setSize(only, 50);
 
     // `std.math.clamp` asserts lower <= upper, so a contradictory pair has to be reconciled
diff --git a/docs/DEPENDENCIES.md b/docs/DEPENDENCIES.md
index a99ad043a..867ff54ea 100644
--- a/docs/DEPENDENCIES.md
+++ b/docs/DEPENDENCIES.md
@@ -133,6 +133,22 @@ backend and never link SDL, so an SDL bump is never an SDK release and never mov
 Each of 5 and 6 is also a branch of its own on upstream `main` (`window-draw-retained`,
 `screens-set`), from which the upstream PR is opened.
 
+**On fizzy's `zig/0.17` branch** the pin is `foxnne/dvui-dev` branch `zig-0.17`, by commit and
+as `git+https` (Zig 0.17 hashes this repo's GitHub archive wrongly; `docs/PITFALLS.md`): the eight
+above rebased onto upstream `main` (`41f6703`), then:
+
+9. **floatingWindow: a backend may show one in an OS window of its own** (`bd7736d`). Patch 8's
+   `osWindowFloating` became `Backend.floatingWindowOs(id, open_flag, min, max)`, asked as
+   any floating window (not modal) begins, and `floatingWindowTitle(id, header)`, asked by
+   `windowHeader`: true, and the backend shows it in an OS window with the OS's title bar, and
+   dvui draws it with no frame of its own. `screenFor` takes the nearest screen.
+10. **floatingWindow: an OS window only for a floating window that asks** (`98a0e07`):
+   `FloatingWindowWidget.InitOptions.os_window`, set by `dvui.osWindow`'s floating window, passed
+   to `floatingWindowOs` as `asked`. The backend's `floating_os_windows` (`.asked`, `.all`,
+   `.none`) says which it shows.
+
+Tagged `fizzy-sdk-*` when `zig/0.17` merges to `main`, as rule 2 says.
+
 Tags: `fizzy-sdk-0.2.13` → `712f7f7` (the stack before this rebase, still what SDK ≤ 0.2.15
 builds); `fizzy-sdk-0.2.16` → `4428108` (SDK 0.2.16 to 0.2.18); `fizzy-sdk-0.2.19` →
 `f8b32db`; `fizzy-sdk-0.2.19-2` → `a90bc70` (0.2.19 was not released yet, and a tag never
diff --git a/docs/PITFALLS.md b/docs/PITFALLS.md
index ea08b5a11..941d6e727 100644
--- a/docs/PITFALLS.md
+++ b/docs/PITFALLS.md
@@ -23,6 +23,53 @@ goes beside the code if it has an area, here if not.
   this; don't fold the two steps back together, or start anything long-lived inside `zig build
   test`.
 
+## The build (Zig 0.17)
+
+`build.zig` runs in a configurer, and its result is cached; a separate maker runs the steps.
+Four things in that split cost time on the move to 0.17:
+
+- **The configuration is cached without regard to the environment.** A variable that
+  `build.zig` reads with `b.graph.environ_map` is seen on the first configure and then ignored
+  until something else forces a reconfigure. Anything that changes the build is a `-D` option.
+  Scripts that hold a setting in the environment (`scripts/release.sh`, `release.yml`) turn it
+  into the option.
+- **`Run.setEnvironmentVariable` freezes the whole environment.** Its first call copies the
+  configure-time environment into the Run, and that copy is cached with the configuration. The
+  command then keeps the environment of the first configure (a `DOTNET_ROOT` exported later never
+  arrived). A command that needs its environment changed runs through velopack-zig's
+  `tools/run_env.zig` (`velopack.addVpkRun`), which applies the changes when it runs. A step
+  that reads the environment itself, as `sdk/plugin_sdk_install.zig` does, reads it at make time.
+- **A file read while configuring must be declared**, or a change to it is never seen:
+  `b.dependOnFileContents`, `dependOnFileMetadata` (existence), `dependOnDirectoryContents`
+  (a listing). `--cache-poison=disallowed` does not catch an undeclared read.
+- **A declared path must not be inside a missing directory.** The maker cannot load the
+  configuration ("configuration failed: FileSystemFailure"); a plugin without `.github/` hit it.
+  `common.dependOnPathExistence` (and its copy in `sdk/plugin_sdk.zig`) declares the nearest
+  directory that exists instead.
+- **Some GitHub `archive/<sha>.tar.gz` URLs fetch wrong.** `zig fetch` reports the package's
+  hash, but a build's own fetch leaves the archive's top folder in place: no `build.zig.zon` at
+  the package's root, an unnamed `N-V-…` hash, and "hash mismatch" (dvui-dev `bd7736d`). Pin the
+  same commit as `git+https://github.com/<owner>/<repo>#<sha>`; the hash is the same.
+
+### Windows, on 0.17
+
+Three that the release builds (`zig build package`, MSVC) hit and the macOS build never shows:
+
+- **An `*-windows-msvc` exe must link `oldnames` itself.** MSVC's C runtime spells the POSIX
+  calls `_getcwd`, `_chdir`, …, and `oldnames.lib` maps the plain names onto them. Zig 0.16
+  linked it into every MSVC exe; 0.17 does not, so C that calls `getcwd` (dvui's
+  tinyfiledialogs, fizzy's startup) fails to link with unresolved symbols. `build/exe.zig` adds
+  it for `abi == .msvc`; any other MSVC exe built from this tree needs the same line.
+- **The `translate-c` tool takes `--libc=<ini>` before its `--`.** Everything after `--` goes to
+  the C front end, which doesn't know the flag, so a `--libc` appended at the end is lost and the
+  MSVC headers aren't found. `build/msvc.zig` inserts it ahead of the `--`. (The deprecated
+  `addTranslateC` step has no way to pass a libc file at all; it gets the include dirs instead.)
+- **sdl_zig must leave SDL's `core/linux/` out of a Windows build.** SDL lists those sources as
+  generic because they compile to nothing off Linux, but `core/linux/SDL_dbus.c` includes
+  `<unistd.h>` before its guard, and MSVC has no `unistd.h`. fizzyedit/sdl_zig filters them
+  (`ef7eb36`, pinned in `backend/build.zig.zon`); a move to upstream sdl_zig or a new SDL must
+  keep the filter.
+
 ## Running a second fizzy
 
 - **`fizzy --profile <dir>`** keeps config, recents, plugins, the single-instance lock and its
diff --git a/docs/PLUGINS.md b/docs/PLUGINS.md
index 98a5be6dc..6d1be2af9 100644
--- a/docs/PLUGINS.md
+++ b/docs/PLUGINS.md
@@ -163,7 +163,7 @@ which produces:
 .{
     .name = .my_plugin,
     .version = "0.1.0",
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .paths = .{ "build.zig", "build.zig.zon", "plugin.zig", "plugin.zig.zon", "src" },
     .fingerprint = 0x0000000000000000, // zig fills this in on first `zig build`
     .dependencies = .{
@@ -223,6 +223,11 @@ libraries (vendored C, packed assets). See `fizzy.plugin.addCModule` and
 [pixi's `build.zig`](https://github.com/fizzyedit/pixi/blob/main/build.zig) for a worked example
 with vendored C deps.
 
+A plugin that ships a program of its own (a helper it starts, as the agent plugin starts
+`fizzy-mcp`) builds it as usual and passes it to `fizzy.plugin.installBeside(b, exe, .{ .plugin =
+"<id>" })`: `zig build install` then copies it into the plugin's own directory, beside the
+library and still executable, where the plugin finds it at run time.
+
 Under `create`, the dylib's C-ABI entry point (the five symbols the host looks up at `dlopen`
 time — ABI fingerprint check, the `register` entry, and injection hooks for the
 allocator/`*Host`/dvui-context/render-bridge — see §7 for the full list) is a tiny **generated**
@@ -1652,7 +1657,7 @@ jobs:
     permissions:
       contents: write
     with:
-      zig-version: "0.16.0"
+      zig-version: "0.17.0"
 ```
 
 Bump the `sdk-v*` tag your `build.zig.zon` pins when you want a new SDK; the next tag's manifest picks up
diff --git a/libs/dvui-singleton-app/src/windows_impl.zig b/libs/dvui-singleton-app/src/windows_impl.zig
index 1dc9b92ec..51d9a87f3 100644
--- a/libs/dvui-singleton-app/src/windows_impl.zig
+++ b/libs/dvui-singleton-app/src/windows_impl.zig
@@ -32,11 +32,11 @@ const FILE_ATTRIBUTE_NORMAL: w.DWORD = 0x80;
 
 const NMPWAIT_USE_DEFAULT_WAIT: w.DWORD = 0x00000000;
 
-const ERROR_FILE_NOT_FOUND = @as(w.Win32Error, @enumFromInt(2));
-const ERROR_ACCESS_DENIED = @as(w.Win32Error, @enumFromInt(5));
-const ERROR_PIPE_BUSY = @as(w.Win32Error, @enumFromInt(231));
-const ERROR_PIPE_CONNECTED = @as(w.Win32Error, @enumFromInt(535));
-const ERROR_BROKEN_PIPE = @as(w.Win32Error, @enumFromInt(109));
+const ERROR_FILE_NOT_FOUND = @as(w.Win32Error, @fromBackingInt(@intCast(2)));
+const ERROR_ACCESS_DENIED = @as(w.Win32Error, @fromBackingInt(@intCast(5)));
+const ERROR_PIPE_BUSY = @as(w.Win32Error, @fromBackingInt(@intCast(231)));
+const ERROR_PIPE_CONNECTED = @as(w.Win32Error, @fromBackingInt(@intCast(535)));
+const ERROR_BROKEN_PIPE = @as(w.Win32Error, @fromBackingInt(@intCast(109)));
 
 extern "kernel32" fn CreateFileW(
     lpFileName: w.LPCWSTR,
@@ -172,7 +172,7 @@ pub const Primary = struct {
             }
 
             const ok = ConnectNamedPipe(current, null);
-            const err = if (ok == .FALSE) w.GetLastError() else @as(w.Win32Error, @enumFromInt(0));
+            const err = if (ok == .FALSE) w.GetLastError() else @as(w.Win32Error, @fromBackingInt(@intCast(0)));
             if (ok == .FALSE and err != ERROR_PIPE_CONNECTED) {
                 log.warn("ConnectNamedPipe failed: {t}", .{err});
                 w.CloseHandle(current);
diff --git a/plugins/archive/build.zig.zon b/plugins/archive/build.zig.zon
index f9a5d6380..53350bb27 100644
--- a/plugins/archive/build.zig.zon
+++ b/plugins/archive/build.zig.zon
@@ -1,7 +1,7 @@
 .{
     .name = .archive,
     .version = "0.1.0",
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .paths = .{
         "build.zig",
         "build.zig.zon",
diff --git a/plugins/devtools/build.zig.zon b/plugins/devtools/build.zig.zon
index 589381583..9b9662578 100644
--- a/plugins/devtools/build.zig.zon
+++ b/plugins/devtools/build.zig.zon
@@ -1,7 +1,7 @@
 .{
     .name = .devtools,
     .version = "0.1.0",
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .paths = .{
         "build.zig",
         "build.zig.zon",
diff --git a/plugins/image/build.zig.zon b/plugins/image/build.zig.zon
index 8427f7b61..cd89af7ec 100644
--- a/plugins/image/build.zig.zon
+++ b/plugins/image/build.zig.zon
@@ -1,7 +1,7 @@
 .{
     .name = .image,
     .version = "0.1.0",
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .paths = .{
         "build.zig",
         "build.zig.zon",
diff --git a/plugins/markdown/build.zig.zon b/plugins/markdown/build.zig.zon
index f0b780ba7..eb78acd41 100644
--- a/plugins/markdown/build.zig.zon
+++ b/plugins/markdown/build.zig.zon
@@ -1,7 +1,7 @@
 .{
     .name = .markdown,
     .version = "0.1.0",
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .paths = .{
         "build.zig",
         "build.zig.zon",
@@ -16,8 +16,8 @@
             .path = "../../sdk",
         },
         .md4zig = .{
-            .url = "git+https://github.com/fizzyedit/md4zig#2d0a687d28be9849b9abe3453bfb7c9f22ffcda1",
-            .hash = "md4zig-0.1.0-iiatj7oOBgCcrw8ee3UISfYe2LsKVEf7O3osC85HthPX",
+            .url = "git+https://github.com/fizzyedit/md4zig#eb5241c9e46cd0a507c0c7a85b01afe2b51e58a8",
+            .hash = "md4zig-0.1.0-iiatj6AQBgBP6PiK2c4MRhjNK2ZXjVg94GvbIEv5WEl7",
         },
     },
 }
diff --git a/plugins/markdown/src/md/code_language.zig b/plugins/markdown/src/md/code_language.zig
index 607ec0421..80858a465 100644
--- a/plugins/markdown/src/md/code_language.zig
+++ b/plugins/markdown/src/md/code_language.zig
@@ -121,6 +121,6 @@ test "an empty or unknown tag has no extension" {
 }
 
 test "an absurdly long tag is rejected rather than overflowing the buffer" {
-    const long = "a" ** (max_tag_len + 40);
-    try testing.expect(extensionForTag(long) == null);
+    const long: [max_tag_len + 40]u8 = @splat('a');
+    try testing.expect(extensionForTag(&long) == null);
 }
diff --git a/plugins/markdown/src/md/image_format.zig b/plugins/markdown/src/md/image_format.zig
index 939bcc785..04fde4353 100644
--- a/plugins/markdown/src/md/image_format.zig
+++ b/plugins/markdown/src/md/image_format.zig
@@ -27,7 +27,7 @@ pub fn isSvg(bytes: []const u8) bool {
     if (std.ascii.startsWithIgnoreCase(window, "<svg")) return true;
     if (!std.ascii.startsWithIgnoreCase(window, "<?xml") and
         !std.ascii.startsWithIgnoreCase(window, "<!doctype")) return false;
-    return std.ascii.indexOfIgnoreCase(window, "<svg") != null;
+    return std.ascii.findIgnoreCase(window, "<svg") != null;
 }
 
 test "isSvg: bare root element" {
diff --git a/plugins/markdown/src/md/net_image.zig b/plugins/markdown/src/md/net_image.zig
index c515cb4e0..51be0be33 100644
--- a/plugins/markdown/src/md/net_image.zig
+++ b/plugins/markdown/src/md/net_image.zig
@@ -52,7 +52,7 @@ const max_in_flight: usize = 6;
 
 const Entry = struct {
     id: u32 = 0,
-    status: std.atomic.Value(u8) = .init(@intFromEnum(Status.fetching)),
+    status: std.atomic.Value(u8) = .init(@backingInt(Status.fetching)),
     /// Encoded file bytes (`gpa`-owned). Native worker writes this before the release-store
     /// of `ready`. Unused on web.
     bytes: ?[]u8 = null,
@@ -65,7 +65,7 @@ const Entry = struct {
     url: []u8,
 
     fn statusValue(self: *Entry) Status {
-        return @enumFromInt(self.status.load(.acquire));
+        return @fromBackingInt(@intCast(self.status.load(.acquire)));
     }
 };
 
@@ -148,7 +148,7 @@ pub fn request(allocator: std.mem.Allocator, url: []const u8) Result {
     const io = dvui.io;
     const win = dvui.currentWindow();
     entry.thread = std.Thread.spawn(.{}, worker, .{ entry, io, win }) catch {
-        entry.status.store(@intFromEnum(Status.failed), .release);
+        entry.status.store(@backingInt(Status.failed), .release);
         return .failed;
     };
     return .pending;
@@ -193,7 +193,7 @@ pub fn deinit() void {
 fn worker(entry: *Entry, io: std.Io, win: *dvui.Window) void {
     defer dvui.refresh(win, @src(), null);
     const a = gpa orelse {
-        entry.status.store(@intFromEnum(Status.failed), .release);
+        entry.status.store(@backingInt(Status.failed), .release);
         return;
     };
 
@@ -207,20 +207,20 @@ fn worker(entry: *Entry, io: std.Io, win: *dvui.Window) void {
         .location = .{ .url = entry.url },
         .response_writer = &body.writer,
     }) catch {
-        entry.status.store(@intFromEnum(Status.failed), .release);
+        entry.status.store(@backingInt(Status.failed), .release);
         return;
     };
     if (result.status != .ok or body.written().len == 0 or body.written().len > max_bytes) {
-        entry.status.store(@intFromEnum(Status.failed), .release);
+        entry.status.store(@backingInt(Status.failed), .release);
         return;
     }
 
     const owned = a.dupe(u8, body.written()) catch {
-        entry.status.store(@intFromEnum(Status.failed), .release);
+        entry.status.store(@backingInt(Status.failed), .release);
         return;
     };
     entry.bytes = owned;
-    entry.status.store(@intFromEnum(Status.ready), .release);
+    entry.status.store(@backingInt(Status.ready), .release);
 }
 
 /// Allocate the pixel buffer the browser will write into. Same `gpa` as the rest of
@@ -240,14 +240,14 @@ export fn FizzyWebImageReady(id: u32, ptr: usize, len: usize, width: u32, height
     const a = gpa orelse return;
     if (ptr == 0 or len == 0 or width == 0 or height == 0) {
         if (ptr != 0 and len != 0) a.free(@as([*]u8, @ptrFromInt(ptr))[0..len]);
-        if (entryById(id)) |entry| entry.status.store(@intFromEnum(Status.failed), .release);
+        if (entryById(id)) |entry| entry.status.store(@backingInt(Status.failed), .release);
         return;
     }
     const rgba = @as([*]u8, @ptrFromInt(ptr))[0..len];
     const expected = @as(usize, width) * @as(usize, height) * 4;
     if (len != expected) {
         a.free(rgba);
-        if (entryById(id)) |entry| entry.status.store(@intFromEnum(Status.failed), .release);
+        if (entryById(id)) |entry| entry.status.store(@backingInt(Status.failed), .release);
         return;
     }
     const entry = entryById(id) orelse {
@@ -259,12 +259,12 @@ export fn FizzyWebImageReady(id: u32, ptr: usize, len: usize, width: u32, height
         return;
     }
     entry.pixels = .{ .rgba = rgba, .width = width, .height = height };
-    entry.status.store(@intFromEnum(Status.ready), .release);
+    entry.status.store(@backingInt(Status.ready), .release);
 }
 
 export fn FizzyWebImageFailed(id: u32) void {
     if (comptime !is_wasm) return;
     const entry = entryById(id) orelse return;
     if (entry.statusValue() != .fetching) return;
-    entry.status.store(@intFromEnum(Status.failed), .release);
+    entry.status.store(@backingInt(Status.failed), .release);
 }
diff --git a/plugins/markdown/src/md/render_ast.zig b/plugins/markdown/src/md/render_ast.zig
index 795dca39a..6c3d5878b 100644
--- a/plugins/markdown/src/md/render_ast.zig
+++ b/plugins/markdown/src/md/render_ast.zig
@@ -718,7 +718,7 @@ fn markUndecodable(ctx: RenderContext, bytes: []const u8) void {
 fn textureCacheKey(ptr: [*]const u8) dvui.Texture.Cache.Key {
     var h = dvui.fnv.init();
     h.update(std.mem.asBytes(&ptr));
-    const it = @intFromEnum(dvui.enums.TextureInterpolation.linear);
+    const it = @backingInt(dvui.enums.TextureInterpolation.linear);
     h.update(std.mem.asBytes(&it));
     return h.final();
 }
diff --git a/plugins/shared/build/helpers.zig b/plugins/shared/build/helpers.zig
index 26bf02f59..723fddd1a 100644
--- a/plugins/shared/build/helpers.zig
+++ b/plugins/shared/build/helpers.zig
@@ -56,16 +56,19 @@ pub const IdentityManifest = @import("../../../sdk/src/manifest_identity.zig").I
 /// collide with the same file when the plugin is built standalone (its own `build.zig` already
 /// `@import`s it via `plugin_sdk.readManifest`). Panics clearly on a missing/invalid manifest.
 pub fn readManifestAt(b: *std.Build, zon_rel_path: []const u8) IdentityManifest {
-    const raw = b.build_root.handle.readFileAlloc(b.graph.io, zon_rel_path, b.allocator, std.Io.Limit.limited(256 * 1024)) catch |e|
+    b.dependOnFileContents(b.path(zon_rel_path));
+    const raw = std.Io.Dir.cwd().readFileAlloc(b.graph.io, b.root.joinString(b.allocator, zon_rel_path) catch @panic("OOM"), b.allocator, std.Io.Limit.limited(256 * 1024)) catch |e|
         std.debug.panic("fizzy: could not read {s}: {}", .{ zon_rel_path, e });
-    const src = b.allocator.dupeZ(u8, raw) catch @panic("OOM");
+    const src = b.allocator.dupeSentinel(u8, raw, 0) catch @panic("OOM");
     const Target = struct {
         id: []const u8,
         name: []const u8,
         version: []const u8,
         min_sdk_version: []const u8 = "",
     };
-    const parsed = std.zon.parse.fromSliceAlloc(Target, b.allocator, src, null, .{ .ignore_unknown_fields = true }) catch |e|
+    // The build's allocator is freed only when the build ends: the manifest is read into it.
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const parsed = std.zon.parse.fromSlice(Target, .{ .gpa = b.allocator, .arena = b.allocator, .source = src, .diagnostics = &diag, .ignore_unknown_fields = true }) catch |e|
         std.debug.panic("fizzy: failed to parse {s}: {}", .{ zon_rel_path, e });
     _ = std.SemanticVersion.parse(parsed.version) catch
         std.debug.panic("fizzy: {s} .version \"{s}\" is not valid semver", .{ zon_rel_path, parsed.version });
diff --git a/plugins/text/build.zig.zon b/plugins/text/build.zig.zon
index 14a706be2..4a719a92e 100644
--- a/plugins/text/build.zig.zon
+++ b/plugins/text/build.zig.zon
@@ -1,7 +1,7 @@
 .{
     .name = .text,
     .version = "0.1.1",
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .paths = .{
         "build.zig",
         "build.zig.zon",
diff --git a/plugins/text/src/Document.zig b/plugins/text/src/Document.zig
index 00e432a23..19190d3a4 100644
--- a/plugins/text/src/Document.zig
+++ b/plugins/text/src/Document.zig
@@ -320,7 +320,7 @@ pub fn fromPath(path: []const u8) !Document {
 /// The token its editor keeps its measured layout under while hidden (`TextEntryWidget
 /// .InitOptions.retain_layout`), released when the document closes.
 pub fn layoutToken(self: *const Document) dvui.data.Token {
-    return @enumFromInt(std.hash.Wyhash.hash(0x7e47_1a70, std.mem.asBytes(&self.id)));
+    return @fromBackingInt(@intCast(std.hash.Wyhash.hash(0x7e47_1a70, std.mem.asBytes(&self.id))));
 }
 
 pub fn deinit(self: *Document) void {
@@ -458,7 +458,7 @@ pub fn captureState(self: *const Document, allocator: std.mem.Allocator) ![]u8 {
         .dirty = self.isDirty(),
         .focused = self.editor_focused,
         .untitled = self.unsaved,
-        .preview_mode = @intFromEnum(self.preview_mode),
+        .preview_mode = @backingInt(self.preview_mode),
         .scroll_y = self.scroll_y,
         .split = self.preview_split_ratio_user,
     });
@@ -470,7 +470,7 @@ pub fn fingerprint(self: *const Document) u64 {
     var h = std.hash.Wyhash.init(0x7e47_f1);
     h.update(self.text.items);
     const sel = self.selection();
-    h.update(std.mem.asBytes(&[_]u64{ sel.anchor, sel.head, @intFromBool(self.isDirty()), @intFromEnum(self.preview_mode) }));
+    h.update(std.mem.asBytes(&[_]u64{ sel.anchor, sel.head, @intFromBool(self.isDirty()), @backingInt(self.preview_mode) }));
     return h.final();
 }
 
diff --git a/plugins/text/src/TextEditor.zig b/plugins/text/src/TextEditor.zig
index fcc52121e..3694ce75e 100644
--- a/plugins/text/src/TextEditor.zig
+++ b/plugins/text/src/TextEditor.zig
@@ -307,7 +307,7 @@ fn drawEditor(doc: *Document, ext: []const u8, id_extra: u64, gpa: std.mem.Alloc
         // setting below only picks *what* it inserts (spaces vs a literal tab), not whether
         // it does so at all.
         .tab_inserts_indent = true,
-        .tab_size = @intFromEnum(plugin_impl.statePtr().settings.tab_size.get()),
+        .tab_size = @backingInt(plugin_impl.statePtr().settings.tab_size.get()),
         .insert_spaces = plugin_impl.statePtr().settings.insert_spaces_on_tab.get(),
         // Same VSCode-style baseline as Tab above — not gated by a setting.
         .auto_indent_newline = true,
diff --git a/plugins/workbench/build.zig.zon b/plugins/workbench/build.zig.zon
index 58832c407..eb878241b 100644
--- a/plugins/workbench/build.zig.zon
+++ b/plugins/workbench/build.zig.zon
@@ -1,7 +1,7 @@
 .{
     .name = .workbench,
     .version = "0.1.1",
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     .paths = .{
         "build.zig",
         "build.zig.zon",
diff --git a/plugins/workbench/src/FileLoadJob.zig b/plugins/workbench/src/FileLoadJob.zig
index 3b9ac5dfe..0564c5b94 100644
--- a/plugins/workbench/src/FileLoadJob.zig
+++ b/plugins/workbench/src/FileLoadJob.zig
@@ -43,7 +43,7 @@ target_grouping: u64,
 window: *dvui.Window,
 started_at_ns: i128,
 
-phase: std.atomic.Value(u8) = .init(@intFromEnum(Phase.queued)),
+phase: std.atomic.Value(u8) = .init(@backingInt(Phase.queued)),
 progress_num: std.atomic.Value(u32) = .init(0),
 progress_den: std.atomic.Value(u32) = .init(0),
 cancelled: std.atomic.Value(bool) = .init(false),
@@ -103,30 +103,30 @@ pub fn workerMain(job: *FileLoadJob) void {
     }
 
     if (job.cancelled.load(.monotonic)) {
-        job.phase.store(@intFromEnum(Phase.cancelled), .release);
+        job.phase.store(@backingInt(Phase.cancelled), .release);
         return;
     }
 
-    job.phase.store(@intFromEnum(Phase.reading), .release);
+    job.phase.store(@backingInt(Phase.reading), .release);
 
     const handled = job.owner.loadDocument(job.path, job.doc_buf.ptr) catch |e| {
         job.err = e;
-        job.phase.store(@intFromEnum(Phase.failed), .release);
+        job.phase.store(@backingInt(Phase.failed), .release);
         return;
     };
     if (!handled) {
         job.err = error.InvalidFile;
-        job.phase.store(@intFromEnum(Phase.failed), .release);
+        job.phase.store(@backingInt(Phase.failed), .release);
         return;
     }
 
     if (job.cancelled.load(.monotonic)) {
         job.owner.deinitDocumentBuffer(job.doc_buf.ptr);
-        job.phase.store(@intFromEnum(Phase.cancelled), .release);
+        job.phase.store(@backingInt(Phase.cancelled), .release);
         return;
     }
 
-    job.phase.store(@intFromEnum(Phase.ready), .release);
+    job.phase.store(@backingInt(Phase.ready), .release);
 }
 
 pub fn elapsedExceeds(job: *const FileLoadJob, threshold_ms: i64) bool {
diff --git a/plugins/workbench/src/Workspace.zig b/plugins/workbench/src/Workspace.zig
index 56b2feb2b..7aee8a5e9 100644
--- a/plugins/workbench/src/Workspace.zig
+++ b/plugins/workbench/src/Workspace.zig
@@ -537,7 +537,8 @@ fn lift(id: []const u8, from: dvui.Rect.Physical, event_num: u16) void {
     wb.carried_tab_key = std.hash.Wyhash.hash(0, id);
     runtime.host().beginViewDrag(id, from);
     if (runtime.host().viewDragSurface() == null) return;
-    if (dvui.currentWindow().capture) |cm| dvui.captureMouseCustom(cm, event_num);
+    if (dvui.captureMouseGet()) |cm|
+        dvui.captureMouseCustom(cm, event_num);
 }
 
 /// Write this pane's tab list and make `focus` its active tab.
diff --git a/plugins/workbench/src/workbench_layout.zig b/plugins/workbench/src/workbench_layout.zig
index 26d70dc03..55d655c74 100644
--- a/plugins/workbench/src/workbench_layout.zig
+++ b/plugins/workbench/src/workbench_layout.zig
@@ -180,13 +180,15 @@ fn loadPanes(wb: *Workbench) void {
     defer wb.allocator.free(path);
     const data = std.Io.Dir.cwd().readFileAlloc(dvui.io, path, wb.allocator, .limited(1 << 20)) catch return;
     defer wb.allocator.free(data);
-    const bytes = wb.allocator.dupeZ(u8, data) catch return;
+    const bytes = wb.allocator.dupeSentinel(u8, data, 0) catch return;
     defer wb.allocator.free(bytes);
-    const snap = std.zon.parse.fromSliceAlloc(Panes.Snapshot, wb.allocator, bytes, null, .{ .ignore_unknown_fields = true }) catch |err| {
+    var snap_arena: std.heap.ArenaAllocator = .init(wb.allocator);
+    defer snap_arena.deinit();
+    var snap_diag: std.zon.parse.Diagnostics = undefined;
+    const snap = std.zon.parse.fromSlice(Panes.Snapshot, .{ .gpa = wb.allocator, .arena = snap_arena.allocator(), .source = bytes, .diagnostics = &snap_diag, .ignore_unknown_fields = true }) catch |err| {
         dvui.log.warn("workbench: ignoring {s}: {s}", .{ path, @errorName(err) });
         return;
     };
-    defer std.zon.parse.free(wb.allocator, snap);
 
     var loaded = Panes.fromSnapshot(wb.allocator, snap) catch return;
     loaded.animated = true;
diff --git a/readme.md b/readme.md
index ff4f468f7..e6c703421 100644
--- a/readme.md
+++ b/readme.md
@@ -30,7 +30,7 @@ By default, when you install fizzy, only builtin plugins are included. This give
 
 ## Compilation
 - [Linux] Ensure `gtk+3-devel` or similar is installed (for native file dialogs).
-- Install zig 0.16.0.
+- Install zig 0.17.0.
 - Clone fizzy.
 - Build.
     - ```git clone https://github.com/fizzyedit/fizzy.git```
diff --git a/scripts/check-examples.sh b/scripts/check-examples.sh
index 3cf2f7fbd..a90d487f5 100755
--- a/scripts/check-examples.sh
+++ b/scripts/check-examples.sh
@@ -50,16 +50,25 @@ for repo in example-app example-plugin; do
     mkdir -p "$work/$repo"
     pack "$EXAMPLES_DIR/$repo" | tar -x -C "$work/$repo"
   else
-    git clone --quiet --depth 1 "https://github.com/fizzyedit/$repo" "$work/$repo"
+    # ZIG017: the examples' zig-0.17 branches until their 0.17 PRs land (just after fizzy's
+    # switch to 0.17), then `main` again in a PR of its own.
+    git clone --quiet --depth 1 --branch "${EXAMPLES_REF:-zig-0.17}" "https://github.com/fizzyedit/$repo" "$work/$repo"
   fi
 done
 
 (cd "$work/example-plugin" && zig fetch --save=fizzy "$sdk_tarball" >/dev/null)
+# example-app bundles example-plugin (`hello`), pinned by URL: the copy here, on this tree's SDK.
+pack "$work/example-plugin" | gzip > "$work/example-plugin.tar.gz"
 (
   cd "$work/example-app"
+  zig fetch --save=hello "$work/example-plugin.tar.gz" >/dev/null
   zig fetch --save=fizzy "$work/fizzy.tar.gz" >/dev/null
   # Its replay app depends on the plugin SDK alone: this tree's, packed as a release would be.
   zig fetch --save=fizzy_sdk "$sdk_tarball" >/dev/null
+  # So do the plugins it carries, each pinning a released SDK of its own.
+  for plugin in plugins/*/; do
+    (cd "$plugin" && zig fetch --save=fizzy "$sdk_tarball" >/dev/null)
+  done
 )
 
 # The plugin build installs the plugin: into a profile of its own, not this machine's fizzy.
diff --git a/scripts/plugin-loop/bench.py b/scripts/plugin-loop/bench.py
index 5eef4edc5..ef88bc0a7 100755
--- a/scripts/plugin-loop/bench.py
+++ b/scripts/plugin-loop/bench.py
@@ -18,7 +18,7 @@
            on the UI thread took (unload, register) — `PluginReloads`. Needs a plugin fizzy does
            not bundle (fizzy skips a user copy of a bundled one): pass `--plugin` and `--id`.
 
-`--backend llvm|self-hosted` forces the code generator for the plugin (`FIZZY_PLUGIN_USE_LLVM`,
+`--backend llvm|self-hosted` forces the code generator for the plugin (`-Dplugin-use-llvm`,
 read by `sdk/plugin_sdk.zig`); `default` leaves it to Zig. Compiler experiments like this run on
 Linux CI (`.github/workflows/plugin-loop.yml`), not on a shared workstation: an experimental
 backend on a large compile can take far more memory than LLVM.
@@ -59,13 +59,12 @@ def step_times(summary: str) -> dict:
     return out
 
 
-def env_for(profile: str, backend: str) -> dict:
-    env = dict(os.environ, FIZZY_PROFILE=profile)
-    if backend == "llvm":
-        env["FIZZY_PLUGIN_USE_LLVM"] = "1"
-    elif backend == "self-hosted":
-        env["FIZZY_PLUGIN_USE_LLVM"] = "0"
-    return env
+def env_for(profile: str) -> dict:
+    return dict(os.environ, FIZZY_PROFILE=profile)
+
+
+def backend_args(backend: str) -> list:
+    return {"llvm": ["-Dplugin-use-llvm=true"], "self-hosted": ["-Dplugin-use-llvm=false"]}.get(backend, [])
 
 
 class BuildFailed(Exception):
@@ -75,8 +74,8 @@ class BuildFailed(Exception):
 def build(plugin_dir: str, optimize: str, profile: str, backend: str) -> tuple:
     start = time.monotonic()
     proc = subprocess.run(
-        ["zig", "build", f"-Doptimize={optimize}", "--summary", "all"],
-        cwd=plugin_dir, env=env_for(profile, backend), capture_output=True, text=True,
+        ["zig", "build", f"-Doptimize={optimize}", "--summary", "all", *backend_args(backend)],
+        cwd=plugin_dir, env=env_for(profile), capture_output=True, text=True,
     )
     wall = (time.monotonic() - start) * 1000
     if proc.returncode != 0:
@@ -179,8 +178,8 @@ def bench_watch(report: Report, plugin_dir: str, optimize: str, profile: str, ba
     log_path = os.path.join(profile, "watch.log")
     log = open(log_path, "w")
     proc = subprocess.Popen(
-        ["zig", "build", "--watch", "-fincremental", f"-Doptimize={optimize}"],
-        cwd=plugin_dir, env=env_for(profile, backend), stdout=log, stderr=subprocess.STDOUT,
+        ["zig", "build", "--watch", "-fincremental", f"-Doptimize={optimize}", *backend_args(backend)],
+        cwd=plugin_dir, env=env_for(profile), stdout=log, stderr=subprocess.STDOUT,
         start_new_session=True,
     )
     try:
diff --git a/scripts/release.sh b/scripts/release.sh
index 13bb58bf4..e6e964d3b 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -98,8 +98,16 @@ sign_app="${FIZZY_MACOS_SIGN_APP:-}"
 sign_install="${FIZZY_MACOS_SIGN_INSTALLER:-}"
 notary_profile="${FIZZY_MACOS_NOTARY_PROFILE:-}"
 
+# As build options, not the environment: zig build caches its configuration without regard to
+# the environment, so a FIZZY_MACOS_* variable read by build.zig would be seen once and then ignored.
+sign_args=()
 if [[ -n "$sign_app" && -n "$sign_install" && -n "$notary_profile" ]]; then
     echo "==> macOS signing: enabled (app=${sign_app}, installer=${sign_install}, notary=${notary_profile})"
+    sign_args=(
+        "-Dmacos-sign-app=$sign_app"
+        "-Dmacos-sign-installer=$sign_install"
+        "-Dmacos-notary-profile=$notary_profile"
+    )
 else
     echo "==> macOS signing: DISABLED (set FIZZY_MACOS_SIGN_APP, FIZZY_MACOS_SIGN_INSTALLER, FIZZY_MACOS_NOTARY_PROFILE to enable)"
     if [[ -n "$sign_app" || -n "$sign_install" || -n "$notary_profile" ]]; then
@@ -143,7 +151,7 @@ if [[ "${FIZZY_RELEASE_SKIP_BUILD:-0}" != "1" ]]; then
     fi
 
     echo "==> Building all targets (zig build packageall -Doptimize=ReleaseFast)"
-    zig build packageall -Doptimize=ReleaseFast
+    zig build packageall -Doptimize=ReleaseFast ${sign_args[@]+"${sign_args[@]}"}
 else
     echo "==> FIZZY_RELEASE_SKIP_BUILD=1, reusing existing zig-out/"
 fi
diff --git a/sdk/build.zig.zon b/sdk/build.zig.zon
index bd572d9fe..26e235959 100644
--- a/sdk/build.zig.zon
+++ b/sdk/build.zig.zon
@@ -2,7 +2,7 @@
     .name = .fizzy,
     .version = "0.2.0",
     .fingerprint = 0x3311781b63706048,
-    .minimum_zig_version = "0.16.0",
+    .minimum_zig_version = "0.17.0",
     // Plugin SDK package — no app-only deps (Velopack, nightwatch, …). Plugins depend on
     // this directory; the repo-root zon owns the editor build. See AGENTS.md.
     .paths = .{
@@ -13,6 +13,7 @@
         "replay_module.zig",
         "plugin_sdk_meta.zig",
         "plugin_sdk_check.zig",
+        "plugin_sdk_install.zig",
         "sdk_version.zig",
         "manifest_identity.zig",
         "paths.zig",
@@ -39,14 +40,14 @@
         // `fizzy-sdk-<version>` tag in the fork before the pin lands. `fizzy-dev` itself stays a
         // working branch and can be rebased freely — the tag, never.
         .dvui = .{
-            // fizzy-sdk-0.2.30-6
-            .url = "https://github.com/foxnne/dvui-dev/archive/40e664ce21d4b6d2018b13ec36f0567d33e25498.tar.gz",
-            .hash = "dvui-0.5.0-dev-AQFJmSKDBAFEplBpuAqF3iL0FKaES5SrmKYLRWRyyWLJ",
+            // zig-0.17 branch (zig/0.17 pins a commit; tagged when it merges to main)
+            .url = "git+https://github.com/foxnne/dvui-dev#1b29a16d0340005c0d5ed2b689a7ffab797b1c37",
+            .hash = "dvui-0.6.0-dev-AQFJmXGtBAE8dNSt4nGJ7ToMZ9HR7rdMVubvTlhzO-mk",
             //.path = "../../dvui-dev",
         },
         .zf = .{
-            .url = "git+https://github.com/natecraddock/zf#c35c421f84895193246db06c40683c1a30e616ef",
-            .hash = "zf-0.11.0-OIRy8X-RAAAwaRXHMYpj2uvBnuGTZWEE_3V7acqHQNtW",
+            .url = "git+https://github.com/natecraddock/zf#e00f9e978b6a7126d1b35fa8ffd49b62042ad6f3",
+            .hash = "zf-0.11.0-OIRy8XCRAAB6FiMwIrtD6FqlagnFwpI6YyOu7bXeYH5J",
         },
     },
 }
diff --git a/sdk/plugin_sdk.zig b/sdk/plugin_sdk.zig
index 12af52b08..25c96e4d0 100644
--- a/sdk/plugin_sdk.zig
+++ b/sdk/plugin_sdk.zig
@@ -18,8 +18,6 @@ const std = @import("std");
 
 /// Shared with the runtime loader so install + load locations never drift (see its doc comment).
 /// Lives in this package; keep `localConfigRoot` in sync with `core/paths.zig`.
-const core_paths = @import("paths.zig");
-
 /// The `core` module's import set, shared with the app build so a dependency can't reach four of
 /// the five `core` compiles and miss this one (see its doc comment).
 const core_module = @import("core_module.zig");
@@ -32,9 +30,8 @@ const core_module = @import("core_module.zig");
 /// release tarball (`fizzy-sdk-v*.tar.gz`) it is vendored at the archive root, which *is* this
 /// package — so the access check below picks whichever layout is present.
 fn repoPath(b: *std.Build, sub_path: []const u8) std.Build.LazyPath {
-    b.build_root.handle.access(b.graph.io, sub_path, .{}) catch {
-        const root = b.build_root.path orelse @panic("fizzy sdk: missing build_root");
-        return .{ .cwd_relative = b.pathJoin(&.{ root, "..", sub_path }) };
+    b.root.access(b.graph.io, sub_path, .{}) catch {
+        return .{ .cwd_relative = b.root.joinString(b.allocator, b.pathJoin(&.{ "..", sub_path })) catch @panic("OOM") };
     };
     return b.path(sub_path);
 }
@@ -100,19 +97,22 @@ pub fn readManifest(b: *std.Build) IdentityManifest {
 }
 
 fn readManifestAt(b: *std.Build, rel_path: []const u8) IdentityManifest {
-    const raw = b.build_root.handle.readFileAlloc(b.graph.io, rel_path, b.allocator, std.Io.Limit.limited(256 * 1024)) catch |e|
+    b.dependOnFileContents(b.path(rel_path));
+    const raw = std.Io.Dir.cwd().readFileAlloc(b.graph.io, b.root.joinString(b.allocator, rel_path) catch @panic("OOM"), b.allocator, std.Io.Limit.limited(256 * 1024)) catch |e|
         std.debug.panic(
             "fizzy: could not read {s}: {}\nEvery plugin needs a `plugin.zig.zon` manifest at its root (id/name/version) — see docs/PLUGINS.md.",
             .{ rel_path, e },
         );
-    const src = b.allocator.dupeZ(u8, raw) catch @panic("OOM");
+    const src = b.allocator.dupeSentinel(u8, raw, 0) catch @panic("OOM");
     const Target = struct {
         id: []const u8,
         name: []const u8,
         version: []const u8,
         min_sdk_version: []const u8 = "",
     };
-    const parsed = std.zon.parse.fromSliceAlloc(Target, b.allocator, src, null, .{ .ignore_unknown_fields = true }) catch |e|
+    // The build's allocator is freed only when the build ends: the manifest is read into it.
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const parsed = std.zon.parse.fromSlice(Target, .{ .gpa = b.allocator, .arena = b.allocator, .source = src, .diagnostics = &diag, .ignore_unknown_fields = true }) catch |e|
         std.debug.panic("fizzy: failed to parse {s}: {}", .{ rel_path, e });
     _ = std.SemanticVersion.parse(parsed.version) catch
         std.debug.panic("fizzy: {s} .version \"{s}\" is not valid semver (expected e.g. 1.2.3)", .{ rel_path, parsed.version });
@@ -253,19 +253,56 @@ pub fn install(b: *std.Build, lib: *std.Build.Step.Compile, opts: InstallOptions
     // convenience). Not for a wasm build: the browser has no plugins directory, and the desktop
     // editor would only find a file it cannot open.
     if (lib.rootModuleTarget().cpu.arch == .wasm32) return;
-    const dev = b.allocator.create(DevInstall) catch @panic("OOM");
-    dev.* = .{
-        .step = std.Build.Step.init(.{
-            .id = .custom,
-            .name = b.fmt("install plugin '{s}' into fizzy plugins dir", .{name}),
-            .owner = b,
-            .makeFn = DevInstall.make,
-        }),
-        .lib = lib,
-        .name = name,
-        .file_name = dest,
-    };
-    dev.step.dependOn(&lib.step);
+    addDevInstall(b, lib, name, dest, b.fmt("install plugin '{s}' into fizzy plugins dir", .{name}));
+}
+
+pub const InstallBesideOptions = struct {
+    /// The plugin's manifest `id`: the directory the artifact joins.
+    plugin: []const u8,
+};
+
+/// Wire `zig build install` to drop a second artifact (a helper program the plugin starts, say)
+/// into the plugin's own `{plugins}/{plugin}/` directory, beside the library `install` puts there,
+/// under the artifact's own file name and with its permissions. Like `install`'s copy, a dev
+/// convenience: a release ships what the plugin's `release.yml` uploads.
+///
+///     fizzy.plugin.installBeside(b, helper_exe, .{ .plugin = "agent" });
+pub fn installBeside(b: *std.Build, artifact: *std.Build.Step.Compile, opts: InstallBesideOptions) void {
+    if (artifact.rootModuleTarget().cpu.arch == .wasm32) return;
+    addDevInstall(b, artifact, opts.plugin, artifact.out_filename, b.fmt("install '{s}' beside plugin '{s}'", .{ artifact.out_filename, opts.plugin }));
+}
+
+/// The helper `addDevInstall` runs, one per builder however many artifacts it installs. Debug:
+/// it only copies a file, and a ReleaseFast compile of it cost a cold plugin build about 4 s.
+fn devInstallExe(b: *std.Build) *std.Build.Step.Compile {
+    const gop = dev_install_exes.getOrPut(b.allocator, b) catch @panic("OOM");
+    if (!gop.found_existing) {
+        const fizzy_dep = fizzyDep(b, .{ .target = b.graph.host, .optimize = .fast });
+        gop.value_ptr.* = b.addExecutable(.{
+            .name = "fizzy-plugin-dev-install",
+            .root_module = b.createModule(.{
+                .root_source_file = fizzy_dep.path("plugin_sdk_install.zig"),
+                .target = b.graph.host,
+                .optimize = .debug,
+            }),
+        });
+    }
+    return gop.value_ptr.*;
+}
+var dev_install_exes: std.AutoHashMapUnmanaged(*std.Build, *std.Build.Step.Compile) = .empty;
+
+/// Copy `artifact` to `{plugins}/{dir_name}/{file_name}` on every `zig build install`, through
+/// `plugin_sdk_install.zig`: Zig 0.17's build has no custom steps.
+fn addDevInstall(b: *std.Build, artifact: *std.Build.Step.Compile, dir_name: []const u8, file_name: []const u8, step_name: []const u8) void {
+    const dev = b.addRunArtifact(devInstallExe(b));
+    dev.setName(step_name);
+    dev.addArtifactArg(artifact);
+    dev.addArgs(&.{ dir_name, file_name });
+    // A relative `FIZZY_PROFILE` is taken from the plugin's own directory.
+    dev.setCwd(b.path("."));
+    // Every install, not only when the artifact changed: the copy in the plugins dir may have
+    // been replaced or removed since.
+    dev.has_side_effects = true;
     b.getInstallStep().dependOn(&dev.step);
 }
 
@@ -273,7 +310,7 @@ pub fn install(b: *std.Build, lib: *std.Build.Step.Compile, opts: InstallOptions
 /// abi_fingerprint safety class matches the dylib). Identity comes from `plugin.zig.zon`.
 /// No dlopen — works for Windows and cross-compiles.
 fn addSdkMeta(b: *std.Build, lib: *std.Build.Step.Compile) *std.Build.Step {
-    const optimize = lib.root_module.optimize orelse .Debug;
+    const optimize = lib.root_module.optimize orelse .debug;
     // One meta emitter per optimize class — Debug vs ReleaseFast disagree on abi_fingerprint.
     const step_name = b.fmt("sdk-meta-{s}", .{@tagName(optimize)});
     if (b.top_level_steps.get(step_name)) |existing| return &existing.step;
@@ -316,13 +353,14 @@ fn addSdkCheck(b: *std.Build) *std.Build.Step {
     const step = b.step("check", "Print pinned fizzy SDK version + abi fingerprint (and catch legacy release.yml drift)");
 
     const release_yml = ".github/workflows/release.yml";
-    b.build_root.handle.access(b.graph.io, release_yml, .{}) catch return step;
+    dependOnPathExistence(b, release_yml);
+    b.root.access(b.graph.io, release_yml, .{}) catch return step;
 
-    const fizzy_dep = fizzyDep(b, .{ .target = b.graph.host, .optimize = .ReleaseFast });
+    const fizzy_dep = fizzyDep(b, .{ .target = b.graph.host, .optimize = .fast });
     const check_mod = b.createModule(.{
         .root_source_file = fizzy_dep.path("plugin_sdk_check.zig"),
         .target = b.graph.host,
-        .optimize = .ReleaseFast,
+        .optimize = .fast,
     });
     check_mod.addImport("fizzy_sdk", fizzy_dep.module("fizzy_sdk"));
     const check_exe = b.addExecutable(.{ .name = "fizzy-plugin-sdk-check", .root_module = check_mod });
@@ -332,6 +370,17 @@ fn addSdkCheck(b: *std.Build) *std.Build.Step {
     return step;
 }
 
+/// `-Dplugin-use-llvm`, declared on the first plugin a builder makes and remembered for the rest:
+/// fizzy's own build makes several plugins on one builder, and an option may be declared only
+/// once. An option, not an environment variable: Zig 0.17 caches the build's configuration
+/// without regard to the environment, so a variable read here would be seen once and then ignored.
+fn pluginUseLlvm(b: *std.Build) ?bool {
+    const gop = plugin_use_llvm.getOrPut(b.allocator, b) catch @panic("OOM");
+    if (!gop.found_existing) gop.value_ptr.* = b.option(bool, "plugin-use-llvm", "Force (true) or forbid (false) LLVM for plugin builds; unset, Zig chooses");
+    return gop.value_ptr.*;
+}
+var plugin_use_llvm: std.AutoHashMapUnmanaged(*std.Build, ?bool) = .empty;
+
 /// Platform extension for a dynamic plugin library, for the given target OS.
 fn pluginExt(os_tag: std.Target.Os.Tag) []const u8 {
     return switch (os_tag) {
@@ -342,74 +391,6 @@ fn pluginExt(os_tag: std.Target.Os.Tag) []const u8 {
     };
 }
 
-/// Resolve `{local_config}/fizzy/plugins` on the build host — exactly where the app scans for
-/// user plugins. Must mirror `known-folders` `.local_configuration` (what the runtime loader
-/// uses, see `core/paths.zig`) + `fizzy/plugins`:
-///   macOS   `~/Library/Application Support/fizzy/plugins`
-///   Linux   `$XDG_CONFIG_HOME/fizzy/plugins` (or `~/.config/fizzy/plugins`)
-///   Windows `%LOCALAPPDATA%/fizzy/plugins`   (FOLDERID_LocalAppData — *not* Roaming/`%APPDATA%`)
-///
-/// With `FIZZY_PROFILE` set, `<profile>/plugins` instead — the plugins directory of a fizzy run
-/// with that profile (`app/profile.zig`), so a sandbox build never replaces the plugin a person
-/// has installed. A relative profile is taken from the plugin's directory, where `zig build`
-/// runs; give an absolute one to share it with a fizzy started elsewhere.
-fn fizzyPluginsDir(b: *std.Build) ![]const u8 {
-    const env = &b.graph.environ_map;
-    if (env.get("FIZZY_PROFILE")) |profile| {
-        if (profile.len > 0) return std.fs.path.resolve(b.allocator, &.{ b.build_root.path orelse ".", profile, "plugins" });
-    }
-    const config_root = (try core_paths.localConfigRoot(
-        b.graph.host.result.os.tag,
-        b.allocator,
-        env.get("HOME"),
-        env.get("XDG_CONFIG_HOME"),
-        env.get("LOCALAPPDATA"),
-    )) orelse return error.NoConfigHome;
-    return std.fs.path.join(b.allocator, &.{ config_root, "fizzy", "plugins" });
-}
-
-/// Custom step: copy the built dylib into the host's fizzy plugins dir, under its own
-/// `{id}/{id}.{ext}` directory (see plans/PLUGIN_MANIFEST_PLAN.md R10). No `.zon` sidecar — the
-/// dylib's own exports (`fizzy_plugin_id`/`fizzy_plugin_manifest_zon`/…) are identity's only
-/// on-disk-adjacent copy.
-const DevInstall = struct {
-    step: std.Build.Step,
-    lib: *std.Build.Step.Compile,
-    /// Bare plugin name (the manifest `id`) — its own subdirectory name under the plugins dir.
-    name: []const u8,
-    file_name: []const u8,
-
-    fn make(step: *std.Build.Step, _: std.Build.Step.MakeOptions) anyerror!void {
-        const self: *DevInstall = @fieldParentPtr("step", step);
-        const b = step.owner;
-        const io = b.graph.io;
-
-        // Skip gracefully if the host has no resolvable config home (e.g. a bare CI runner) so a
-        // plain `zig build` for packaging never fails on the dev convenience.
-        const plugins_dir = fizzyPluginsDir(b) catch |err| {
-            std.log.warn("fizzy: skipping plugin dev install (no config home: {s})", .{@errorName(err)});
-            return;
-        };
-        // This plugin's own `{plugins}/{name}` directory, and whatever above it is missing — a
-        // profile's whole tree, the first time a sandbox is built into. "Already exists" is fine.
-        const dir = try std.fs.path.join(b.allocator, &.{ plugins_dir, self.name });
-        std.Io.Dir.cwd().createDirPath(io, dir) catch {};
-
-        // `getPath2` is relative to the build root (the runner's cwd); the dest is absolute.
-        const src = self.lib.getEmittedBin().getPath2(b, step);
-        const dest = try std.fs.path.join(b.allocator, &.{ dir, self.file_name });
-        const data = try std.Io.Dir.cwd().readFileAlloc(io, src, b.allocator, .limited(512 * 1024 * 1024));
-        // Sibling temp file + rename, not a truncating write onto `dest`: a running fizzy may be
-        // reading `dest` right now (`PluginLoader.stableLoadCopyPath` copies from it), and on
-        // Windows a plain overwrite of a file the editor still has open fails outright. The rename
-        // also means a crash mid-write never leaves a half-written dylib at the load path.
-        const tmp = try std.fmt.allocPrint(b.allocator, "{s}.part", .{dest});
-        try std.Io.Dir.cwd().writeFile(io, .{ .sub_path = tmp, .data = data });
-        try std.Io.Dir.renameAbsolute(tmp, dest, io);
-        std.log.info("fizzy: installed plugin → {s}", .{dest});
-    }
-};
-
 /// A C source file + its compile flags, for `addCModule`.
 pub const CSourceFile = struct {
     file: std.Build.LazyPath,
@@ -555,12 +536,10 @@ pub fn create(b: *std.Build, opts: CreateOptions) PluginArtifact {
     // The id a crash report names this exact binary by (fizzy's `app/crash/image.zig`). Mach-O
     // always carries one (LC_UUID) and PE one with its PDB; an ELF image only when asked.
     if (opts.target.result.ofmt == .elf) lib.build_id = .fast;
-    // `FIZZY_PLUGIN_USE_LLVM=1` / `=0` forces the code generator for a plugin build; unset, Zig
-    // chooses its default for the target. For measuring the rebuild
-    // loop per backend (`scripts/plugin-loop/bench.py --backend`, `.github/workflows/plugin-loop.yml`):
-    // an environment variable rather than a `-D` option, because fizzy's own build creates several
-    // plugins on one builder, and an option may be declared only once.
-    if (b.graph.environ_map.get("FIZZY_PLUGIN_USE_LLVM")) |v| lib.use_llvm = !std.mem.eql(u8, v, "0");
+    // `-Dplugin-use-llvm=true|false` forces the code generator for a plugin build; unset, Zig
+    // chooses its default for the target. For measuring the rebuild loop per backend
+    // (`scripts/plugin-loop/bench.py --backend`, `.github/workflows/plugin-loop.yml`).
+    if (pluginUseLlvm(b)) |v| lib.use_llvm = v;
     if (is_wasm) {
         // A wasm *side module* (Emscripten's term): position-independent, no entry, no
         // threads, loaded into the web host's memory and function table at runtime — the
@@ -672,3 +651,19 @@ pub fn installBuiltinPlugin(
         .dest_sub_path = b.fmt("{s}/{s}.{s}", .{ name, name, ext }),
     });
 }
+
+/// Declare to Zig 0.17's configure cache that the build read whether `rel` exists: the file itself
+/// when it does, and otherwise the nearest directory that exists, since the maker cannot load a
+/// configuration that depends on a path inside a missing directory ("configuration failed:
+/// FileSystemFailure"). Making the file changes that directory, so the build still reconfigures.
+fn dependOnPathExistence(b: *std.Build, rel: []const u8) void {
+    b.root.access(b.graph.io, rel, .{}) catch {
+        var dir = std.fs.path.dirname(rel);
+        while (dir) |d| : (dir = std.fs.path.dirname(d)) {
+            b.root.access(b.graph.io, d, .{}) catch continue;
+            return b.dependOnDirectoryMetadata(b.path(d));
+        }
+        return b.dependOnDirectoryMetadata(b.path("."));
+    };
+    b.dependOnFileMetadata(b.path(rel));
+}
diff --git a/sdk/plugin_sdk_install.zig b/sdk/plugin_sdk_install.zig
new file mode 100644
index 000000000..d2c11a058
--- /dev/null
+++ b/sdk/plugin_sdk_install.zig
@@ -0,0 +1,64 @@
+//! Copy a built plugin, or a program it installs beside itself, into fizzy's plugins directory:
+//! `zig build install`'s dev convenience, wired by `fizzy.plugin.install` and `.installBeside`.
+//! A program run by a Run step, because Zig 0.17's build has no custom steps.
+//!
+//! Usage: `plugin_sdk_install <built artifact> <name> <file name>`. It lands at
+//! `<plugins>/<name>/<file name>`, where `<plugins>` is `$FIZZY_PROFILE/plugins` when that is set
+//! (a relative profile is taken from the working directory, the plugin's own) and otherwise the
+//! host's fizzy plugins directory, the one the editor scans. Read here, at make time, so the
+//! build's configure step never depends on the environment.
+const std = @import("std");
+const builtin = @import("builtin");
+const paths = @import("paths.zig");
+
+pub fn main(init: std.process.Init) !void {
+    const arena = init.arena.allocator();
+    const io = init.io;
+    const args = try init.minimal.args.toSlice(arena);
+    if (args.len != 4) {
+        std.debug.print("usage: plugin_sdk_install <built dylib> <name> <file name>\n", .{});
+        std.process.exit(2);
+    }
+    const src, const name, const file_name = .{ args[1], args[2], args[3] };
+
+    const plugins_dir = pluginsDir(arena, init.environ_map) catch |err| {
+        // A bare CI runner has no config home; packaging must not fail on a dev convenience.
+        std.log.warn("fizzy: skipping plugin dev install (no config home: {t})", .{err});
+        return;
+    };
+    // This plugin's own `{plugins}/{name}` directory, and whatever above it is missing — a
+    // profile's whole tree, the first time a sandbox is built into.
+    const dir = try std.fs.path.join(arena, &.{ plugins_dir, name });
+    const cwd = std.Io.Dir.cwd();
+    cwd.createDirPath(io, dir) catch {};
+
+    const dest = try std.fs.path.join(arena, &.{ dir, file_name });
+    const data = try cwd.readFileAlloc(io, src, arena, .limited(512 * 1024 * 1024));
+    // The source's permissions, so a program installed beside the plugin stays executable.
+    const permissions = (try cwd.statFile(io, src, .{})).permissions;
+    // Sibling temp file + rename, not a truncating write onto `dest`: a running fizzy may be
+    // reading `dest` right now (`PluginLoader.stableLoadCopyPath` copies from it), and on Windows
+    // a plain overwrite of a file the editor still has open fails outright. The rename also means
+    // a crash mid-write never leaves a half-written dylib at the load path.
+    const tmp = try std.fmt.allocPrint(arena, "{s}.part", .{dest});
+    try cwd.writeFile(io, .{ .sub_path = tmp, .data = data, .flags = .{ .permissions = permissions } });
+    try std.Io.Dir.rename(cwd, tmp, cwd, dest, io);
+    std.log.info("fizzy: installed {s} → {s}", .{ file_name, dest });
+}
+
+/// `{local_config}/fizzy/plugins`, mirroring the runtime loader (`core/paths.zig`), or
+/// `<profile>/plugins` under `FIZZY_PROFILE` (`app/profile.zig`), so a sandbox build never
+/// replaces the plugin a person has installed.
+fn pluginsDir(arena: std.mem.Allocator, env: *const std.process.Environ.Map) ![]const u8 {
+    if (env.get("FIZZY_PROFILE")) |profile| {
+        if (profile.len > 0) return std.fs.path.resolve(arena, &.{ profile, "plugins" });
+    }
+    const config_root = (try paths.localConfigRoot(
+        builtin.target.os.tag,
+        arena,
+        env.get("HOME"),
+        env.get("XDG_CONFIG_HOME"),
+        env.get("LOCALAPPDATA"),
+    )) orelse return error.NoConfigHome;
+    return std.fs.path.join(arena, &.{ config_root, "fizzy", "plugins" });
+}
diff --git a/sdk/replay/BlackBox.zig b/sdk/replay/BlackBox.zig
index 619ddb3da..eec1711e5 100644
--- a/sdk/replay/BlackBox.zig
+++ b/sdk/replay/BlackBox.zig
@@ -68,11 +68,11 @@ pub fn record(self: *BlackBox, gpa: std.mem.Allocator) void {
 fn toRecord(e: *const dvui.Event) ?events.Event {
     return switch (e.evt) {
         .mouse => |me| switch (me.action) {
-            .motion => .{ .kind = .motion, .button = @intFromEnum(me.button), .mod = @intFromEnum(me.mod), .x = me.p.x, .y = me.p.y },
-            .press => .{ .kind = .press, .button = @intFromEnum(me.button), .mod = @intFromEnum(me.mod), .x = me.p.x, .y = me.p.y },
-            .release => .{ .kind = .release, .button = @intFromEnum(me.button), .mod = @intFromEnum(me.mod), .x = me.p.x, .y = me.p.y },
-            .wheel_x => |ticks| .{ .kind = .wheel_x, .mod = @intFromEnum(me.mod), .x = ticks },
-            .wheel_y => |ticks| .{ .kind = .wheel_y, .mod = @intFromEnum(me.mod), .x = ticks },
+            .motion => .{ .kind = .motion, .button = @backingInt(me.button), .mod = @backingInt(me.mod), .x = me.p.x, .y = me.p.y },
+            .press => .{ .kind = .press, .button = @backingInt(me.button), .mod = @backingInt(me.mod), .x = me.p.x, .y = me.p.y },
+            .release => .{ .kind = .release, .button = @backingInt(me.button), .mod = @backingInt(me.mod), .x = me.p.x, .y = me.p.y },
+            .wheel_x => |ticks| .{ .kind = .wheel_x, .mod = @backingInt(me.mod), .x = ticks },
+            .wheel_y => |ticks| .{ .kind = .wheel_y, .mod = @backingInt(me.mod), .x = ticks },
             .focus, .position => null,
         },
         .key => |ke| .{
@@ -81,8 +81,8 @@ fn toRecord(e: *const dvui.Event) ?events.Event {
                 .repeat => .key_repeat,
                 .up => .key_up,
             },
-            .key = @intFromEnum(ke.code),
-            .mod = @intFromEnum(ke.mod),
+            .key = @backingInt(ke.code),
+            .mod = @backingInt(ke.mod),
         },
         .text => |t| switch (t.action) {
             .value => |v| .{ .kind = .text, .selected = v.selected },
diff --git a/sdk/replay/Input.zig b/sdk/replay/Input.zig
index 8dadef610..850c0aeff 100644
--- a/sdk/replay/Input.zig
+++ b/sdk/replay/Input.zig
@@ -16,7 +16,7 @@ const Sequencer = @import("tape").Sequencer;
 const chord = @import("tape").chord;
 
 /// The buttons this input has pressed and not let go of.
-held: std.EnumSet(Tape.Button) = .initEmpty(),
+held: std.EnumSet(Tape.Button) = .empty,
 
 /// A target's point in physical pixels: a fraction of the tagged rect (or the window), nudged by
 /// natural pixels. Only a visible tag has a point.
@@ -56,7 +56,7 @@ pub fn releaseHeld(self: *Input) void {
             _ = cw.addEventMouseButton(dvuiButton(b), .release) catch {};
         }
     }
-    self.held = .initEmpty();
+    self.held = .empty;
 }
 
 pub fn scroll(by: Tape.Scroll) void {
@@ -114,11 +114,11 @@ fn dvuiButton(b: Tape.Button) dvui.enums.Button {
 
 fn dvuiMod(m: chord.Mods) dvui.enums.Mod {
     var bits: u16 = 0;
-    if (m.ctrl) bits |= @intFromEnum(dvui.enums.Mod.lcontrol);
-    if (m.shift) bits |= @intFromEnum(dvui.enums.Mod.lshift);
-    if (m.alt) bits |= @intFromEnum(dvui.enums.Mod.lalt);
-    if (m.command) bits |= @intFromEnum(dvui.enums.Mod.lcommand);
-    return @enumFromInt(bits);
+    if (m.ctrl) bits |= @backingInt(dvui.enums.Mod.lcontrol);
+    if (m.shift) bits |= @backingInt(dvui.enums.Mod.lshift);
+    if (m.alt) bits |= @backingInt(dvui.enums.Mod.lalt);
+    if (m.command) bits |= @backingInt(dvui.enums.Mod.lcommand);
+    return @fromBackingInt(@intCast(bits));
 }
 
 /// The key events this frame's tape added, by `dvui.Event.num`: what `synthetic` answers from.
diff --git a/sdk/replay/Snapshot.zig b/sdk/replay/Snapshot.zig
index 3a55b50b1..3dea87645 100644
--- a/sdk/replay/Snapshot.zig
+++ b/sdk/replay/Snapshot.zig
@@ -121,7 +121,7 @@ pub fn get(self: *const Snapshot, n: u32) ?[]const u8 {
     return if (n == self.taken and n != 0) self.text.items else null;
 }
 
-const taking_id: dvui.Id = @enumFromInt(0x6669_7a7a_736e_6170); // "fizzsnap"
+const taking_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_736e_6170)); // "fizzsnap"
 const taking_key = "_snapshot_at";
 
 /// Whether a snapshot is being taken of this frame (`beginFrame`). Shared through the window's
@@ -382,7 +382,8 @@ test "a snapshot names what a person acts on, and what a tape aims at" {
     // It reads back as what it says: two buttons by name, the tagged one by its tag, the mark.
     var arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
     defer arena.deinit();
-    const nodes = try std.zon.parse.fromSliceAlloc([]const Node, arena.allocator(), try arena.allocator().dupeZ(u8, text), null, .{});
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const nodes = try std.zon.parse.fromSlice([]const Node, .{ .gpa = std.testing.allocator, .arena = arena.allocator(), .source = try arena.allocator().dupeSentinel(u8, text, 0), .diagnostics = &diag });
     var buttons: usize = 0;
     var save = false;
     var close = false;
@@ -466,7 +467,8 @@ test "a snapshot has the dialogs dvui shows after its capture, and says which wi
 
     var arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
     defer arena.deinit();
-    const nodes = try std.zon.parse.fromSliceAlloc([]const Node, arena.allocator(), try arena.allocator().dupeZ(u8, text), null, .{});
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const nodes = try std.zon.parse.fromSlice([]const Node, .{ .gpa = std.testing.allocator, .arena = arena.allocator(), .source = try arena.allocator().dupeSentinel(u8, text, 0), .diagnostics = &diag });
     // The windows first, each a node.
     try std.testing.expect(nodes.len > 3);
     for (nodes[0..3], [_][]const u8{ "app.window:main", "app.window:band", "app.window:dialog" }) |node, tag| {
diff --git a/sdk/replay/anchor.zig b/sdk/replay/anchor.zig
index 7036b37a1..e8b32c4fb 100644
--- a/sdk/replay/anchor.zig
+++ b/sdk/replay/anchor.zig
@@ -17,7 +17,7 @@
 const std = @import("std");
 const dvui = @import("dvui");
 
-const publish_id: dvui.Id = @enumFromInt(0x6669_7a7a_616e_6368); // "fizzanch"
+const publish_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_616e_6368)); // "fizzanch"
 /// The frame anchors were last asked for in, by its `frame_time_ns`. Not the `_anchors` bool an
 /// older copy of this file reads: a plugin built against that one marks nothing until rebuilt,
 /// rather than reading a value of another type.
diff --git a/sdk/src/Command.zig b/sdk/src/Command.zig
index 4b7024fdf..f1069319a 100644
--- a/sdk/src/Command.zig
+++ b/sdk/src/Command.zig
@@ -220,13 +220,13 @@ pub fn Params(comptime T: type) type {
         /// naming where, and returns `error.BadArguments`.
         pub fn parse(call: *Call) error{ BadArguments, OutOfMemory }!Args {
             const text = std.mem.trim(u8, call.args, " \t\r\n");
-            const source = try call.arena.dupeZ(u8, if (text.len == 0) ".{}" else text);
-            var diag: std.zon.parse.Diagnostics = .{};
-            return std.zon.parse.fromSliceAlloc(Args, call.arena, source, &diag, .{}) catch |err| switch (err) {
+            const source = try call.arena.dupeSentinel(u8, if (text.len == 0) ".{}" else text, 0);
+            var diag: std.zon.parse.Diagnostics = undefined;
+            return std.zon.parse.fromSlice(Args, .{ .gpa = call.arena, .arena = call.arena, .source = source, .diagnostics = &diag }) catch |err| switch (err) {
                 error.OutOfMemory => return error.OutOfMemory,
                 error.ParseZon => {
                     call.bad_args = true;
-                    const msg = std.fmt.allocPrint(call.arena, "{f}", .{&diag}) catch "the arguments do not fit";
+                    const msg = std.fmt.allocPrint(call.arena, "{f}", .{diag.fmt("args")}) catch "the arguments do not fit";
                     call.message = std.mem.trimEnd(u8, msg, "\n");
                     return error.BadArguments;
                 },
@@ -246,24 +246,24 @@ pub fn Params(comptime T: type) type {
     };
 }
 
-fn buildParams(comptime T: type) [std.meta.fields(T).len]Param {
-    const fields = std.meta.fields(T);
-    var out: [fields.len]Param = undefined;
-    for (fields, 0..) |f, i| {
-        if (!settings.isCell(f.type)) @compileError(
-            "sdk.Command.Params: field '" ++ f.name ++ "' of " ++ @typeName(T) ++
-                " must be an argument cell — `" ++ f.name ++ ": sdk.Command.Arg(" ++
-                @typeName(f.type) ++ ", .{ .description = \"…\" })`. Every parameter needs a description.",
+fn buildParams(comptime T: type) [@typeInfo(T).@"struct".field_names.len]Param {
+    const info = @typeInfo(T).@"struct";
+    var out: [info.field_names.len]Param = undefined;
+    for (info.field_names, info.field_types, info.field_attrs, 0..) |f_name, Cell, cell_attrs, i| {
+        if (!settings.isCell(Cell)) @compileError(
+            "sdk.Command.Params: field '" ++ f_name ++ "' of " ++ @typeName(T) ++
+                " must be an argument cell — `" ++ f_name ++ ": sdk.Command.Arg(" ++
+                @typeName(Cell) ++ ", .{ .description = \"…\" })`. Every parameter needs a description.",
         );
-        const opts = f.type.setting_options;
-        const default: ?f.type.Payload = if (f.defaultValue()) |cell| cell.v else null;
+        const opts = Cell.setting_options;
+        const default: ?Cell.Payload = if (cell_attrs.defaultValue(Cell)) |cell| cell.v else null;
         out[i] = .{
-            .key = f.name,
-            .label = opts.name orelse settings.deriveLabel(f.name),
+            .key = f_name,
+            .label = opts.name orelse settings.deriveLabel(f_name),
             .description = opts.description,
-            .kind = settings.kindFor(f.type.Payload, opts),
+            .kind = settings.kindFor(Cell.Payload, opts),
             .required = default == null,
-            .default = if (default) |d| defaultZon(f.type.Payload, d) else null,
+            .default = if (default) |d| defaultZon(Cell.Payload, d) else null,
         };
     }
     return out;
@@ -285,23 +285,20 @@ fn defaultZon(comptime P: type, comptime value: P) ?[]const u8 {
 
 /// `T`'s fields with bare payload types, each keeping its cell's default if it has one.
 fn Plain(comptime T: type) type {
-    const fields = std.meta.fields(T);
-    var names: [fields.len][:0]const u8 = undefined;
-    var types: [fields.len]type = undefined;
-    var attrs: [fields.len]std.builtin.Type.StructField.Attributes = undefined;
-    for (fields, 0..) |f, i| {
-        const P = f.type.Payload;
-        names[i] = f.name;
+    const info = @typeInfo(T).@"struct";
+    var types: [info.field_names.len]type = undefined;
+    var attrs: [info.field_names.len]std.lang.Type.Struct.FieldAttributes = undefined;
+    for (info.field_types, info.field_attrs, 0..) |Cell, cell_attrs, i| {
+        const P = Cell.Payload;
         types[i] = P;
-        attrs[i] = if (f.defaultValue()) |cell| blk: {
+        attrs[i] = if (cell_attrs.defaultValue(Cell)) |cell| blk: {
             const payload_default: P = cell.v;
             break :blk .{ .default_value_ptr = @ptrCast(&payload_default) };
         } else .{};
     }
-    const frozen_names = names;
     const frozen_types = types;
     const frozen_attrs = attrs;
-    return @Struct(.auto, null, &frozen_names, &frozen_types, &frozen_attrs);
+    return @Struct(.auto, null, info.field_names, &frozen_types, &frozen_attrs);
 }
 
 test "Params: descriptors, defaults and parsing" {
diff --git a/sdk/src/Manifest.zig b/sdk/src/Manifest.zig
index fac810a57..ee31afbce 100644
--- a/sdk/src/Manifest.zig
+++ b/sdk/src/Manifest.zig
@@ -52,7 +52,7 @@ author_url: []const u8 = "",
 /// `dupeZ`/`readFileAllocOptions` with a sentinel) into a `Manifest`. Validates `version` (and
 /// `min_sdk_version`, when non-empty) are well-formed semver post-parse — zon itself has no
 /// semver type, so this is the manifest's own integrity check on top of the structural parse.
-/// Free the result with `free`.
+/// The result, its strings included, lives in `arena`; `gpa` is the parse's scratch.
 ///
 /// **Unknown fields are ignored on purpose**, which is what makes this format forward-compatible:
 /// `Manifest` is explicitly a growing set of optional fields (R16 added `description`, R17 added
@@ -63,11 +63,15 @@ author_url: []const u8 = "",
 /// (`probeName`/`probeDescription`/`probeTags`/`probeVersionInfo`) would silently lose data it
 /// could otherwise still read. The tradeoff accepted here is that a misspelled field name is
 /// ignored rather than diagnosed; the visible symptom is a store listing missing that value.
-pub fn parse(gpa: std.mem.Allocator, source: [:0]const u8) !Manifest {
-    const m = try std.zon.parse.fromSliceAlloc(Manifest, gpa, source, null, .{
+pub fn parse(gpa: std.mem.Allocator, arena: std.mem.Allocator, source: [:0]const u8) !Manifest {
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const m = try std.zon.parse.fromSlice(Manifest, .{
+        .gpa = gpa,
+        .arena = arena,
+        .source = source,
+        .diagnostics = &diag,
         .ignore_unknown_fields = true,
     });
-    errdefer free(gpa, m);
     _ = std.SemanticVersion.parse(m.version) catch return error.InvalidVersion;
     if (m.min_sdk_version.len > 0) {
         _ = std.SemanticVersion.parse(m.min_sdk_version) catch return error.InvalidMinSdkVersion;
@@ -75,11 +79,6 @@ pub fn parse(gpa: std.mem.Allocator, source: [:0]const u8) !Manifest {
     return m;
 }
 
-/// Free a `Manifest` returned by `parse`.
-pub fn free(gpa: std.mem.Allocator, m: Manifest) void {
-    std.zon.parse.free(gpa, m);
-}
-
 test "Manifest parse round-trips identity" {
     const gpa = std.testing.allocator;
     const source: [:0]const u8 =
@@ -91,8 +90,11 @@ test "Manifest parse round-trips identity" {
         \\}
     ;
 
-    const m = try parse(gpa, source);
-    defer free(gpa, m);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+
+    defer arena.deinit();
+
+    const m = try parse(gpa, arena.allocator(), source);
 
     try std.testing.expectEqualStrings("example", m.id);
     try std.testing.expectEqualStrings("Example", m.name);
@@ -109,8 +111,9 @@ test "parse defaults min_sdk_version when omitted" {
         \\    .version = "0.1.0",
         \\}
     ;
-    const m = try parse(gpa, source);
-    defer free(gpa, m);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const m = try parse(gpa, arena.allocator(), source);
 
     try std.testing.expectEqualStrings("", m.min_sdk_version);
 }
@@ -124,8 +127,9 @@ test "parse defaults tags to empty when omitted" {
         \\    .version = "0.1.0",
         \\}
     ;
-    const m = try parse(gpa, source);
-    defer free(gpa, m);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const m = try parse(gpa, arena.allocator(), source);
 
     try std.testing.expectEqual(@as(usize, 0), m.tags.len);
 }
@@ -140,8 +144,9 @@ test "parse round-trips tags" {
         \\    .tags = .{ "editor", "pixel-art" },
         \\}
     ;
-    const m = try parse(gpa, source);
-    defer free(gpa, m);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const m = try parse(gpa, arena.allocator(), source);
 
     try std.testing.expectEqual(@as(usize, 2), m.tags.len);
     try std.testing.expectEqualStrings("editor", m.tags[0]);
@@ -159,8 +164,9 @@ test "parse round-trips author and author_url" {
         \\    .author_url = "https://example.test/~somebody",
         \\}
     ;
-    const m = try parse(gpa, source);
-    defer free(gpa, m);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const m = try parse(gpa, arena.allocator(), source);
 
     try std.testing.expectEqualStrings("somebody", m.author);
     try std.testing.expectEqualStrings("https://example.test/~somebody", m.author_url);
@@ -171,8 +177,9 @@ test "parse defaults author and author_url to empty" {
     const source: [:0]const u8 =
         \\.{ .id = "example", .name = "Example", .version = "0.1.0" }
     ;
-    const m = try parse(gpa, source);
-    defer free(gpa, m);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const m = try parse(gpa, arena.allocator(), source);
 
     try std.testing.expectEqualStrings("", m.author);
     try std.testing.expectEqualStrings("", m.author_url);
@@ -191,8 +198,9 @@ test "parse ignores fields a newer SDK added" {
         \\    .another = .{ "a", "b" },
         \\}
     ;
-    const m = try parse(gpa, source);
-    defer free(gpa, m);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const m = try parse(gpa, arena.allocator(), source);
 
     try std.testing.expectEqualStrings("example", m.id);
     try std.testing.expectEqualStrings("0.1.0", m.version);
@@ -207,5 +215,7 @@ test "parse rejects a non-semver version" {
         \\    .version = "not-a-version",
         \\}
     ;
-    try std.testing.expectError(error.InvalidVersion, parse(gpa, source));
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    try std.testing.expectError(error.InvalidVersion, parse(gpa, arena.allocator(), source));
 }
diff --git a/sdk/src/Plugin.zig b/sdk/src/Plugin.zig
index 0d0a17851..b9d0189da 100644
--- a/sdk/src/Plugin.zig
+++ b/sdk/src/Plugin.zig
@@ -48,7 +48,7 @@ step_format: u32 = 0,
 /// plugin's table. Leave it alone; call `errorName`.
 error_name: *const fn (code: ErrorInt) [:0]const u8 = &localErrorName,
 
-pub const ErrorInt = std.meta.Int(.unsigned, @bitSizeOf(anyerror));
+pub const ErrorInt = @Int(.unsigned, @bitSizeOf(anyerror));
 
 /// `@errorName` in whichever binary this is compiled into.
 pub fn localErrorName(code: ErrorInt) [:0]const u8 {
diff --git a/sdk/src/dvui_context.zig b/sdk/src/dvui_context.zig
index e1f199773..d72aa9070 100644
--- a/sdk/src/dvui_context.zig
+++ b/sdk/src/dvui_context.zig
@@ -51,7 +51,7 @@ pub const mouse_drag_threshold: f32 = 3;
 
 /// Where the host records whether input is touch, in the shared window's data — every dylib's
 /// copy of dvui has its own `Dragging.threshold`, and this is how they agree on it.
-const input_id: dvui.Id = @enumFromInt(0x6669_7a7a_795f_7463); // "fizzy_tc"
+const input_id: dvui.Id = @fromBackingInt(@intCast(0x6669_7a7a_795f_7463)); // "fizzy_tc"
 const input_key = "_touch_input";
 
 /// Host only, once a frame before anything handles input: note whether the pointer is a finger
diff --git a/sdk/src/dylib.zig b/sdk/src/dylib.zig
index 769f4251f..740d885a1 100644
--- a/sdk/src/dylib.zig
+++ b/sdk/src/dylib.zig
@@ -238,8 +238,8 @@ const dvui_shared_state_types = .{
 /// no store shard can ever match it, whatever the SDK version says (see `PluginStore`'s
 /// `host_optimize_matches_store`).
 pub const optimize_safety_class: []const u8 = switch (builtin.mode) {
-    .Debug, .ReleaseSafe => "safe",
-    .ReleaseFast, .ReleaseSmall => "fast",
+    .debug, .safe => "safe",
+    .fast, .small => "fast",
 };
 
 /// Runtime dlopen-time compatibility key, compared live host-vs-plugin (`fingerprintMatches`).
@@ -429,12 +429,12 @@ pub fn exportEntry(comptime plugin_mod: type, comptime identity: Identity, compt
             return tripletFromSemver(identity.version);
         }
         fn register(host: ?*Host) callconv(.c) u32 {
-            if (host == null) return @intFromEnum(RegisterStatus.err_null_host);
+            if (host == null) return @backingInt(RegisterStatus.err_null_host);
             if (!version.sdkVersionSatisfies(version.sdk_version, identity.min_sdk_version)) {
-                return @intFromEnum(RegisterStatus.err_sdk_version);
+                return @backingInt(RegisterStatus.err_sdk_version);
             }
-            plugin_mod.register(host.?) catch return @intFromEnum(RegisterStatus.err_register);
-            return @intFromEnum(RegisterStatus.ok);
+            plugin_mod.register(host.?) catch return @backingInt(RegisterStatus.err_register);
+            return @backingInt(RegisterStatus.ok);
         }
         fn setDvuiContext(
             window: ?*dvui.Window,
diff --git a/sdk/src/events.zig b/sdk/src/events.zig
index 8b282f5ed..90d819519 100644
--- a/sdk/src/events.zig
+++ b/sdk/src/events.zig
@@ -52,8 +52,9 @@ pub fn matches(pattern: []const u8, name: []const u8) bool {
 /// an emitter can grow a payload without breaking its listeners.
 pub fn parse(comptime T: type, arena: std.mem.Allocator, event: Event) !T {
     const text = std.mem.trim(u8, event.payload, " \t\r\n");
-    const source = try arena.dupeZ(u8, if (text.len == 0) ".{}" else text);
-    return std.zon.parse.fromSliceAlloc(T, arena, source, null, .{ .ignore_unknown_fields = true });
+    const source = try arena.dupeSentinel(u8, if (text.len == 0) ".{}" else text, 0);
+    var diag: std.zon.parse.Diagnostics = undefined;
+    return std.zon.parse.fromSlice(T, .{ .gpa = arena, .arena = arena, .source = source, .diagnostics = &diag, .ignore_unknown_fields = true });
 }
 
 // ---- what fizzy announces ----
diff --git a/sdk/src/fingerprint.zig b/sdk/src/fingerprint.zig
index 71a903697..b30c159fa 100644
--- a/sdk/src/fingerprint.zig
+++ b/sdk/src/fingerprint.zig
@@ -73,7 +73,7 @@ pub fn hashAll(h_in: u64, comptime types: anytype, comptime depth: comptime_int)
 fn hashType(h_in: u64, comptime T: type, comptime depth: comptime_int) u64 {
     comptime {
         const info = @typeInfo(T);
-        var h = mixU64(h_in, @intFromEnum(std.meta.activeTag(info)));
+        var h = mixU64(h_in, @backingInt(std.meta.activeTag(info)));
         // Bare function and opaque types are comptime-only / unsized; everything else
         // reached here has a concrete size and alignment worth folding in.
         if (info != .@"fn" and info != .@"opaque") {
@@ -84,25 +84,25 @@ fn hashType(h_in: u64, comptime T: type, comptime depth: comptime_int) u64 {
 
         switch (info) {
             .@"struct" => |s| {
-                h = mixU64(h, s.fields.len);
-                for (s.fields, 0..) |f, i| {
-                    h = mixStr(h, f.name);
+                h = mixU64(h, s.field_names.len);
+                for (s.field_names, s.field_types, 0..) |f_name, f_type, i| {
+                    h = mixStr(h, f_name);
                     // Packed structs have no byte offsets; fall back to declaration order.
-                    h = mixU64(h, if (s.layout == .@"packed") i else @offsetOf(T, f.name));
-                    h = hashType(h, f.type, depth - 1);
+                    h = mixU64(h, if (s.layout == .@"packed") i else @offsetOf(T, f_name));
+                    h = hashType(h, f_type, depth - 1);
                 }
             },
             .@"union" => |u| {
-                h = mixU64(h, u.fields.len);
-                for (u.fields) |f| {
-                    h = mixStr(h, f.name);
-                    h = hashType(h, f.type, depth - 1);
+                h = mixU64(h, u.field_names.len);
+                for (u.field_names, u.field_types) |f_name, f_type| {
+                    h = mixStr(h, f_name);
+                    h = hashType(h, f_type, depth - 1);
                 }
             },
             .@"enum" => |e| {
-                h = mixU64(h, e.fields.len);
-                for (e.fields, 0..) |f, i| {
-                    h = mixStr(h, f.name);
+                h = mixU64(h, e.field_names.len);
+                for (e.field_names, 0..) |f_name, i| {
+                    h = mixStr(h, f_name);
                     h = mixU64(h, i);
                 }
             },
@@ -112,18 +112,18 @@ fn hashType(h_in: u64, comptime T: type, comptime depth: comptime_int) u64 {
                 h = hashType(h, a.child, depth - 1);
             },
             .pointer => |p| {
-                h = mixU64(h, @intFromEnum(p.size));
-                h = mixU64(h, @intFromBool(p.is_const));
+                h = mixU64(h, @backingInt(p.size));
+                h = mixU64(h, @intFromBool(p.attrs.@"const"));
                 // Follow function pointers so vtable hook signatures are part of the
                 // hash, but never follow data pointers: that would deep-walk types we
                 // only pass by reference (e.g. `*dvui.Window`) and risk reference cycles.
                 if (@typeInfo(p.child) == .@"fn") h = hashType(h, p.child, depth - 1);
             },
             .@"fn" => |fninfo| {
-                h = mixU64(h, @intFromEnum(std.meta.activeTag(fninfo.calling_convention)));
-                h = mixU64(h, fninfo.params.len);
-                for (fninfo.params) |param| {
-                    if (param.type) |pt| {
+                h = mixU64(h, @backingInt(std.meta.activeTag(fninfo.attrs.@"callconv")));
+                h = mixU64(h, fninfo.param_types.len);
+                for (fninfo.param_types) |param| {
+                    if (param) |pt| {
                         h = hashType(h, pt, depth - 1);
                     } else {
                         h = mixStr(h, "anytype");
@@ -169,7 +169,7 @@ pub fn hashAllShape(h_in: u64, comptime types: anytype, comptime depth: comptime
 /// target-invariant and is hashed as-is.
 fn callingConventionShapeKey(cc: std.builtin.CallingConvention) u64 {
     if (std.meta.eql(cc, std.builtin.CallingConvention.c)) return 0;
-    return 1 + @intFromEnum(std.meta.activeTag(cc));
+    return 1 + @backingInt(std.meta.activeTag(cc));
 }
 
 /// `std.debug.SafetyLock.state`'s enum has a *different tag set* in safety builds
@@ -188,7 +188,7 @@ fn hashFieldTypeShape(h_in: u64, comptime FieldType: type, comptime depth: compt
 fn hashTypeShape(h_in: u64, comptime T: type, comptime depth: comptime_int) u64 {
     comptime {
         const info = @typeInfo(T);
-        var h = mixU64(h_in, @intFromEnum(std.meta.activeTag(info)));
+        var h = mixU64(h_in, @backingInt(std.meta.activeTag(info)));
         switch (info) {
             .int => {
                 // `usize`/`isize` are pointer-width: 64-bit on native, 32-bit on wasm32. Hashing
@@ -205,7 +205,7 @@ fn hashTypeShape(h_in: u64, comptime T: type, comptime depth: comptime_int) u64
                     h = mixStr(h, "isize");
                 } else {
                     const i = info.int;
-                    h = mixU64(h, @intFromEnum(i.signedness));
+                    h = mixU64(h, @backingInt(i.signedness));
                     h = mixU64(h, i.bits);
                 }
             },
@@ -216,25 +216,25 @@ fn hashTypeShape(h_in: u64, comptime T: type, comptime depth: comptime_int) u64
 
         switch (info) {
             .@"struct" => |s| {
-                h = mixU64(h, s.fields.len);
-                for (s.fields, 0..) |f, i| {
-                    h = mixStr(h, f.name);
+                h = mixU64(h, s.field_names.len);
+                for (s.field_names, s.field_types, 0..) |f_name, f_type, i| {
+                    h = mixStr(h, f_name);
                     h = mixU64(h, i); // declaration position, never a byte offset
-                    h = hashFieldTypeShape(h, f.type, depth - 1);
+                    h = hashFieldTypeShape(h, f_type, depth - 1);
                 }
             },
             .@"union" => |u| {
-                h = mixU64(h, u.fields.len);
-                for (u.fields, 0..) |f, i| {
-                    h = mixStr(h, f.name);
+                h = mixU64(h, u.field_names.len);
+                for (u.field_names, u.field_types, 0..) |f_name, f_type, i| {
+                    h = mixStr(h, f_name);
                     h = mixU64(h, i);
-                    h = hashFieldTypeShape(h, f.type, depth - 1);
+                    h = hashFieldTypeShape(h, f_type, depth - 1);
                 }
             },
             .@"enum" => |e| {
-                h = mixU64(h, e.fields.len);
-                for (e.fields, 0..) |f, i| {
-                    h = mixStr(h, f.name);
+                h = mixU64(h, e.field_names.len);
+                for (e.field_names, 0..) |f_name, i| {
+                    h = mixStr(h, f_name);
                     h = mixU64(h, i);
                 }
             },
@@ -244,15 +244,15 @@ fn hashTypeShape(h_in: u64, comptime T: type, comptime depth: comptime_int) u64
                 h = hashTypeShape(h, a.child, depth - 1);
             },
             .pointer => |p| {
-                h = mixU64(h, @intFromEnum(p.size));
-                h = mixU64(h, @intFromBool(p.is_const));
+                h = mixU64(h, @backingInt(p.size));
+                h = mixU64(h, @intFromBool(p.attrs.@"const"));
                 if (@typeInfo(p.child) == .@"fn") h = hashTypeShape(h, p.child, depth - 1);
             },
             .@"fn" => |fninfo| {
-                h = mixU64(h, callingConventionShapeKey(fninfo.calling_convention));
-                h = mixU64(h, fninfo.params.len);
-                for (fninfo.params) |param| {
-                    if (param.type) |pt| {
+                h = mixU64(h, callingConventionShapeKey(fninfo.attrs.@"callconv"));
+                h = mixU64(h, fninfo.param_types.len);
+                for (fninfo.param_types) |param| {
+                    if (param) |pt| {
                         h = hashTypeShape(h, pt, depth - 1);
                     } else {
                         h = mixStr(h, "anytype");
@@ -331,3 +331,36 @@ test "fingerprint catches function-pointer signature changes" {
     const v2 = comptime hashAll(seed, .{V2}, 6);
     try std.testing.expect(v1 != v2);
 }
+
+test "both hashes are the ones Zig 0.16 gave for the same types" {
+    // Computed by Zig 0.16 with this file as it was before 0.17 made `@typeInfo` struct-of-arrays
+    // (fizzy `main` at 7b538aa): the 0.17 loops hash the same facts in the same order. A type of
+    // every kind the hashes look into, at a depth that reaches them all.
+    const Tag = enum(u8) { a, b, c };
+    const Inner = extern struct { x: i16, y: f32 };
+    const Packed = packed struct { lo: u4, hi: u12 };
+    const Choice = union(enum) { none, int: i64, pair: [2]u16 };
+    const Opaque = opaque {};
+    const Probe = struct {
+        tag: Tag,
+        inner: Inner,
+        bits: Packed,
+        choice: Choice,
+        maybe: ?*const Inner,
+        many: [3]u16,
+        name: []const u8,
+        raw: [*]u8,
+        len: usize,
+        delta: isize,
+        ratio: f64,
+        on: bool,
+        hook: *const fn (state: *Opaque, n: u32, s: []const u8) callconv(.c) bool,
+        plain: *const fn (f32) void,
+        result: ?*const fn (?*anyopaque) callconv(.c) u64,
+    };
+    // Fixed widths only: `hashAll` folds in sizes, which this keeps the same on every target.
+    const Fixed = extern struct { a: u8, b: u32, c: i64, d: [4]u16, e: f32, t: Tag };
+    @setEvalBranchQuota(1_000_000);
+    try std.testing.expectEqual(@as(u64, 0x2ae9f3848d7d3d9f), comptime hashAllShape(seed, .{ Probe, Fixed }, 6));
+    try std.testing.expectEqual(@as(u64, 0xc0b59f8f6303fb84), comptime hashAll(seed, .{Fixed}, 6));
+}
diff --git a/sdk/src/keywords.zig b/sdk/src/keywords.zig
index 2cfe4453a..b613a6c26 100644
--- a/sdk/src/keywords.zig
+++ b/sdk/src/keywords.zig
@@ -135,7 +135,7 @@ pub fn strength(region: []const []const u8, surface: []const []const u8) Fit {
     var best: Fit = .none;
     for (region) |r| for (surface) |s| {
         const f = fit(r, s);
-        if (@intFromEnum(f) > @intFromEnum(best)) best = f;
+        if (@backingInt(f) > @backingInt(best)) best = f;
     };
     return best;
 }
diff --git a/sdk/src/render_bridge.zig b/sdk/src/render_bridge.zig
index 5d7bcf53c..1de789e62 100644
--- a/sdk/src/render_bridge.zig
+++ b/sdk/src/render_bridge.zig
@@ -62,10 +62,10 @@ fn textureCreate(
     const created = win.backend.textureCreate(pixels, .{
         .width = options.width,
         .height = options.height,
-        .format = @enumFromInt(options.format),
-        .interpolation = @enumFromInt(options.interpolation),
-        .wrap_u = @enumFromInt(options.wrap_u),
-        .wrap_v = @enumFromInt(options.wrap_v),
+        .format = @fromBackingInt(@intCast(options.format)),
+        .interpolation = @fromBackingInt(@intCast(options.interpolation)),
+        .wrap_u = @fromBackingInt(@intCast(options.wrap_u)),
+        .wrap_v = @fromBackingInt(@intCast(options.wrap_v)),
     }) catch return emptyTextureDesc();
     return proxy_bridge.textureDescFrom(created);
 }
@@ -107,10 +107,10 @@ fn textureCreateTarget(ctx: ?*anyopaque, options: proxy_bridge.CreateOptions) ca
     const target = win.backend.textureCreateTarget(.{
         .width = options.width,
         .height = options.height,
-        .format = @enumFromInt(options.format),
-        .interpolation = @enumFromInt(options.interpolation),
-        .wrap_u = @enumFromInt(options.wrap_u),
-        .wrap_v = @enumFromInt(options.wrap_v),
+        .format = @fromBackingInt(@intCast(options.format)),
+        .interpolation = @fromBackingInt(@intCast(options.interpolation)),
+        .wrap_u = @fromBackingInt(@intCast(options.wrap_u)),
+        .wrap_v = @fromBackingInt(@intCast(options.wrap_v)),
         .precision = std.enums.fromInt(dvui.Texture.Precision, options.precision) orelse .default,
     }) catch return emptyTextureDesc();
     return proxy_bridge.textureDescFromTarget(target);
@@ -205,7 +205,7 @@ fn openURL(ctx: ?*anyopaque, url: [*]const u8, url_len: usize, new_window: u8) c
 
 fn setCursor(ctx: ?*anyopaque, cursor: u8) callconv(.c) void {
     const win = windowFromCtx(ctx);
-    win.backend.setCursor(@enumFromInt(cursor));
+    win.backend.setCursor(@fromBackingInt(@intCast(cursor)));
 }
 
 fn textInputRect(ctx: ?*anyopaque, has_rect: u8, rect: proxy_bridge.ClipRect) callconv(.c) void {
diff --git a/sdk/src/settings.zig b/sdk/src/settings.zig
index 0f26b9708..657032c22 100644
--- a/sdk/src/settings.zig
+++ b/sdk/src/settings.zig
@@ -141,6 +141,24 @@ pub fn isCell(comptime T: type) bool {
 
 /// Compile error for a settings struct field that isn't a `Value(...)` cell. Bare fields used to
 /// be the whole API, so this names the fix rather than just the rule.
+/// True when a value of `T` holds a pointer anywhere in it. A settings payload may hold one only
+/// when it is a string itself: the schema copies strings out of a parse and frees them, and owns
+/// nothing else, so any other pointer would point into a parse's arena after it is freed.
+fn holdsPointers(comptime T: type) bool {
+    return comptime switch (@typeInfo(T)) {
+        .pointer => true,
+        .optional => |o| holdsPointers(o.child),
+        .array => |a| holdsPointers(a.child),
+        .@"struct" => |st| for (st.field_types) |F| {
+            if (holdsPointers(F)) break true;
+        } else false,
+        .@"union" => |u| for (u.field_types) |F| {
+            if (holdsPointers(F)) break true;
+        } else false,
+        else => false,
+    };
+}
+
 fn requireCell(comptime T: type, comptime field_name: []const u8, comptime owner: type) void {
     if (!isCell(T)) @compileError(
         "sdk.settings.Schema: field '" ++ field_name ++ "' of " ++ @typeName(owner) ++
@@ -185,10 +203,10 @@ fn intBounds(comptime IntT: type) struct { min: i64, max: i64 } {
 }
 
 fn enumChoices(comptime EnumT: type) []const []const u8 {
-    const enum_fields = std.meta.fields(EnumT);
-    comptime var names: [enum_fields.len][]const u8 = undefined;
-    inline for (enum_fields, 0..) |f, i| names[i] = f.name;
-    const frozen = names;
+    const names = @typeInfo(EnumT).@"enum".field_names;
+    comptime var out: [names.len][]const u8 = undefined;
+    inline for (names, 0..) |name, i| out[i] = name;
+    const frozen = out;
     return &frozen;
 }
 
@@ -219,17 +237,17 @@ pub fn kindFor(comptime T: type, comptime opts: Options) Kind {
     };
 }
 
-fn buildSettings(comptime T: type) [std.meta.fields(T).len]Setting {
-    const struct_fields = std.meta.fields(T);
-    var out: [struct_fields.len]Setting = undefined;
-    inline for (struct_fields, 0..) |f, i| {
-        requireCell(f.type, f.name, T);
-        const opts = f.type.setting_options;
+fn buildSettings(comptime T: type) [@typeInfo(T).@"struct".field_names.len]Setting {
+    const info = @typeInfo(T).@"struct";
+    var out: [info.field_names.len]Setting = undefined;
+    inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
+        requireCell(Cell, f_name, T);
+        const opts = Cell.setting_options;
         out[i] = .{
-            .key = f.name,
-            .label = opts.name orelse deriveLabel(f.name),
+            .key = f_name,
+            .label = opts.name orelse deriveLabel(f_name),
             .description = opts.description,
-            .kind = kindFor(f.type.Payload, opts),
+            .kind = kindFor(Cell.Payload, opts),
             .secret = opts.secret,
         };
     }
@@ -241,27 +259,29 @@ fn buildSettings(comptime T: type) [std.meta.fields(T).len]Setting {
 /// diff against defaults — works on this, which is why the on-disk format never learned that
 /// cells exist.
 fn Plain(comptime T: type) type {
-    const cell_fields = std.meta.fields(T);
-    var names: [cell_fields.len][:0]const u8 = undefined;
-    var types: [cell_fields.len]type = undefined;
-    var attrs: [cell_fields.len]std.builtin.Type.StructField.Attributes = undefined;
-    inline for (cell_fields, 0..) |f, i| {
-        requireCell(f.type, f.name, T);
-        const P = f.type.Payload;
-        const cell_default = f.defaultValue() orelse @compileError(
-            "sdk.settings.Schema: field '" ++ f.name ++ "' of " ++ @typeName(T) ++
+    const info = @typeInfo(T).@"struct";
+    var types: [info.field_names.len]type = undefined;
+    var attrs: [info.field_names.len]std.lang.Type.Struct.FieldAttributes = undefined;
+    inline for (info.field_names, info.field_types, info.field_attrs, 0..) |f_name, Cell, cell_attrs, i| {
+        requireCell(Cell, f_name, T);
+        const P = Cell.Payload;
+        if (typeTagFor(P) != .string and holdsPointers(P)) @compileError(
+            "sdk.settings.Schema: field '" ++ f_name ++ "' of " ++ @typeName(T) ++ " is a " ++
+                @typeName(P) ++ ", which holds pointers. A setting owns strings and plain values " ++
+                "only; keep a list as a string, or as several settings.",
+        );
+        const cell_default = cell_attrs.defaultValue(Cell) orelse @compileError(
+            "sdk.settings.Schema: field '" ++ f_name ++ "' of " ++ @typeName(T) ++
                 " needs a default value (`= .init(<default>)`) — required so settings.zon only " ++
                 "has to record what differs from it",
         );
         const payload_default: P = cell_default.v;
-        names[i] = f.name;
         types[i] = P;
         attrs[i] = .{ .default_value_ptr = @ptrCast(&payload_default) };
     }
-    const frozen_names = names;
     const frozen_types = types;
     const frozen_attrs = attrs;
-    return @Struct(.auto, null, &frozen_names, &frozen_types, &frozen_attrs);
+    return @Struct(.auto, null, info.field_names, &frozen_types, &frozen_attrs);
 }
 
 /// Type-erased read/write of a `Schema(T).Value` for fizzy's generic settings UI.
@@ -312,7 +332,7 @@ pub const SettingsSchema = struct {
 /// non-default-only persistence (see `diffSerialize`, R12 in plans/PLUGIN_MANIFEST_PLAN.md) diffs
 /// every value against.
 pub fn Schema(comptime T: type) type {
-    const struct_fields = std.meta.fields(T);
+    const info = @typeInfo(T).@"struct";
     const built_settings = buildSettings(T);
 
     return struct {
@@ -327,7 +347,7 @@ pub fn Schema(comptime T: type) type {
 
         /// Payload type of field `i`.
         fn PayloadOf(comptime i: usize) type {
-            return struct_fields[i].type.Payload;
+            return info.field_types[i].Payload;
         }
 
         /// Live payload of a field, by name — cells are transparent to everything in here.
@@ -337,12 +357,12 @@ pub fn Schema(comptime T: type) type {
 
         fn toPayloads(v: T) Payloads {
             var out: Payloads = undefined;
-            inline for (struct_fields) |f| @field(out, f.name) = @field(v, f.name).v;
+            inline for (info.field_names) |f_name| @field(out, f_name) = @field(v, f_name).v;
             return out;
         }
 
         fn fromPayloads(out: *T, p: Payloads) void {
-            inline for (struct_fields) |f| @field(out.*, f.name).v = @field(p, f.name);
+            inline for (info.field_names) |f_name| @field(out.*, f_name).v = @field(p, f_name);
         }
 
         pub fn load(host: anytype, id: []const u8, out: *T) void {
@@ -373,9 +393,9 @@ pub fn Schema(comptime T: type) type {
 
         fn isAllDefault(value: T) bool {
             const p = toPayloads(value);
-            inline for (struct_fields) |f| {
-                const P = f.type.Payload;
-                if (!fieldEqual(P, @field(p, f.name), @field(default_payloads, f.name))) return false;
+            inline for (info.field_names, info.field_types) |f_name, Cell| {
+                const P = Cell.Payload;
+                if (!fieldEqual(P, @field(p, f_name), @field(default_payloads, f_name))) return false;
             }
             return true;
         }
@@ -390,11 +410,11 @@ pub fn Schema(comptime T: type) type {
             var aw: std.Io.Writer.Allocating = .init(gpa);
             errdefer aw.deinit();
             try aw.writer.writeAll(".{\n");
-            inline for (struct_fields) |f| {
-                const P = f.type.Payload;
-                if (!fieldEqual(P, @field(p, f.name), @field(default_payloads, f.name))) {
-                    try aw.writer.print("    .{f} = ", .{std.zig.fmtId(f.name)});
-                    try std.zon.stringify.serialize(@field(p, f.name), .{}, &aw.writer);
+            inline for (info.field_names, info.field_types) |f_name, Cell| {
+                const P = Cell.Payload;
+                if (!fieldEqual(P, @field(p, f_name), @field(default_payloads, f_name))) {
+                    try aw.writer.print("    .{f} = ", .{std.zig.fmtId(f_name)});
+                    try std.zon.stringify.serialize(@field(p, f_name), .{}, &aw.writer);
                     try aw.writer.writeAll(",\n");
                 }
             }
@@ -440,9 +460,9 @@ pub fn Schema(comptime T: type) type {
         /// wholesale would hand a string literal to the allocator. Payloads that aren't strings
         /// or don't contain any need no release at all.
         fn freeOwned(gpa: std.mem.Allocator, value: T) void {
-            inline for (struct_fields) |f| {
-                if (comptime typeTagFor(f.type.Payload) == .string) {
-                    if (fieldIsOwned(f.name, value)) gpa.free(@field(value, f.name).v);
+            inline for (info.field_names, info.field_types) |f_name, Cell| {
+                if (comptime typeTagFor(Cell.Payload) == .string) {
+                    if (fieldIsOwned(f_name, value)) gpa.free(@field(value, f_name).v);
                 }
             }
         }
@@ -458,18 +478,50 @@ pub fn Schema(comptime T: type) type {
 
         pub fn applyZon(out: *T, blob: []const u8) void {
             const gpa = runtime.allocator();
-            const blob_z = gpa.dupeZ(u8, blob) catch |err| {
+            const blob_z = gpa.dupeSentinel(u8, blob, 0) catch |err| {
                 dvui.log.warn("sdk.settings: out of memory parsing settings: {s}", .{@errorName(err)});
                 return;
             };
             defer gpa.free(blob_z);
 
-            const parsed = std.zon.parse.fromSliceAlloc(Payloads, gpa, blob_z, null, .{
+            var arena: std.heap.ArenaAllocator = .init(gpa);
+            defer arena.deinit();
+            var diag: std.zon.parse.Diagnostics = undefined;
+            var parsed = std.zon.parse.fromSlice(Payloads, .{
+                .gpa = gpa,
+                .arena = arena.allocator(),
+                .source = blob_z,
+                .diagnostics = &diag,
                 .ignore_unknown_fields = true,
             }) catch |err| {
                 dvui.log.warn("sdk.settings: failed to parse settings: {s}", .{@errorName(err)});
                 return;
             };
+            // The parse's strings are in `arena`. One that is not the declared default is copied
+            // out, so it is this schema's to free (`freeOwned`); a default stays the default. A
+            // copy that fails frees the ones before it, and the live value is left as it was.
+            var copied: usize = 0;
+            const all_copied = copy: {
+                inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
+                    if (comptime typeTagFor(Cell.Payload) == .string) {
+                        const parsed_str = @field(parsed, f_name);
+                        if (parsed_str.ptr != @field(default_payloads, f_name).ptr) {
+                            @field(parsed, f_name) = gpa.dupe(u8, parsed_str) catch break :copy false;
+                        }
+                    }
+                    copied = i + 1;
+                }
+                break :copy true;
+            };
+            if (!all_copied) {
+                inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
+                    if (comptime typeTagFor(Cell.Payload) == .string) {
+                        if (i < copied and @field(parsed, f_name).ptr != @field(default_payloads, f_name).ptr) gpa.free(@field(parsed, f_name));
+                    }
+                }
+                dvui.log.warn("sdk.settings: out of memory keeping settings", .{});
+                return;
+            }
             freeOwned(gpa, out.*);
             fromPayloads(out, parsed);
         }
@@ -480,10 +532,10 @@ pub fn Schema(comptime T: type) type {
 
         fn getBool(ptr: *anyopaque, field_index: usize) bool {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    if (@typeInfo(f.type.Payload) != .bool) return false;
-                    return payloadPtr(v, f.name).*;
+                    if (@typeInfo(Cell.Payload) != .bool) return false;
+                    return payloadPtr(v, f_name).*;
                 }
             }
             return false;
@@ -491,9 +543,9 @@ pub fn Schema(comptime T: type) type {
 
         fn setBool(ptr: *anyopaque, field_index: usize, b: bool) void {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    if (@typeInfo(f.type.Payload) == .bool) payloadPtr(v, f.name).* = b;
+                    if (@typeInfo(Cell.Payload) == .bool) payloadPtr(v, f_name).* = b;
                     return;
                 }
             }
@@ -501,10 +553,10 @@ pub fn Schema(comptime T: type) type {
 
         fn getInt(ptr: *anyopaque, field_index: usize) i64 {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    if (@typeInfo(f.type.Payload) != .int) return 0;
-                    return @intCast(payloadPtr(v, f.name).*);
+                    if (@typeInfo(Cell.Payload) != .int) return 0;
+                    return @intCast(payloadPtr(v, f_name).*);
                 }
             }
             return 0;
@@ -512,11 +564,11 @@ pub fn Schema(comptime T: type) type {
 
         fn setInt(ptr: *anyopaque, field_index: usize, n: i64) void {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    if (@typeInfo(f.type.Payload) == .int) {
-                        const p = payloadPtr(v, f.name);
-                        p.* = std.math.cast(f.type.Payload, n) orelse p.*;
+                    if (@typeInfo(Cell.Payload) == .int) {
+                        const p = payloadPtr(v, f_name);
+                        p.* = std.math.cast(Cell.Payload, n) orelse p.*;
                     }
                     return;
                 }
@@ -525,10 +577,10 @@ pub fn Schema(comptime T: type) type {
 
         fn getFloat(ptr: *anyopaque, field_index: usize) f64 {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    if (@typeInfo(f.type.Payload) != .float) return 0;
-                    return @floatCast(payloadPtr(v, f.name).*);
+                    if (@typeInfo(Cell.Payload) != .float) return 0;
+                    return @floatCast(payloadPtr(v, f_name).*);
                 }
             }
             return 0;
@@ -536,9 +588,9 @@ pub fn Schema(comptime T: type) type {
 
         fn setFloat(ptr: *anyopaque, field_index: usize, n: f64) void {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    if (@typeInfo(f.type.Payload) == .float) payloadPtr(v, f.name).* = @floatCast(n);
+                    if (@typeInfo(Cell.Payload) == .float) payloadPtr(v, f_name).* = @floatCast(n);
                     return;
                 }
             }
@@ -546,15 +598,15 @@ pub fn Schema(comptime T: type) type {
 
         fn getEnumIndex(ptr: *anyopaque, field_index: usize) usize {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    const P = f.type.Payload;
+                    const P = Cell.Payload;
                     if (@typeInfo(P) != .@"enum") return 0;
                     // Declaration-order position, matching `enumChoices`' `choices` list and
                     // `setEnumIndex`'s `std.meta.tags(P)[choice_index]` — not the enum's raw
                     // backing integer, which for an explicit-value enum like `TabSize`
                     // (`@"2" = 2, @"4" = 4, @"8" = 8`) is out of range for `choices.len`.
-                    const current = payloadPtr(v, f.name).*;
+                    const current = payloadPtr(v, f_name).*;
                     const tags = std.meta.tags(P);
                     inline for (tags, 0..) |t, ti| {
                         if (t == current) return ti;
@@ -567,12 +619,12 @@ pub fn Schema(comptime T: type) type {
 
         fn setEnumIndex(ptr: *anyopaque, field_index: usize, choice_index: usize) void {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    const P = f.type.Payload;
+                    const P = Cell.Payload;
                     if (@typeInfo(P) == .@"enum") {
                         const tags = std.meta.tags(P);
-                        if (choice_index < tags.len) payloadPtr(v, f.name).* = tags[choice_index];
+                        if (choice_index < tags.len) payloadPtr(v, f_name).* = tags[choice_index];
                     }
                     return;
                 }
@@ -581,9 +633,9 @@ pub fn Schema(comptime T: type) type {
 
         fn getString(ptr: *anyopaque, field_index: usize) []const u8 {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    if (comptime typeTagFor(f.type.Payload) == .string) return payloadPtr(v, f.name).*;
+                    if (comptime typeTagFor(Cell.Payload) == .string) return payloadPtr(v, f_name).*;
                     return "";
                 }
             }
@@ -596,15 +648,15 @@ pub fn Schema(comptime T: type) type {
         fn setString(ptr: *anyopaque, field_index: usize, s: []const u8) void {
             const v = asValue(ptr);
             const gpa = runtime.allocator();
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    if (comptime typeTagFor(f.type.Payload) == .string) {
+                    if (comptime typeTagFor(Cell.Payload) == .string) {
                         const copy = gpa.dupe(u8, s) catch |err| {
-                            dvui.log.warn("sdk.settings: failed to set '{s}': {s}", .{ f.name, @errorName(err) });
+                            dvui.log.warn("sdk.settings: failed to set '{s}': {s}", .{ f_name, @errorName(err) });
                             return;
                         };
-                        if (fieldIsOwned(f.name, v.*)) gpa.free(@field(v.*, f.name).v);
-                        payloadPtr(v, f.name).* = copy;
+                        if (fieldIsOwned(f_name, v.*)) gpa.free(@field(v.*, f_name).v);
+                        payloadPtr(v, f_name).* = copy;
                     }
                     return;
                 }
@@ -613,10 +665,10 @@ pub fn Schema(comptime T: type) type {
 
         fn getZonText(ptr: *anyopaque, field_index: usize, arena: std.mem.Allocator) []const u8 {
             const v = asValue(ptr);
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, 0..) |f_name, i| {
                 if (i == field_index) {
                     var aw: std.Io.Writer.Allocating = .init(arena);
-                    std.zon.stringify.serialize(payloadPtr(v, f.name).*, .{}, &aw.writer) catch {
+                    std.zon.stringify.serialize(payloadPtr(v, f_name).*, .{}, &aw.writer) catch {
                         aw.deinit();
                         return "";
                     };
@@ -632,18 +684,22 @@ pub fn Schema(comptime T: type) type {
         fn setZonText(ptr: *anyopaque, field_index: usize, text: []const u8) bool {
             const v = asValue(ptr);
             const gpa = runtime.allocator();
-            inline for (struct_fields, 0..) |f, i| {
+            inline for (info.field_names, info.field_types, 0..) |f_name, Cell, i| {
                 if (i == field_index) {
-                    const P = f.type.Payload;
-                    const text_z = gpa.dupeZ(u8, text) catch return false;
+                    const P = Cell.Payload;
+                    const text_z = gpa.dupeSentinel(u8, text, 0) catch return false;
                     defer gpa.free(text_z);
-                    const parsed = std.zon.parse.fromSliceAlloc(P, gpa, text_z, null, .{}) catch return false;
-                    // Strings follow the same ownership rule as `setString`; other payloads are
-                    // plain values the parse allocated nothing for.
+                    var arena: std.heap.ArenaAllocator = .init(gpa);
+                    defer arena.deinit();
+                    var diag: std.zon.parse.Diagnostics = undefined;
+                    var parsed = std.zon.parse.fromSlice(P, .{ .gpa = gpa, .arena = arena.allocator(), .source = text_z, .diagnostics = &diag }) catch return false;
+                    // Strings follow the same ownership rule as `setString`: copied out of the
+                    // parse's arena, the schema's to free. Other payloads are plain values.
                     if (comptime typeTagFor(P) == .string) {
-                        if (fieldIsOwned(f.name, v.*)) gpa.free(@field(v.*, f.name).v);
+                        parsed = gpa.dupe(u8, parsed) catch return false;
+                        if (fieldIsOwned(f_name, v.*)) gpa.free(@field(v.*, f_name).v);
                     }
-                    payloadPtr(v, f.name).* = parsed;
+                    payloadPtr(v, f_name).* = parsed;
                     return true;
                 }
             }
@@ -1000,3 +1056,13 @@ test "a type with no dedicated control is still a legal setting, edited as zon t
     // `.other` payloads take part in diff-vs-default like anything else.
     try testing.expect(try S.diffSerialize(testing.allocator, .{}) == null);
 }
+
+test "a settings payload holds pointers only as a string" {
+    try std.testing.expect(!holdsPointers(u32));
+    try std.testing.expect(!holdsPointers(?[4]f32));
+    try std.testing.expect(!holdsPointers(enum { a, b }));
+    try std.testing.expect(holdsPointers([]const u8));
+    try std.testing.expect(holdsPointers([]const []const u8));
+    try std.testing.expect(holdsPointers(struct { n: u8, name: []const u8 }));
+    try std.testing.expect(holdsPointers(?struct { inner: [2]?*const u8 }));
+}
diff --git a/sdk/src/version.zig b/sdk/src/version.zig
index d04e2fc42..2d5d61eac 100644
--- a/sdk/src/version.zig
+++ b/sdk/src/version.zig
@@ -75,7 +75,7 @@ pub const sdk_version = @import("sdk_version").sdk_version;
 /// why it is a single target/mode-invariant literal rather than a per-target table. Update this
 /// value from the `@compileError` it triggers whenever it changes; leave `sdk_version` to the
 /// next SDK release.
-pub const recorded_sdk_shape_fingerprint: u64 = 0x35bac8377071cd23;
+pub const recorded_sdk_shape_fingerprint: u64 = 0x5f9c818a6972efd4;
 
 comptime {
     if (dylib.sdk_shape_fingerprint != recorded_sdk_shape_fingerprint) {
diff --git a/sdk/tape/Tape.zig b/sdk/tape/Tape.zig
index 19b6c76b8..634b96c2f 100644
--- a/sdk/tape/Tape.zig
+++ b/sdk/tape/Tape.zig
@@ -493,7 +493,7 @@ pub const Owned = struct {
 /// (`parse`) otherwise.
 pub fn load(gpa: std.mem.Allocator, bytes: []const u8, check: Check) !Owned {
     if (binary.sniff(bytes)) return binary.read(gpa, bytes, check);
-    const source = try gpa.dupeZ(u8, bytes);
+    const source = try gpa.dupeSentinel(u8, bytes, 0);
     defer gpa.free(source);
     return parse(gpa, source, check);
 }
@@ -502,7 +502,8 @@ pub fn load(gpa: std.mem.Allocator, bytes: []const u8, check: Check) !Owned {
 pub fn parse(gpa: std.mem.Allocator, source: [:0]const u8, check: Check) !Owned {
     var arena: std.heap.ArenaAllocator = .init(gpa);
     errdefer arena.deinit();
-    const tape = try std.zon.parse.fromSliceAlloc(Tape, arena.allocator(), source, null, .{});
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const tape = try std.zon.parse.fromSlice(Tape, .{ .gpa = gpa, .arena = arena.allocator(), .source = source, .diagnostics = &diag });
     try tape.validate(check);
     return .{ .arena = arena, .tape = tape };
 }
@@ -691,7 +692,7 @@ test "a tape round-trips through ZON" {
     var out: std.Io.Writer.Allocating = .init(testing.allocator);
     defer out.deinit();
     try tape.write(&out.writer);
-    const text = try testing.allocator.dupeZ(u8, out.written());
+    const text = try testing.allocator.dupeSentinel(u8, out.written(), 0);
     defer testing.allocator.free(text);
 
     var back = try parse(testing.allocator, text, .{});
@@ -762,7 +763,7 @@ test "a step changes a file of the keyframe before it, whose owner the app can a
     var out: std.Io.Writer.Allocating = .init(testing.allocator);
     defer out.deinit();
     try tape.write(&out.writer);
-    const source = try testing.allocator.dupeZ(u8, out.written());
+    const source = try testing.allocator.dupeSentinel(u8, out.written(), 0);
     defer testing.allocator.free(source);
     var back = try parse(testing.allocator, source, test_steps);
     defer back.deinit();
diff --git a/sdk/tape/binary.zig b/sdk/tape/binary.zig
index bc8a6f73c..8fe3610ec 100644
--- a/sdk/tape/binary.zig
+++ b/sdk/tape/binary.zig
@@ -68,7 +68,7 @@ pub const Header = struct {
 
     /// How many of its fields a tape of version `v` has on disk.
     fn fields(v: u16) usize {
-        return if (v >= 3) std.meta.fields(Header).len else 13;
+        return if (v >= 3) std.meta.fieldNames(Header).len else 13;
     }
 };
 /// What comes before the header: magic, version, flags.
@@ -209,7 +209,7 @@ fn writeBody(gpa: std.mem.Allocator, tape: Tape, w: *std.Io.Writer) !void {
         .blobs = count(blobs.items.len),
         .blob_bytes = count(blob_bytes),
     };
-    inline for (std.meta.fields(Header)) |f| try w.writeInt(u32, @field(h, f.name), .little);
+    inline for (@typeInfo(Header).@"struct".field_names, @typeInfo(Header).@"struct".field_types, @typeInfo(Header).@"struct".field_attrs) |f_name, _, _| try w.writeInt(u32, @field(h, f_name), .little);
 
     try writeTable(w, table.list.items, table.bytes);
     try writeTable(w, blobs.items, blob_bytes);
@@ -235,7 +235,7 @@ fn writeBody(gpa: std.mem.Allocator, tape: Tape, w: *std.Io.Writer) !void {
             },
             .press, .release => |btn| {
                 kind = if (op.do == .press) .press else .release;
-                small = @intFromEnum(btn);
+                small = @backingInt(btn);
             },
             .scroll => |s| {
                 kind = .scroll;
@@ -265,13 +265,13 @@ fn writeBody(gpa: std.mem.Allocator, tape: Tape, w: *std.Io.Writer) !void {
                 kind = .wait;
                 b = wt.timeout;
                 switch (wt.until) {
-                    .idle => small = @intFromEnum(UntilKind.idle),
+                    .idle => small = @backingInt(UntilKind.idle),
                     .shown => |s| {
-                        small = @intFromEnum(UntilKind.shown);
+                        small = @backingInt(UntilKind.shown);
                         a = table.index(s);
                     },
                     .gone => |s| {
-                        small = @intFromEnum(UntilKind.gone);
+                        small = @backingInt(UntilKind.gone);
                         a = table.index(s);
                     },
                 }
@@ -279,7 +279,7 @@ fn writeBody(gpa: std.mem.Allocator, tape: Tape, w: *std.Io.Writer) !void {
         }
         try w.writeInt(u32, op.at, .little);
         try w.writeInt(u32, op.ms, .little);
-        try w.writeByte(@intFromEnum(kind));
+        try w.writeByte(@backingInt(kind));
         try w.writeByte(small);
         try w.writeInt(u16, 0, .little);
         try w.writeInt(u32, a, .little);
@@ -292,7 +292,7 @@ fn writeBody(gpa: std.mem.Allocator, tape: Tape, w: *std.Io.Writer) !void {
     var settings_at: u32 = 0;
     for (tape.keyframes) |kf| {
         try w.writeInt(u32, table.index(kf.root), .little);
-        try w.writeByte(@intFromEnum(kf.layout));
+        try w.writeByte(@backingInt(kf.layout));
         try w.splatByteAll(0, 3);
         for ([_]u32{ files_at, count(kf.files.len), open_at, count(kf.open.len), settings_at, count(kf.settings.len) }) |v|
             try w.writeInt(u32, v, .little);
@@ -314,7 +314,7 @@ fn writeBody(gpa: std.mem.Allocator, tape: Tape, w: *std.Io.Writer) !void {
     var clear_at: u32 = 0;
     for (tape.captions) |c| {
         for ([_]u32{ c.at, c.ms, table.index(c.title), table.index(c.text) }) |v| try w.writeInt(u32, v, .little);
-        try w.writeByte(@intFromEnum(c.place));
+        try w.writeByte(@backingInt(c.place));
         try w.splatByteAll(0, 3);
         for ([_]u32{ table.index(c.near), clear_at, count(c.clear.len) }) |v| try w.writeInt(u32, v, .little);
         clear_at += count(c.clear.len);
@@ -419,13 +419,12 @@ pub fn read(gpa: std.mem.Allocator, bytes: []const u8, check: Tape.Check) ReadEr
         if (tape_version < 3) return error.Corrupt;
         const len = try pre.int(u32);
         if (len > max_inflated) return error.Corrupt;
-        var in_buffer: [4096]u8 = undefined;
-        var in: Endless = .init(bytes[prefix_size + 4 ..], &in_buffer);
+        var in: std.Io.Reader = .fixed(bytes[prefix_size + 4 ..]);
         const window = try gpa.alloc(u8, flate.max_window_len);
         defer gpa.free(window);
-        var d: flate.Decompress = .init(&in.reader, .zlib, window);
+        var d: flate.Decompress = .init(&in, .zlib, window);
         // One byte more than it should come to, so a stream that runs on is caught; a stream cut
-        // short runs on into the zeros, or stops early, or fails its checksum.
+        // short fails to read, or stops early, or fails its checksum.
         const inflated = d.reader.allocRemaining(a, .limited(@as(usize, len) + 1)) catch |err| return switch (err) {
             error.OutOfMemory => error.OutOfMemory,
             error.ReadFailed, error.StreamTooLong => error.Corrupt,
@@ -438,8 +437,8 @@ pub fn read(gpa: std.mem.Allocator, bytes: []const u8, check: Tape.Check) ReadEr
     var r: Reader = .{ .bytes = own };
 
     var h: Header = std.mem.zeroes(Header);
-    inline for (std.meta.fields(Header), 0..) |f, i| {
-        if (i < Header.fields(tape_version)) @field(h, f.name) = try r.int(u32);
+    inline for (@typeInfo(Header).@"struct".field_names, 0..) |f_name, i| {
+        if (i < Header.fields(tape_version)) @field(h, f_name) = try r.int(u32);
     }
 
     const strings = try Table.take(&r, h.strings, h.string_bytes);
@@ -568,32 +567,6 @@ pub fn read(gpa: std.mem.Allocator, bytes: []const u8, check: Tape.Check) ReadEr
     return .{ .arena = arena, .tape = tape };
 }
 
-/// A deflated stream's bytes, then zeros without end. std's inflate (0.16) misreads a stream that
-/// ends inside its last four bytes (`tossBitsShort` adds the bits it has used where it should take
-/// them away) and asserts past the end of its input — a crash on a tape cut short. Never letting
-/// its input end keeps it off that path; the inflated length, known from the header, bounds what a
-/// stream cut short can run on into. ZIG017: fixed in 0.17's inflate, so this goes with the move;
-/// 0.17 still leaves the checksum unchecked, so `read`'s Adler-32 check stays.
-const Endless = struct {
-    rest: []const u8,
-    reader: std.Io.Reader,
-
-    fn init(bytes: []const u8, buffer: []u8) Endless {
-        return .{ .rest = bytes, .reader = .{ .vtable = &.{ .stream = stream }, .buffer = buffer, .seek = 0, .end = 0 } };
-    }
-
-    fn stream(r: *std.Io.Reader, w: *std.Io.Writer, limit: std.Io.Limit) std.Io.Reader.StreamError!usize {
-        const self: *Endless = @alignCast(@fieldParentPtr("reader", r));
-        const dest = limit.slice(try w.writableSliceGreedy(1));
-        const n = @min(dest.len, self.rest.len);
-        @memcpy(dest[0..n], self.rest[0..n]);
-        @memset(dest[n..], 0);
-        self.rest = self.rest[n..];
-        w.advance(dest.len);
-        return dest.len;
-    }
-};
-
 /// `n` records of `size` bytes, or `error.Corrupt` when that is more than a tape could hold.
 fn sizeOf(n: usize, size: usize) ReadError!usize {
     return std.math.mul(usize, n, size) catch error.Corrupt;
@@ -767,7 +740,7 @@ test "binary and ZON are the same tape, converted either way" {
     var zon: std.Io.Writer.Allocating = .init(testing.allocator);
     defer zon.deinit();
     try tape.write(&zon.writer);
-    const source = try testing.allocator.dupeZ(u8, zon.written());
+    const source = try testing.allocator.dupeSentinel(u8, zon.written(), 0);
     defer testing.allocator.free(source);
     var from_zon = try Tape.parse(testing.allocator, source, steps_check);
     defer from_zon.deinit();
diff --git a/sdk/tape/events.zig b/sdk/tape/events.zig
index 501318d8c..2f67e62a8 100644
--- a/sdk/tape/events.zig
+++ b/sdk/tape/events.zig
@@ -60,7 +60,7 @@ pub const Event = extern struct {
     _pad1: u32 = 0,
 
     pub fn valid(self: Event) bool {
-        return @intFromEnum(self.kind) <= @intFromEnum(Kind.app_quit);
+        return @backingInt(self.kind) <= @backingInt(Kind.app_quit);
     }
 };
 
diff --git a/sdk/tape/ring.zig b/sdk/tape/ring.zig
index cc00fd128..e423ac0f4 100644
--- a/sdk/tape/ring.zig
+++ b/sdk/tape/ring.zig
@@ -315,7 +315,7 @@ test "the rings keep the newest, and a stretch starts at the oldest frame still
     for (0..TestRing.frames_cap + 10) |i| ring.appendFrame(.{ .t_ns = @intCast(i) }, &.{.{ .button = @intCast(i % 16) }}, &.{});
     try std.testing.expectEqual(@as(u64, 10), ring.oldestWhole());
     // Payloads outrunning their ring: a frame whose bytes were overwritten is not whole.
-    for (0..8) |_| ring.appendFrame(.{ .t_ns = 100 }, &.{.{ .button = 1 }}, &.{"x" ** 64});
+    for (0..8) |_| ring.appendFrame(.{ .t_ns = 100 }, &.{.{ .button = 1 }}, &.{&@as([64]u8, @splat('x'))});
     const oldest = ring.frame(ring.oldestWhole());
     const r = ring.records[@intCast(oldest.first % TestRing.records_cap)];
     try std.testing.expect(r.bytes_at >= ring.bytes_n - TestRing.bytes_cap);
diff --git a/spikes/windows-composition/src/main.zig b/spikes/windows-composition/src/main.zig
index 078ef65e4..17db71704 100644
--- a/spikes/windows-composition/src/main.zig
+++ b/spikes/windows-composition/src/main.zig
@@ -186,7 +186,7 @@ pub fn main() !void {
                     _ = c.SDL_SetGPUAllowedFramesInFlight(gpu, st.frames_in_flight);
                 },
                 c.SDLK_D => st.clip_delay = (st.clip_delay + 1) % 4,
-                c.SDLK_T => st.timing = @enumFromInt((@intFromEnum(st.timing) + 1) % 3),
+                c.SDLK_T => st.timing = @fromBackingInt(@intCast((@backingInt(st.timing) + 1) % 3)),
                 c.SDLK_B => st.use_backdrop = !st.use_backdrop,
                 c.SDLK_SPACE => st.paused = !st.paused,
                 c.SDLK_UP => st.speed *= 1.5,
diff --git a/spikes/windows-composition/src/overlay.zig b/spikes/windows-composition/src/overlay.zig
index ec29e6fac..d0de398a8 100644
--- a/spikes/windows-composition/src/overlay.zig
+++ b/spikes/windows-composition/src/overlay.zig
@@ -25,8 +25,8 @@ pub const Variant = enum {
 
     pub fn next(v: ?Variant) ?Variant {
         const cur = v orelse return .layered;
-        const i = @intFromEnum(cur) + 1;
-        return if (i >= @typeInfo(Variant).@"enum".fields.len) null else @enumFromInt(i);
+        const i = @backingInt(cur) + 1;
+        return if (i >= @typeInfo(Variant).@"enum".fields.len) null else @fromBackingInt(@intCast(i));
     }
 };
 
diff --git a/src/Entry.zig b/src/Entry.zig
index 8967fbb88..ee5c5e4b0 100644
--- a/src/Entry.zig
+++ b/src/Entry.zig
@@ -100,7 +100,7 @@ fn startOptions() dvui.App.StartOptions {
         }
         // A profile is the config folder itself (`app.profile`), for SDL's preferences too.
         const pref: ?[:0]const u8 = if (@import("app").profile.root) |root|
-            std.fmt.bufPrintZ(&pref_path_buf, "{s}", .{root}) catch null
+            std.fmt.bufPrintSentinel(&pref_path_buf, "{s}", .{root}, 0) catch null
         else
             paths.configFolderZ(&pref_path_buf, main_init.io, fizzy.core.platform.processEnviron(), ".", AppInfo.current.config_dir);
         if (pref) |pref_path| {
@@ -276,7 +276,7 @@ const sdk_version = std.fmt.comptimePrint("{f} ({x})", .{
 fn logFn(comptime level: std.log.Level, comptime scope: @EnumLiteral(), comptime format: []const u8, args: anytype) void {
     // A refresh record, counted as a frame's cause; printed only for `FIZZY_LOG_REFRESH`.
     if (fizzy.core.profile.interceptLog(level, scope, format, args) and !refresh_log_active) return;
-    if (comptime scope == .dvui and level == .debug and @import("builtin").mode != .Debug) return;
+    if (comptime scope == .dvui and level == .debug and @import("builtin").mode != .debug) return;
     if (!refresh_log_active) fizzy.OutputLog.append(level, scope, format, args);
     dvui.App.logFn(level, scope, format, args);
 }
@@ -356,7 +356,7 @@ pub fn AppInit(win: *dvui.Window) !void {
     app_ptr.* = .{
         .allocator = allocator,
         .window = win,
-        .root_path = try allocator.dupeZ(u8, path),
+        .root_path = try allocator.dupeSentinel(u8, path, 0),
     };
 
     const editor_ptr = try allocator.create(Editor);
@@ -375,6 +375,8 @@ pub fn AppInit(win: *dvui.Window) !void {
 
     // Whether dvui went quiet at the end of each frame, for the `automation` service's `settled`.
     if (comptime @hasDecl(dvui.backend, "frame_ended_hook")) dvui.backend.frame_ended_hook = frameEnded;
+    // Fizzy takes its floats out into windows itself (`Popout`).
+    if (comptime @hasDecl(dvui.backend, "floating_os_windows")) dvui.backend.floating_os_windows = .none;
 
     // Hand the window to the listener thread and queue our own argv so the
     // first frame opens any files / project folder supplied on the command line.
@@ -506,10 +508,21 @@ fn gpuTotals() ?fizzy.core.profile.Gpu {
     if (comptime !@hasDecl(dvui.backend, "gpuTotals")) return null;
     const t = dvui.backend.gpuTotals();
     var out: fizzy.core.profile.Gpu = .{};
-    inline for (std.meta.fields(fizzy.core.profile.Gpu)) |f| @field(out, f.name) = @truncate(@field(t, f.name));
+    inline for (@typeInfo(fizzy.core.profile.Gpu).@"struct".field_names, @typeInfo(fizzy.core.profile.Gpu).@"struct".field_types, @typeInfo(fizzy.core.profile.Gpu).@"struct".field_attrs) |f_name, _, _| @field(out, f_name) = @truncate(@field(t, f_name));
     return out;
 }
 
+/// The kinds of window material the backend can show (`core.material.Kinds`), from its own answer,
+/// field for field; `none` alone from a backend that does not say.
+fn materialOffered() fizzy.core.material.Kinds {
+    var k: fizzy.core.material.Kinds = .{};
+    if (comptime @hasDecl(dvui.backend, "materialKinds")) {
+        const b = dvui.currentWindow().backend.impl.materialKinds();
+        inline for (@typeInfo(fizzy.core.material.Kinds).@"struct".field_names) |f| @field(k, f) = @field(b, f);
+    }
+    return k;
+}
+
 /// One run of the app's frame.
 fn frameOnce() !dvui.App.Result {
     // First, before anything reads `dvui.events()` or the frame target binds: a playing demo adds
@@ -526,6 +539,9 @@ fn frameOnce() !dvui.App.Result {
     // A float asked out of the main window, or back into it, goes before anything is drawn
     // (`Editor.Popout`: on by default on macOS, `FIZZY_POPOUT` elsewhere).
     Editor.Popout.beginFrame(&fizzy.editor().app.layout);
+    // What the app's windows are made of, as the backend can show it, for every glass drawn this
+    // frame (`core.material`). `.none` until the app has a setting for it.
+    fizzy.core.material.publish((fizzy.core.material.Material{}).effective(materialOffered()));
     // The whole frame draws into a texture — see `core.FrameTarget` for why.
     {
         const prof = fizzy.core.profile.begin("fizzy", "frame target: begin");
diff --git a/src/backend/WebBackend.zig b/src/backend/WebBackend.zig
index 5c923443a..8fbe62da5 100644
--- a/src/backend/WebBackend.zig
+++ b/src/backend/WebBackend.zig
@@ -385,7 +385,7 @@ fn dvui_c_ldexp(x: f64, n: c_int) callconv(.c) f64 {
 // See https://github.com/ziglang/zig/issues/23358
 comptime {
     switch (builtin.mode) {
-        .Debug => {
+        .debug => {
             @export(&dvui_c_ldexp, .{ .name = "dvui_c_ldexp" });
         },
         else => {},
@@ -497,17 +497,17 @@ fn add_event_raw(w: *dvui.Window, which: u8, int1: u32, int2: u32, float1: f32,
             _ = try w.addEventText(.{ .text = str });
         },
         8 => {
-            const touch: dvui.enums.Button = @enumFromInt(@intFromEnum(dvui.enums.Button.touch0) + int1);
+            const touch: dvui.enums.Button = @fromBackingInt(@intCast(@backingInt(dvui.enums.Button.touch0) + int1));
             _ = try w.addEventPointer(.{ .button = touch, .action = .press, .xynorm = .{ .x = float1, .y = float2 } });
             touchPoints[int1] = .{ .x = float1, .y = float2 };
         },
         9 => {
-            const touch: dvui.enums.Button = @enumFromInt(@intFromEnum(dvui.enums.Button.touch0) + int1);
+            const touch: dvui.enums.Button = @fromBackingInt(@intCast(@backingInt(dvui.enums.Button.touch0) + int1));
             _ = try w.addEventPointer(.{ .button = touch, .action = .release, .xynorm = .{ .x = float1, .y = float2 } });
             touchPoints[int1] = null;
         },
         10 => {
-            const touch: dvui.enums.Button = @enumFromInt(@intFromEnum(dvui.enums.Button.touch0) + int1);
+            const touch: dvui.enums.Button = @fromBackingInt(@intCast(@backingInt(dvui.enums.Button.touch0) + int1));
             var dx: f32 = 0;
             var dy: f32 = 0;
             if (touchPoints[int1]) |p| {
@@ -665,12 +665,12 @@ fn web_mod_code_to_dvui(wmod: u8) dvui.enums.Mod {
     if (wmod == 0) return .none;
 
     var m: u16 = 0;
-    if (wmod & 0b0001 > 0) m |= @intFromEnum(dvui.enums.Mod.lshift);
-    if (wmod & 0b0010 > 0) m |= @intFromEnum(dvui.enums.Mod.lcontrol);
-    if (wmod & 0b0100 > 0) m |= @intFromEnum(dvui.enums.Mod.lalt);
-    if (wmod & 0b1000 > 0) m |= @intFromEnum(dvui.enums.Mod.lcommand);
+    if (wmod & 0b0001 > 0) m |= @backingInt(dvui.enums.Mod.lshift);
+    if (wmod & 0b0010 > 0) m |= @backingInt(dvui.enums.Mod.lcontrol);
+    if (wmod & 0b0100 > 0) m |= @backingInt(dvui.enums.Mod.lalt);
+    if (wmod & 0b1000 > 0) m |= @backingInt(dvui.enums.Mod.lcommand);
 
-    return @as(dvui.enums.Mod, @enumFromInt(m));
+    return @as(dvui.enums.Mod, @fromBackingInt(@intCast(m)));
 }
 
 //pub fn addAllEvents(self: *WebBackend, win: *dvui.Window) !void {
@@ -749,6 +749,15 @@ pub fn sleep(_: *WebBackend, ns: u64) void {
     wasm.wasm_sleep(@intCast(@divTrunc(ns, 1_000_000)));
 }
 
+/// The kinds of window material the web can show (fizzy's `core.material`, field for field):
+/// every one. Its glass is all drawn in the canvas, the one surface it puts glass on (Liquid Glass
+/// by its own shader), and the page behind a clear canvas shows through.
+pub const MaterialKinds = struct { none: bool = true, transparent: bool = true, blur: bool = true, frost: bool = true, liquid: bool = true };
+
+pub fn materialKinds(_: *WebBackend) MaterialKinds {
+    return .{};
+}
+
 pub fn begin(_: *WebBackend, arena_in: std.mem.Allocator) !void {
     arena = arena_in;
     batch = .{};
@@ -815,7 +824,7 @@ fn command(texture: ?dvui.Texture, maybe_clipr: ?dvui.Rect.Physical, index_start
         c.clip = @as(i32, b) << 1;
     } else if (texture) |t| {
         const blend = blends.get(@intFromPtr(t.ptr)) orelse .over;
-        c.clip = @as(i32, @intFromEnum(blend)) << 1;
+        c.clip = @as(i32, @backingInt(blend)) << 1;
     }
     if (maybe_clipr) |clipr| {
         c.clip |= 1;
diff --git a/src/backend/backend_native.zig b/src/backend/backend_native.zig
index 99a07422e..a80137de4 100644
--- a/src/backend/backend_native.zig
+++ b/src/backend/backend_native.zig
@@ -126,7 +126,7 @@ pub fn restoreWindowState(win: *dvui.Window) void {
         platform.geometry.setStore(.{ .load = layoutStoreLoad, .save = layoutStoreSave });
     };
     platform.geometry.restore(win);
-    platform.macos_monitor.install(win);
+    platform.macos_monitor.install(win, false);
 }
 
 /// Keep where the window is for the next launch. Call at shutdown (AppDeinit).
@@ -158,8 +158,9 @@ var layout_store_dir: []const u8 = "";
 
 fn layoutStoreLoad(_: ?*anyopaque) ?platform.geometry.Geometry {
     const gpa = std.heap.page_allocator;
-    const f = loadWindowFile(gpa, layout_store_dir);
-    defer std.zon.parse.free(gpa, f);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const f = loadWindowFile(gpa, arena.allocator(), layout_store_dir);
     if (f.w < 1 or f.h < 1) return null;
     return .{ .x = f.x, .y = f.y, .w = f.w, .h = f.h, .state = if (f.maximized) .maximized else .normal };
 }
@@ -167,8 +168,9 @@ fn layoutStoreLoad(_: ?*anyopaque) ?platform.geometry.Geometry {
 fn layoutStoreSave(_: ?*anyopaque, g: platform.geometry.Geometry) void {
     // Read-modify-write: the regions and tree on disk stay as they are.
     const gpa = std.heap.page_allocator;
-    var f = loadWindowFile(gpa, layout_store_dir);
-    defer std.zon.parse.free(gpa, f);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    var f = loadWindowFile(gpa, arena.allocator(), layout_store_dir);
     f.x = g.x;
     f.y = g.y;
     f.w = g.w;
@@ -182,18 +184,7 @@ fn layoutStoreSave(_: ?*anyopaque, g: platform.geometry.Geometry) void {
 /// pane mid-transition; a zoom without a Space keeps the full strip. Fizzy's titlebar heights
 /// over the window's state (`platform.macos_monitor.titlebarState`).
 pub fn titlebarStripHeight(win: *dvui.Window) f32 {
-    if (builtin.target.os.tag != .macos) return Constants.titlebar_height;
-    const t = platform.macos_monitor.titlebarState(win);
-    const in: platform.window_layout.StripInputs = .{
-        .collapsed = t.collapsed,
-        .restoring_chrome = t.restoring_chrome,
-        .live_inset = t.live_inset,
-        .saved_inset = t.saved_inset,
-        .titlebar_height = Constants.titlebar_height,
-        .titlebar_top_buffer = Constants.titlebar_top_buffer,
-    };
-    if (platform.window.spaceFullness(win)) |f| return platform.window_layout.titlebarStripAtFullness(in, f);
-    return platform.window_layout.chooseTitlebarStrip(in);
+    return platform.macos_monitor.titlebarStrip(win.backend.impl.window, Constants.titlebar_height, Constants.titlebar_top_buffer);
 }
 
 // ---- The native menu bar: fizzy's menus (`menu_model`) on the platform's (`platform.menu`) ----
diff --git a/src/backend/layout_file.zig b/src/backend/layout_file.zig
index 162248396..3192238ae 100644
--- a/src/backend/layout_file.zig
+++ b/src/backend/layout_file.zig
@@ -89,17 +89,16 @@ const legacy_window_file = "window.zon";
 fn windowFilePath(buf: []u8, dir: []const u8, name: []const u8) ?[:0]const u8 {
     const sep = std.fs.path.sep_str;
     if (std.mem.endsWith(u8, dir, sep)) {
-        return std.fmt.bufPrintZ(buf, "{s}{s}", .{ dir, name }) catch null;
+        return std.fmt.bufPrintSentinel(buf, "{s}{s}", .{ dir, name }, 0) catch null;
     }
-    return std.fmt.bufPrintZ(buf, "{s}{s}{s}", .{ dir, sep, name }) catch null;
+    return std.fmt.bufPrintSentinel(buf, "{s}{s}{s}", .{ dir, sep, name }, 0) catch null;
 }
 
 /// Reads every field of `window.zon`, falling back to `SavedFrame`'s own defaults for whatever
 /// is missing or unparseable (never null — simplifies every caller, which only cares about the
 /// subset of fields it owns).
-/// Reads `window.zon` into `gpa`-owned memory. Free with `std.zon.parse.free(gpa, frame)` — the
-/// region list holds allocated names now, so the old return-by-value-and-forget will not do.
-pub fn loadWindowFile(gpa: std.mem.Allocator, dir: []const u8) SavedFrame {
+/// Reads `window.zon` into `arena` (the region list holds allocated names); `gpa` is scratch.
+pub fn loadWindowFile(gpa: std.mem.Allocator, arena: std.mem.Allocator, dir: []const u8) SavedFrame {
     var path_buf: [1024]u8 = undefined;
     const path = windowFilePath(&path_buf, dir, layout_file) orelse return .{};
     const data = readCapped(gpa, path) catch blk: {
@@ -109,17 +108,16 @@ pub fn loadWindowFile(gpa: std.mem.Allocator, dir: []const u8) SavedFrame {
         break :blk readCapped(gpa, legacy) catch return .{};
     };
     defer gpa.free(data);
-    const data_z = gpa.dupeZ(u8, data) catch return .{};
+    const data_z = gpa.dupeSentinel(u8, data, 0) catch return .{};
     defer gpa.free(data_z);
-    // `fromSliceAlloc`, not `fromSlice`: the region list holds allocated names, and `fromSlice`
-    // asserts at comptime that the result contains no pointers.
-    return std.zon.parse.fromSliceAlloc(
-        SavedFrame,
-        gpa,
-        data_z,
-        null,
-        .{ .ignore_unknown_fields = true },
-    ) catch .{};
+    var diag: std.zon.parse.Diagnostics = undefined;
+    return std.zon.parse.fromSlice(SavedFrame, .{
+        .gpa = gpa,
+        .arena = arena,
+        .source = data_z,
+        .diagnostics = &diag,
+        .ignore_unknown_fields = true,
+    }) catch .{};
 }
 
 pub fn writeWindowFile(dir: []const u8, f: SavedFrame) void {
@@ -140,8 +138,9 @@ pub fn writeWindowFile(dir: []const u8, f: SavedFrame) void {
 /// Read-modify-write: keeps whatever frame geometry is on disk, replaces the region list.
 pub fn saveRegions(dir: []const u8, regions: []const SavedRegion) void {
     const gpa = std.heap.page_allocator;
-    var f = loadWindowFile(gpa, dir);
-    defer std.zon.parse.free(gpa, f);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    var f = loadWindowFile(gpa, arena.allocator(), dir);
     const keep = f.regions;
     f.regions = regions;
     writeWindowFile(dir, f);
@@ -153,8 +152,9 @@ pub fn saveRegions(dir: []const u8, regions: []const SavedRegion) void {
 /// this, so an existing tree on disk is left alone.
 pub fn saveTree(dir: []const u8, tree: ?core.widgets.DockLayout.Snapshot) void {
     const gpa = std.heap.page_allocator;
-    var f = loadWindowFile(gpa, dir);
-    defer std.zon.parse.free(gpa, f);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    var f = loadWindowFile(gpa, arena.allocator(), dir);
     const keep = f.tree;
     f.tree = tree;
     writeWindowFile(dir, f);
@@ -164,8 +164,9 @@ pub fn saveTree(dir: []const u8, tree: ?core.widgets.DockLayout.Snapshot) void {
 /// The saved seed-tree, rebuilt as a live `DockLayout`, or null when the file has none.
 /// Caller owns the result (`DockLayout.deinit`).
 pub fn loadTree(gpa: std.mem.Allocator, dir: []const u8) ?core.widgets.DockLayout {
-    const f = loadWindowFile(gpa, dir);
-    defer std.zon.parse.free(gpa, f);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const f = loadWindowFile(gpa, arena.allocator(), dir);
     const snap = f.tree orelse return null;
     var dock = core.widgets.DockLayout.fromSnapshot(gpa, snap) catch return null;
     dock.animated = true;
@@ -175,8 +176,9 @@ pub fn loadTree(gpa: std.mem.Allocator, dir: []const u8) ?core.widgets.DockLayou
 /// Every region `layout.zon` remembers, in `gpa`-owned memory. Call once at startup; free with
 /// `freeRegions`.
 pub fn loadRegions(gpa: std.mem.Allocator, dir: []const u8) []SavedRegion {
-    const f = loadWindowFile(gpa, dir);
-    defer std.zon.parse.free(gpa, f);
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    const f = loadWindowFile(gpa, arena.allocator(), dir);
     const out = gpa.alloc(SavedRegion, f.regions.len) catch return &.{};
     var n: usize = 0;
     for (f.regions) |r| {
diff --git a/src/editor/Editor.zig b/src/editor/Editor.zig
index 6e1465f43..bc8b708fa 100644
--- a/src/editor/Editor.zig
+++ b/src/editor/Editor.zig
@@ -25,7 +25,7 @@ const build_opts = @import("build_opts");
 /// dvui's demo window (View › Show DVUI Demo), in Debug builds only. Calling it at all links the
 /// whole of it — every example, widgetpedia's raw images, the demos' own source for its code
 /// viewer — into a release, where no one opens it: on the web that is download size.
-pub const dvui_demo = builtin.mode == .Debug;
+pub const dvui_demo = builtin.mode == .debug;
 
 const fizzy = @import("../fizzy.zig");
 const dvui = @import("dvui");
@@ -893,8 +893,8 @@ pub fn builtinManifest(editor: *Editor, id: []const u8) ?sdk.Manifest {
     inline for (bundled_plugins) |m| {
         if (std.mem.eql(u8, m.plugin_id, id)) {
             const frame_gpa = editor.app.arena.allocator();
-            const zon = frame_gpa.dupeZ(u8, m.plugin_options.manifest_zon) catch return null;
-            return sdk.Manifest.parse(frame_gpa, zon) catch return null;
+            const zon = frame_gpa.dupeSentinel(u8, m.plugin_options.manifest_zon, 0) catch return null;
+            return sdk.Manifest.parse(frame_gpa, frame_gpa, zon) catch return null;
         }
     }
     return null;
@@ -3212,7 +3212,7 @@ pub fn drawActiveCenter(editor: *Editor) !dvui.App.Result {
             self.slot.packed_children = 0;
             self.slot.total_weight = 0;
             self.slot.min_space_taken = 0;
-            if (builtin.mode == .Debug) self.slot.child_id = .zero;
+            if (builtin.mode == .debug) self.slot.child_id = .zero;
         }
     };
 
@@ -3619,11 +3619,12 @@ pub fn reconcileExternalSettingsChange(editor: *Editor) void {
     // plugin's settings. Left unreconciled until another external change retriggers a read
     // (rare in practice: the watcher's debounce already gives a normal atomic save time to
     // settle before this runs at all).
-    const parsed = Settings.parseOnly(gpa, data) catch |err| {
+    var parsed_arena: std.heap.ArenaAllocator = .init(gpa);
+    defer parsed_arena.deinit();
+    const parsed = Settings.parseOnly(gpa, parsed_arena.allocator(), data) catch |err| {
         dvui.log.warn("settings watcher: could not parse external settings.zon change ({s}); skipping this reconciliation", .{@errorName(err)});
         return;
     };
-    defer Settings.freeParsed(gpa, parsed);
 
     // Fizzy fields, one at a time rather than `editor.app.settings = parsed` wholesale: `theme` is
     // runtime-owned (see its doc comment on `Settings`) and must not be clobbered by the raw
diff --git a/src/editor/KeptDocuments.zig b/src/editor/KeptDocuments.zig
index f53e42ccc..b9c79b086 100644
--- a/src/editor/KeptDocuments.zig
+++ b/src/editor/KeptDocuments.zig
@@ -387,7 +387,8 @@ pub fn loadSession(gpa: std.mem.Allocator, dir: []const u8) ?KeptDocuments {
     defer gpa.free(text);
     var arena: std.heap.ArenaAllocator = .init(gpa);
     defer arena.deinit();
-    const saved = std.zon.parse.fromSliceAlloc(Saved, arena.allocator(), text, null, .{ .ignore_unknown_fields = true }) catch |err| {
+    var diag: std.zon.parse.Diagnostics = undefined;
+    const saved = std.zon.parse.fromSlice(Saved, .{ .gpa = gpa, .arena = arena.allocator(), .source = text, .diagnostics = &diag, .ignore_unknown_fields = true }) catch |err| {
         dvui.log.warn("restart: the last session could not be read ({t}); documents open from disk", .{err});
         return null;
     };
diff --git a/src/editor/KeybindSettings.zig b/src/editor/KeybindSettings.zig
index 1bb1433bb..58869a337 100644
--- a/src/editor/KeybindSettings.zig
+++ b/src/editor/KeybindSettings.zig
@@ -704,7 +704,7 @@ fn directShortcut(editor: *fizzy.Editor, id: []const u8, platform: Keymap.Platfo
     // Prefer the highest-source binding (user > plugin > profile > dvui).
     var best = found[0];
     for (found[1..]) |b| {
-        if (@intFromEnum(b.source) >= @intFromEnum(best.source)) best = b;
+        if (@backingInt(b.source) >= @backingInt(best.source)) best = b;
     }
     const keys = Keymap.formatKeys(arena, best.stroke, platform) catch return null;
     return .{ .keys = keys, .stroke = best.stroke };
diff --git a/src/editor/Keybinds.zig b/src/editor/Keybinds.zig
index f8855f7c2..bf71337bc 100644
--- a/src/editor/Keybinds.zig
+++ b/src/editor/Keybinds.zig
@@ -1080,8 +1080,8 @@ fn shadowedByHigherLayer(editor: *Editor, binding: Keymap.Binding, command_id: [
         else if (binding.owner_id) |b| (if (other.owner_id) |o| std.mem.eql(u8, b, o) else false) else false;
         if (!same_owner) continue;
 
-        const mine = (@as(u16, @intFromEnum(binding.source)) << 8) | binding.when.weight();
-        const theirs = (@as(u16, @intFromEnum(other.source)) << 8) | other.when.weight();
+        const mine = (@as(u16, @backingInt(binding.source)) << 8) | binding.when.weight();
+        const theirs = (@as(u16, @backingInt(other.source)) << 8) | other.when.weight();
         if (theirs > mine) return true;
     }
     return false;
@@ -1159,7 +1159,7 @@ fn bestBinding(editor: *Editor, command: []const u8) ?Keymap.Binding {
         if (b.args.len > 0) continue;
         if (!std.mem.eql(u8, cmd, command)) continue;
         if (best) |cur| {
-            if (@intFromEnum(b.source) >= @intFromEnum(cur.source)) best = b;
+            if (@backingInt(b.source) >= @backingInt(cur.source)) best = b;
         } else best = b;
     }
     return best;
@@ -1428,7 +1428,7 @@ pub fn webKeyBound(key_len: usize, mods_bits: u32) bool {
     };
     var buf: [16]u8 = undefined;
     const key = webKey(web_key_buf[0..key_len], &buf) orelse return false;
-    const function_key = @intFromEnum(key) >= @intFromEnum(Keymap.Key.f1) and @intFromEnum(key) <= @intFromEnum(Keymap.Key.f25);
+    const function_key = @backingInt(key) >= @backingInt(Keymap.Key.f1) and @backingInt(key) <= @backingInt(Keymap.Key.f25);
     if (!mods.ctrl and !mods.command and !function_key) return false;
 
     // Recording a new binding: every such chord is data for the settings pane, not the browser's.
diff --git a/src/editor/Popout.zig b/src/editor/Popout.zig
index 5d7722d94..a8847a2a8 100644
--- a/src/editor/Popout.zig
+++ b/src/editor/Popout.zig
@@ -97,7 +97,7 @@ const Out = struct {
     serial: u64,
     viewport: *viewports.Viewport,
     /// Its part of the frame, drawn every frame for its window: `drawn` of it, from its top left —
-    /// the texture is kept larger through a fullscreen transition (`keepTarget`).
+    /// the texture is kept larger through a fullscreen transition (`viewports.keptTarget`).
     target: ?dvui.Texture.Target = null,
     drawn: [2]u32 = .{ 0, 0 },
     /// The part of the frame its picture shows this frame, once drawn (`overlaysFrame`).
@@ -196,7 +196,7 @@ pub fn beginFrame(state: *State) void {
     menus_left_behind = false;
     // Whatever happened, the screens floating things are placed on this frame: each window's,
     // besides the main window's (`dvui.screensSet`).
-    defer publishScreens();
+    defer viewports.publishScreens(null);
     // And where a held pointer is read: pinned while a float's window is being moved or resized.
     defer pinPointer(state);
     for (&outs) |*slot| {
@@ -257,7 +257,7 @@ fn popOut(f: *Floats.Float) void {
         if (o.* == null) break o;
     } else return;
     var title_buf: [96]u8 = undefined;
-    const title = std.fmt.bufPrintZ(&title_buf, "{s}", .{f.titleText()}) catch "Fizzy";
+    const title = std.fmt.bufPrintSentinel(&title_buf, "{s}", .{f.titleText()}, 0) catch "Fizzy";
     const s = dvui.windowNaturalScale();
     // Where it goes in the main window's frame, whole — not where it was last drawn: made last
     // frame, it may have been drawn as the carried glass it lands from, a drop's size.
@@ -299,19 +299,6 @@ fn pinPointer(state: *const State) void {
 
 /// Each window's part of the frame, natural, as a screen menus, tooltips and popovers opened in its
 /// float are placed on and kept within (`dvui.screensSet`, `core.screens.screenFor`).
-fn publishScreens() void {
-    var rects: [max_out]dvui.Rect.Natural = undefined;
-    var n: usize = 0;
-    const s = dvui.windowNaturalScale();
-    for (outs) |slot| {
-        const o = slot orelse continue;
-        const f = viewports.frameOf(o.viewport);
-        rects[n] = .{ .x = f.x / s, .y = f.y / s, .w = f.w / s, .h = f.h / s };
-        n += 1;
-    }
-    dvui.screensSet(rects[0..n]);
-}
-
 fn find(state: *const State, serial: u64) ?usize {
     for (state.floats.items.items, 0..) |f, i| {
         if (f.serial == serial) return i;
@@ -1136,7 +1123,8 @@ fn windowFrame(state: *State, o: *Out) void {
     }
     const w: u32 = @intFromFloat(@max(1, @round(shown.w)));
     const h: u32 = @intFromFloat(@max(1, @round(shown.h)));
-    const target = keepTarget(o, w, h) orelse return;
+    const target = viewports.keptTarget(o.viewport, &o.target, w, h) orelse return;
+    o.drawn = .{ w, h };
 
     // Transparent where the float is not: past its corners.
     const picture: viewports.Picture = .begin(target, shown);
@@ -1223,30 +1211,6 @@ fn displayNatural() dvui.Rect.Natural {
 /// same sizes shrinking, did not (the user; measured 20–59 ms frames growing, 5–9 shrinking). There
 /// it is made once at the display's size, kept while the window fits in it, and let go for one its
 /// size once the window has settled.
-fn keepTarget(o: *Out, w: u32, h: u32) ?dvui.Texture.Target {
-    const moving = viewports.spaceFullness(o.viewport) != null;
-    if (o.target) |t| {
-        const fits = t.width >= w and t.height >= h;
-        const exact = t.width == w and t.height == h;
-        if (!fits or (!moving and !exact)) {
-            t.destroyLater();
-            o.target = null;
-        }
-    }
-    if (o.target == null) {
-        var tw = w;
-        var th = h;
-        if (moving) {
-            const d = viewports.displayInMain();
-            tw = @max(w, @as(u32, @intFromFloat(@max(0, @round(d.w)))));
-            th = @max(h, @as(u32, @intFromFloat(@max(0, @round(d.h)))));
-        }
-        o.target = dvui.textureCreateTarget(.{ .width = tw, .height = th, .interpolation = .nearest }) catch return null;
-    }
-    o.drawn = .{ w, h };
-    return o.target.?;
-}
-
 /// The least window opacity a menu's glass takes: a menu carries text, and over a clear window
 /// there was too little behind it to read it by.
 const menu_opacity_floor: f32 = 0.6;
diff --git a/src/editor/caption_buttons.zig b/src/editor/caption_buttons.zig
index 1f2e1caa7..e347f2e24 100644
--- a/src/editor/caption_buttons.zig
+++ b/src/editor/caption_buttons.zig
@@ -54,7 +54,7 @@ fn drawWindows(frame: dvui.Rect, corner_radius: ?f32) void {
         var b = dvui.box(@src(), .{ .dir = .horizontal }, .{
             .role = .button,
             .label = .{ .text = nameOf(button, maximized) },
-            .id_extra = @intFromEnum(button),
+            .id_extra = @backingInt(button),
             .min_size_content = .{ .w = cell_w, .h = cell_h },
             .expand = .vertical,
             .background = hover,
@@ -94,7 +94,7 @@ fn drawGnome(frame: dvui.Rect) void {
         var b = dvui.box(@src(), .{ .dir = .horizontal }, .{
             .role = .button,
             .label = .{ .text = nameOf(button, maximized) },
-            .id_extra = @intFromEnum(button),
+            .id_extra = @backingInt(button),
             .min_size_content = .{ .w = d, .h = d },
             .margin = .{ .x = if (i == 0) 0 else gap },
         });
diff --git a/src/editor/dialogs/WebSaveAs.zig b/src/editor/dialogs/WebSaveAs.zig
index 962d1e89c..6b9e14ad4 100644
--- a/src/editor/dialogs/WebSaveAs.zig
+++ b/src/editor/dialogs/WebSaveAs.zig
@@ -185,10 +185,10 @@ fn exportFileName(gpa: std.mem.Allocator, name: []const u8, patterns: []const u8
     var first: []const u8 = "";
     var it = std.mem.tokenizeScalar(u8, patterns, ';');
     while (it.next()) |pattern| {
-        if (std.mem.eql(u8, pattern, "*")) return gpa.dupeZ(u8, name);
-        if (typed.len > 0 and std.ascii.eqlIgnoreCase(pattern, typed)) return gpa.dupeZ(u8, name);
+        if (std.mem.eql(u8, pattern, "*")) return gpa.dupeSentinel(u8, name, 0);
+        if (typed.len > 0 and std.ascii.eqlIgnoreCase(pattern, typed)) return gpa.dupeSentinel(u8, name, 0);
         if (first.len == 0) first = pattern;
     }
-    if (first.len == 0) return gpa.dupeZ(u8, name);
+    if (first.len == 0) return gpa.dupeSentinel(u8, name, 0);
     return std.fmt.allocPrintSentinel(gpa, "{s}.{s}", .{ name, first }, 0);
 }
diff --git a/src/editor/menu_model.zig b/src/editor/menu_model.zig
index 0f9bec040..e4de3c69d 100644
--- a/src/editor/menu_model.zig
+++ b/src/editor/menu_model.zig
@@ -132,7 +132,7 @@ fn historyTitle(editor: *Editor, action: Editor.HistoryAction, plain: [:0]const
     if (!editor.app.host.step_authors.contains(doc.id)) return plain;
     const t = editor.stepToTake(doc, action, editor.app.host.arena()) catch return plain;
     if (t.by.kind == .person) return plain;
-    return std.fmt.bufPrintZ(buf, "{s} {s}'s {s}", .{ plain, Editor.authorName(t.by), t.step.title }) catch plain;
+    return std.fmt.bufPrintSentinel(buf, "{s} {s}'s {s}", .{ plain, Editor.authorName(t.by), t.step.title }, 0) catch plain;
 }
 
 fn canUndo(editor: *Editor) bool {
diff --git a/src/editor/verdict.zig b/src/editor/verdict.zig
index 97a8796e4..b1b697574 100644
--- a/src/editor/verdict.zig
+++ b/src/editor/verdict.zig
@@ -126,7 +126,7 @@ var path: []const u8 = "";
 var expect: Expect = .{};
 var start_ns: i128 = 0;
 var waited_frames: u32 = 0;
-var failures: [@typeInfo(Failure).@"enum".fields.len]Failure = undefined;
+var failures: [@typeInfo(Failure).@"enum".field_names.len]Failure = undefined;
 var failure_count: usize = 0;
 var ended_buf: [64]u8 = undefined;
 var tape_buf: [128]u8 = undefined;
@@ -188,9 +188,12 @@ pub fn init(gpa: std.mem.Allocator, process_io: std.Io, profile: ?[]const u8) ?u
 fn readExpect(gpa: std.mem.Allocator, file: []const u8) !Expect {
     const bytes = try std.Io.Dir.cwd().readFileAlloc(io, file, gpa, .limited(1 << 16));
     defer gpa.free(bytes);
-    const source = try gpa.dupeZ(u8, bytes);
+    const source = try gpa.dupeSentinel(u8, bytes, 0);
     defer gpa.free(source);
-    return std.zon.parse.fromSlice(Expect, gpa, source, null, .{});
+    var arena: std.heap.ArenaAllocator = .init(gpa);
+    defer arena.deinit();
+    var diag: std.zon.parse.Diagnostics = undefined;
+    return std.zon.parse.fromSliceNoAlloc(Expect, .{ .gpa = gpa, .arena = arena.allocator(), .source = source, .diagnostics = &diag });
 }
 
 /// Once a displayed frame, after the app's: watch the tape start and end. True: the tape has
diff --git a/tests/bench/bench_tape.zig b/tests/bench/bench_tape.zig
index af897eef1..7248e07cc 100644
--- a/tests/bench/bench_tape.zig
+++ b/tests/bench/bench_tape.zig
@@ -167,7 +167,7 @@ test "bench tape: ZON against the binary form" {
         var zon: std.Io.Writer.Allocating = .init(std.testing.allocator);
         defer zon.deinit();
         const zon_write = try best(zonWrite, .{ t, &zon });
-        const source = try std.testing.allocator.dupeZ(u8, zon.written());
+        const source = try std.testing.allocator.dupeSentinel(u8, zon.written(), 0);
         defer std.testing.allocator.free(source);
         const zon_read = try best(zonRead, .{source});
 
diff --git a/tests/integration.zig b/tests/integration.zig
index 449598285..5e3ec7e5b 100644
--- a/tests/integration.zig
+++ b/tests/integration.zig
@@ -689,8 +689,8 @@ fn markdownSettle() !void {
     // always the same shape: which blocks are still owed a measure, and in what state. Printing
     // the tally is what turned "the layout never settles" into "164 of 185 blocks were never
     // measured once, because the resettle budget was gated on being near the viewport".
-    var counts = [_]usize{0} ** 4;
-    for (md_preview.rs.blocks.heights.items) |e| counts[@intFromEnum(e.state)] += 1;
+    var counts = @as([4]usize, @splat(0));
+    for (md_preview.rs.blocks.heights.items) |e| counts[@backingInt(e.state)] += 1;
     std.debug.print(
         "\nnever settled: blocks={d} estimated={d} measured={d} settled={d} deferred={d} pending_measure={d}\n",
         .{ md_preview.rs.blocks.heights.items.len, counts[0], counts[1], counts[2], counts[3], md_render_ast.stats.pending_measure },
@@ -1620,8 +1620,8 @@ test "markdown preview: stops asking for frames so the app can sleep" {
 
         try markdownAwaitParse();
         if (!try markdownReachesIdle()) {
-            var counts = [_]usize{0} ** 4;
-            for (md_preview.rs.blocks.heights.items) |e| counts[@intFromEnum(e.state)] += 1;
+            var counts = @as([4]usize, @splat(0));
+            for (md_preview.rs.blocks.heights.items) |e| counts[@backingInt(e.state)] += 1;
             std.debug.print(
                 "\nnever idle: estimated={d} measured={d} settled={d} deferred={d} pending_measure={d}\n",
                 .{ counts[0], counts[1], counts[2], counts[3], md_render_ast.stats.pending_measure },
@@ -4148,7 +4148,7 @@ test "a place closing for good is not still holding its padding and its sash" {
 
 const DropFinishFrame = struct {
     var editor: ?*fizzy.Editor = null;
-    const key: dvui.Id = @enumFromInt(0xd7_0b_f1_4e);
+    const key: dvui.Id = @fromBackingInt(@intCast(0xd7_0b_f1_4e));
 
     fn frame() anyerror!dvui.App.Result {
         const e = editor.?;
@@ -4705,7 +4705,7 @@ test "drop: a place with room for the wheel keeps it" {
 
 const ShapeFrame = struct {
     var wheel: DZ.Wheel = undefined;
-    const key: dvui.Id = @enumFromInt(0x5a_a9_e0_01);
+    const key: dvui.Id = @fromBackingInt(@intCast(0x5a_a9_e0_01));
 
     fn frame() anyerror!dvui.App.Result {
         _ = DZ.draw(key, wheel, 1, .{});
@@ -5548,7 +5548,10 @@ test "verdict: the soak tape is a demo, and its expectations read" {
     // It ends on a wait, so what closed last has time to close before the windows are counted.
     try std.testing.expect(owned.tape.ops[owned.tape.ops.len - 1].do == .wait);
 
-    const expect = try std.zon.parse.fromSlice(fizzy.verdict.Expect, std.testing.allocator, @embedFile("soak_expect"), null, .{});
+    var expect_arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
+    defer expect_arena.deinit();
+    var expect_diag: std.zon.parse.Diagnostics = undefined;
+    const expect = try std.zon.parse.fromSliceNoAlloc(fizzy.verdict.Expect, .{ .gpa = std.testing.allocator, .arena = expect_arena.allocator(), .source = @embedFile("soak_expect"), .diagnostics = &expect_diag });
     try std.testing.expect(!expect.allow_leaks);
     try std.testing.expectEqual(@as(u32, 0), expect.max_sdl_errors);
     try std.testing.expectEqual(@as(?u32, null), expect.os_windows);
@@ -5564,7 +5567,7 @@ test "demo: the hand-written sample tape parses and round-trips" {
     var out: std.Io.Writer.Allocating = .init(std.testing.allocator);
     defer out.deinit();
     try owned.tape.write(&out.writer);
-    const again = try std.testing.allocator.dupeZ(u8, out.written());
+    const again = try std.testing.allocator.dupeSentinel(u8, out.written(), 0);
     defer std.testing.allocator.free(again);
     var back = try automation.Tape.parse(std.testing.allocator, again, automation.Input.check);
     defer back.deinit();
@@ -5716,10 +5719,12 @@ test "float: the saved layout brings it back, and Reset Layout takes it away" {
     defer out.deinit();
     try std.zon.stringify.serializeMaxDepth(regions, .{}, &out.writer, 64);
     gpa.free(regions);
-    const text = try gpa.dupeZ(u8, out.written());
+    const text = try gpa.dupeSentinel(u8, out.written(), 0);
     defer gpa.free(text);
-    const saved = try std.zon.parse.fromSliceAlloc([]fizzy.backend.SavedRegion, gpa, text, null, .{ .ignore_unknown_fields = true });
-    defer std.zon.parse.free(gpa, saved);
+    var saved_arena: std.heap.ArenaAllocator = .init(gpa);
+    defer saved_arena.deinit();
+    var saved_diag: std.zon.parse.Diagnostics = undefined;
+    const saved = try std.zon.parse.fromSlice([]fizzy.backend.SavedRegion, .{ .gpa = gpa, .arena = saved_arena.allocator(), .source = text, .diagnostics = &saved_diag, .ignore_unknown_fields = true });
 
     editor.app.layout.resetLayout(gpa);
     try dvui.testing.settle(ManyPanelFrame.frame);
@@ -5769,7 +5774,7 @@ test "float: a drag aims at a float's place over it, at nothing over its header,
         .rect = .{ .x = 100, .y = 50, .w = 150, .h = 130 },
         .home = "Panel",
         .fresh = false,
-        .win_id = @enumFromInt(0xf10a7),
+        .win_id = @fromBackingInt(@intCast(0xf10a7)),
         .bounds = window,
         .header = header,
     });
@@ -5823,7 +5828,7 @@ const FloatOverMain = struct {
             .rect = .{ .x = 100, .y = 50, .w = 150, .h = 130 },
             .home = "Panel",
             .fresh = false,
-            .win_id = @enumFromInt(0xf10a7),
+            .win_id = @fromBackingInt(@intCast(0xf10a7)),
             .bounds = win,
             .header = head,
         });
@@ -6985,7 +6990,7 @@ const ControlOneShot = struct {
             if (std.mem.endsWith(u8, self.reply[0..self.len], "\r\n\r\n")) break;
         }
         const key = "content-length: ";
-        const i = std.ascii.indexOfIgnoreCase(self.reply[0..self.len], key) orelse return;
+        const i = std.ascii.findIgnoreCase(self.reply[0..self.len], key) orelse return;
         const end = std.mem.indexOfPos(u8, self.reply[0..self.len], i, "\r\n") orelse return;
         const want = std.fmt.parseInt(usize, self.reply[i + key.len .. end], 10) catch return;
         r.interface.readSliceAll(self.reply[self.len..][0..want]) catch return;
@@ -7470,17 +7475,21 @@ const HeardEvents = struct {
     fn handler(state: *anyopaque, e: sdk.events.Event) void {
         const self: *HeardEvents = @ptrCast(@alignCast(state));
         const gpa = std.heap.smp_allocator;
-        const src = gpa.dupeZ(u8, e.payload) catch return;
+        const src = gpa.dupeSentinel(u8, e.payload, 0) catch return;
         defer gpa.free(src);
         // A batch of disk changes is heard by its first path, everything else by its `.path`.
         const path = if (std.mem.eql(u8, e.name, "fizzy.files.changed")) files: {
-            const changed = std.zon.parse.fromSliceAlloc(sdk.events.FilesChanged, gpa, src, null, .{ .ignore_unknown_fields = true }) catch return;
-            defer std.zon.parse.free(gpa, changed);
+            var changed_arena: std.heap.ArenaAllocator = .init(gpa);
+            defer changed_arena.deinit();
+            var changed_diag: std.zon.parse.Diagnostics = undefined;
+            const changed = std.zon.parse.fromSlice(sdk.events.FilesChanged, .{ .gpa = gpa, .arena = changed_arena.allocator(), .source = src, .diagnostics = &changed_diag, .ignore_unknown_fields = true }) catch return;
             if (changed.events.len == 0) return;
             break :files gpa.dupe(u8, changed.events[0].path) catch return;
         } else plain: {
-            const payload = std.zon.parse.fromSliceAlloc(sdk.events.Path, gpa, src, null, .{ .ignore_unknown_fields = true }) catch return;
-            defer std.zon.parse.free(gpa, payload);
+            var payload_arena: std.heap.ArenaAllocator = .init(gpa);
+            defer payload_arena.deinit();
+            var payload_diag: std.zon.parse.Diagnostics = undefined;
+            const payload = std.zon.parse.fromSlice(sdk.events.Path, .{ .gpa = gpa, .arena = payload_arena.allocator(), .source = src, .diagnostics = &payload_diag, .ignore_unknown_fields = true }) catch return;
             break :plain gpa.dupe(u8, payload.path) catch return;
         };
         self.events.append(gpa, .{ .name = gpa.dupe(u8, e.name) catch return, .path = path }) catch gpa.free(path);
@@ -7789,7 +7798,8 @@ test "headless: the whole editor comes up, opens a file, plays the tour and goes
                     .ok => |r| r orelse return error.TestUnexpectedResult,
                     else => return error.TestUnexpectedResult,
                 };
-                return std.zon.parse.fromSliceAlloc(Read, h.arena(), try h.arena().dupeZ(u8, zon), null, .{ .ignore_unknown_fields = true });
+                var diag: std.zon.parse.Diagnostics = undefined;
+                return std.zon.parse.fromSlice(Read, .{ .gpa = h.arena(), .arena = h.arena(), .source = try h.arena().dupeSentinel(u8, zon, 0), .diagnostics = &diag, .ignore_unknown_fields = true });
             }
         }.read;
 
@@ -7827,7 +7837,8 @@ test "headless: the whole editor comes up, opens a file, plays the tour and goes
             try std.testing.expectEqualStrings(notes, front.owner.documentPath(front));
             const Caret = struct { caret: struct { line: u32, column: u32 } };
             const out = host.callCommand("text.read", notes_args, host.arena()).ok.?;
-            const at = try std.zon.parse.fromSliceAlloc(Caret, host.arena(), try host.arena().dupeZ(u8, out), null, .{ .ignore_unknown_fields = true });
+            var at_diag: std.zon.parse.Diagnostics = undefined;
+            const at = try std.zon.parse.fromSlice(Caret, .{ .gpa = host.arena(), .arena = host.arena(), .source = try host.arena().dupeSentinel(u8, out, 0), .diagnostics = &at_diag, .ignore_unknown_fields = true });
             try std.testing.expectEqual(@as(u32, 3), at.caret.line);
             try std.testing.expectEqual(@as(u32, 4), at.caret.column);
         }
@@ -8747,7 +8758,8 @@ test "headless: the whole editor comes up, opens a file, plays the tour and goes
             // has passed on screen, which a few test frames are not.
             profile: struct { frame: struct { fps: f64 } },
         };
-        const stats = try std.zon.parse.fromSliceAlloc(Stats, host.arena(), try host.arena().dupeZ(u8, zon), null, .{ .ignore_unknown_fields = true });
+        var stats_diag: std.zon.parse.Diagnostics = undefined;
+        const stats = try std.zon.parse.fromSlice(Stats, .{ .gpa = host.arena(), .arena = host.arena(), .source = try host.arena().dupeSentinel(u8, zon, 0), .diagnostics = &stats_diag, .ignore_unknown_fields = true });
         try std.testing.expect(for (stats.plugins) |pl| {
             if (std.mem.eql(u8, pl.id, "devtools")) break pl.link == .bundled;
         } else false);
@@ -8767,7 +8779,8 @@ test "headless: the whole editor comes up, opens a file, plays the tour and goes
             else => return error.TestUnexpectedResult,
         };
         const Written = struct { path: []const u8, frames: u64 };
-        const written = try std.zon.parse.fromSliceAlloc(Written, host.arena(), try host.arena().dupeZ(u8, zon), null, .{ .ignore_unknown_fields = true });
+        var written_diag: std.zon.parse.Diagnostics = undefined;
+        const written = try std.zon.parse.fromSlice(Written, .{ .gpa = host.arena(), .arena = host.arena(), .source = try host.arena().dupeSentinel(u8, zon, 0), .diagnostics = &written_diag, .ignore_unknown_fields = true });
         try std.testing.expect(written.frames > 0);
         const input_path = try std.fs.path.join(host.arena(), &.{ written.path, "input.bin" });
         const bytes = try std.Io.Dir.cwd().readFileAlloc(dvui.io, input_path, host.arena(), .unlimited);
@@ -9083,7 +9096,7 @@ test "headless: the whole editor comes up, opens a file, plays the tour and goes
     // A quit straight after a pane slid shut (`snapshotClosingPane`): the pane still holds its
     // picture, and the quit comes after the last frame, when nothing can be freed at a frame's end.
     {
-        const pixels = [_]u8{0} ** (4 * 4 * 4);
+        const pixels: [4 * 4 * 4]u8 = @splat(0);
         const snap = try t.window.backend.textureCreate(&pixels, .{ .width = 4, .height = 4 });
         editor.workbench.workspaces.values()[0].closing_snapshot = snap;
     }
@@ -9270,7 +9283,7 @@ test "automation service: refused while something drives the app, or for a demo'
     // A demo's tape opens on a keyframe; garbage is no tape at all. Both say why.
     try std.testing.expectEqualStrings("KeyframeInLiveTape", api.play(demo).invalid);
     try std.testing.expect(api.play("not a tape") == .invalid);
-    try std.testing.expect(api.outcome(@enumFromInt(12345)) == .unknown);
+    try std.testing.expect(api.outcome(@fromBackingInt(@intCast(12345))) == .unknown);
 
     // A demo loaded: refused, and nothing is settled while it plays.
     service_demo_loaded = true;
@@ -9281,7 +9294,7 @@ test "automation service: refused while something drives the app, or for a demo'
     // One tape at a time, and only its own ticket stops it.
     const ticket = try started(api.play(live));
     try std.testing.expect(api.play(live) == .busy);
-    api.stop(@enumFromInt(@intFromEnum(ticket) + 1));
+    api.stop(@fromBackingInt(@intCast(@backingInt(ticket) + 1)));
     try std.testing.expect(api.outcome(ticket) == .playing);
     api.stop(ticket);
     try std.testing.expect(api.outcome(ticket) == .stopped);
@@ -9350,7 +9363,11 @@ test "the output panel settles at its tail with a line wider than it anywhere in
     defer t.deinit();
     defer fizzy.OutputLog.clear();
 
-    const wide = "a line far wider than the panel " ** 12;
+    const wide = comptime blk: {
+        var s: []const u8 = "";
+        for (0..12) |_| s = s ++ "a line far wider than the panel ";
+        break :blk s;
+    };
     const rows = 40;
     // The wide line at each of the last rows in turn, wherever the top of the view falls.
     for (0..20) |from_tail| {
diff --git a/update.zig b/update.zig
deleted file mode 100644
index 131c635d1..000000000
--- a/update.zig
+++ /dev/null
@@ -1,71 +0,0 @@
-const std = @import("std");
-const Allocator = std.mem.Allocator;
-const Io = std.Io;
-
-// url must be something like: https://github.com/nat3Github/zig-lib-dvui-dev-fork
-//  branch must be something like main or dev
-pub fn get_hash(alloc: Allocator, io: Io, url: []const u8, branch: []const u8) ![]const u8 {
-    const get_commit = &.{ "git", "ls-remote", url };
-    const dat = try exec(alloc, io, get_commit);
-    var tokenizer = std.mem.tokenizeAny(u8, dat, "\r\n");
-    var hash: []const u8 = "";
-    const refs_heads = "refs/heads/";
-    var arlist: std.ArrayList([]const u8) = .empty;
-    defer arlist.deinit(alloc);
-    while (tokenizer.next()) |token| {
-        hash = token[0..40];
-        var ref = std.mem.trim(u8, token[40..], " \t");
-        if (std.ascii.startsWithIgnoreCase(ref, refs_heads)) ref = ref[refs_heads.len..];
-        if (std.mem.eql(u8, branch, ref)) return alloc.dupe(u8, hash);
-        try arlist.append(alloc, ref);
-    }
-    const branches = arlist.items;
-    std.log.err("url: {s} BRANCH: '{s}' NOT FOUND", .{ url, branch });
-    std.log.info("there are {} other branches:", .{branches.len});
-    for (branches[0..@min(10, branches.len)]) |s| {
-        std.log.info("{s}", .{s});
-    }
-    return error.BranchNotFound;
-}
-
-pub fn get_zig_fetch_repo_string(alloc: Allocator, io: Io, url: []const u8, branch: []const u8) ![]const u8 {
-    const hash = try get_hash(alloc, io, url, branch);
-    const repo = try std.fmt.allocPrint(alloc, "git+{s}#{s}", .{ url, hash });
-    return repo;
-}
-
-pub const GitDependency = struct {
-    url: []const u8,
-    branch: []const u8,
-};
-
-pub fn update_dependency(alloc: Allocator, io: Io, deps: []const GitDependency) !void {
-    for (deps) |dep| {
-        const rep = try get_zig_fetch_repo_string(alloc, io, dep.url, dep.branch);
-        std.log.info("running zig fetch --save {s}", .{rep});
-        _ = try exec(alloc, io, &.{
-            "zig",
-            "fetch",
-            "--save",
-            rep,
-        });
-    }
-    std.log.info("ok", .{});
-}
-
-pub fn exec(alloc: Allocator, io: Io, args: []const []const u8) ![]const u8 {
-    const result = try std.process.run(alloc, io, .{ .argv = args });
-    defer alloc.free(result.stderr);
-    errdefer alloc.free(result.stdout);
-    switch (result.term) {
-        .exited => |code| if (code != 0) {
-            std.log.err("{s}\n", .{result.stderr});
-            return error.Failed;
-        },
-        else => {
-            std.log.err("{s}\n", .{result.stderr});
-            return error.Failed;
-        },
-    }
-    return result.stdout;
-}