diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 20ba888f4..45877e78a 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -32,6 +32,7 @@ jobs:
       fmt: ${{ steps.filter.outputs.fmt }}
       fmt-comments: ${{ steps.filter.outputs.fmt-comments }}
       fmt-markdown: ${{ steps.filter.outputs.fmt-markdown }}
+      typecheck-js: ${{ steps.filter.outputs.typecheck-js }}
       test: ${{ steps.filter.outputs.test }}
       docs: ${{ steps.filter.outputs.docs }}
       coverage: ${{ steps.filter.outputs.coverage }}
@@ -76,6 +77,7 @@ jobs:
           cargo='(^|/)Cargo\.toml$|^Cargo\.lock$|^rust-toolchain\.toml$'
           rust='\.rs$'
           markdown='\.md$|\.markdown$'
+          javascript='\.js$|(^|/)tsconfig\.json$'
           snapshots='\.snap$|^\.config/insta\.yaml$'
           source="$rust|$cargo|$workflow|$justfile"
 
@@ -83,6 +85,7 @@ jobs:
           set_task fmt "$rust|^\.rustfmt\.toml$|$workflow|$justfile"
           set_task fmt-comments "$rust|$workflow|$justfile"
           set_task fmt-markdown "$markdown|$workflow|$justfile"
+          set_task typecheck-js "$javascript|$workflow|$justfile"
           set_task test "$source|$snapshots"
           set_task docs "$source"
           set_task coverage "$source|$snapshots"
@@ -96,7 +99,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        task: [lint, fmt, fmt-comments, fmt-markdown, test, docs, coverage, deny, insta, shear, vet]
+        task: [lint, fmt, fmt-comments, fmt-markdown, typecheck-js, test, docs, coverage, deny, insta, shear, vet]
         include:
           - task: test
             os: windows-latest
@@ -125,6 +128,7 @@ jobs:
           FMT: ${{ needs.changes.outputs.fmt }}
           FMT_COMMENTS: ${{ needs.changes.outputs.fmt-comments }}
           FMT_MARKDOWN: ${{ needs.changes.outputs.fmt-markdown }}
+          TYPECHECK_JS: ${{ needs.changes.outputs.typecheck-js }}
           TEST: ${{ needs.changes.outputs.test }}
           DOCS: ${{ needs.changes.outputs.docs }}
           COVERAGE: ${{ needs.changes.outputs.coverage }}
@@ -140,6 +144,7 @@ jobs:
             fmt) run="$FMT" ;;
             fmt-comments) run="$FMT_COMMENTS" ;;
             fmt-markdown) run="$FMT_MARKDOWN" ;;
+            typecheck-js) run="$TYPECHECK_JS" ;;
             test) run="$TEST" ;;
             docs) run="$DOCS" ;;
             coverage) run="$COVERAGE" ;;
@@ -197,6 +202,8 @@ jobs:
         if: ${{ steps.task.outputs.run == 'true' && matrix.task == 'test' }}
         shell: bash
         run: cargo metadata --locked --format-version 1 > /dev/null
+      - if: ${{ steps.task.outputs.run == 'true' && matrix.task == 'typecheck-js' }}
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       - if: ${{ steps.task.outputs.run == 'true' }}
         run: just ${{ matrix.task }}-ci ${{ matrix.scope }}
       - if: ${{ matrix.task == 'coverage' && steps.task.outputs.run == 'true' }}
diff --git a/Cargo.lock b/Cargo.lock
index cb88f3395..95a73a8d3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -56,6 +56,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -270,6 +276,7 @@ checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core",
  "bytes",
+ "form_urlencoded",
  "futures-util",
  "http",
  "http-body",
@@ -283,6 +290,9 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
  "sync_wrapper",
  "tokio",
  "tower",
@@ -370,11 +380,11 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.9.4"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -443,6 +453,12 @@ version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
+[[package]]
+name = "bytecount"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -519,6 +535,15 @@ dependencies = [
  "unicode-normalization",
 ]
 
+[[package]]
+name = "castaway"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "cc"
 version = "1.2.56"
@@ -657,6 +682,19 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "compact_str"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79fcda08c33bb58b97008b2cdada6622500e949e060f5913361763121abd2416"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "static_assertions",
+ "zmij",
+]
+
 [[package]]
 name = "comrak"
 version = "0.52.0"
@@ -667,7 +705,7 @@ dependencies = [
  "entities",
  "finl_unicode",
  "jetscii",
- "phf",
+ "phf 0.13.1",
  "phf_codegen",
  "rustc-hash 2.1.1",
  "smallvec",
@@ -748,6 +786,12 @@ version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
 
+[[package]]
+name = "cow-utils"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417bef24afe1460300965a25ff4a24b8b45ad011948302ec221e8a0a81eb2c79"
+
 [[package]]
 name = "cpp_demangle"
 version = "0.5.1"
@@ -815,7 +859,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "crossterm_winapi",
  "derive_more",
  "document-features",
@@ -856,7 +900,7 @@ dependencies = [
  "cssparser-macros",
  "dtoa-short",
  "itoa",
- "phf",
+ "phf 0.13.1",
  "smallvec",
 ]
 
@@ -1079,6 +1123,12 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
+[[package]]
+name = "dragonbox_ecma"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd8e701084c37e7ef62d3f9e453b618130cbc0ef3573847785952a3ac3f746bf"
+
 [[package]]
 name = "dtoa"
 version = "1.0.11"
@@ -1621,6 +1671,7 @@ version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
+ "allocator-api2",
  "foldhash",
 ]
 
@@ -1647,7 +1698,7 @@ checksum = "de550515ae03ff01fb033658945ba393c8db391297978a1f988ecb436e072f87"
 dependencies = [
  "html5ever",
  "markup5ever_rcdom",
- "phf",
+ "phf 0.13.1",
 ]
 
 [[package]]
@@ -1998,7 +2049,7 @@ name = "inquire"
 version = "0.9.1"
 source = "git+https://github.com/JeanMertz/inquire?branch=merged#93ecb2750bc244b2af69b4294d6809957ec7adf0"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "crossterm",
  "dyn-clone",
  "unicode-segmentation",
@@ -2032,7 +2083,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "046fa2d4d00aea763528b4950358d0ead425372445dc8ff86312b3c69ff7727b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "cfg-if",
  "libc",
 ]
@@ -2068,11 +2119,20 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jetscii"
@@ -2104,9 +2164,15 @@ dependencies = [
  "axum",
  "chrono",
  "comrak",
+ "form_urlencoded",
  "jp_plugin",
  "maud",
+ "oxc_allocator",
+ "oxc_parser",
+ "oxc_semantic",
+ "oxc_span",
  "pretty_assertions",
+ "serde",
  "serde_json",
  "sha2",
  "tokio",
@@ -2793,7 +2859,7 @@ version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "libc",
 ]
 
@@ -2974,9 +3040,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "memmap2"
@@ -3051,7 +3117,7 @@ version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases 0.1.1",
  "libc",
@@ -3063,7 +3129,7 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases 0.2.1",
  "libc",
@@ -3079,6 +3145,12 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "nonmax"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "610a5acd306ec67f907abe5567859a3c693fb9886eb1f012ab8f2a47bef3db51"
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.1"
@@ -3088,6 +3160,25 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "num-bigint"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -3194,6 +3285,231 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "owo-colors"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
+
+[[package]]
+name = "oxc_allocator"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "064fce871c5cb07e557049ed27c8ca2aa530db797f73424c67e4bb8cfe61175e"
+dependencies = [
+ "allocator-api2",
+ "hashbrown 0.17.1",
+ "oxc_data_structures",
+ "rustc-hash 2.1.1",
+]
+
+[[package]]
+name = "oxc_ast"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a999fd4494b604fc0328fc43443bc1298722500587d87d7e993118bd82c65d7b"
+dependencies = [
+ "bitflags 2.13.1",
+ "oxc_allocator",
+ "oxc_ast_macros",
+ "oxc_data_structures",
+ "oxc_diagnostics",
+ "oxc_estree",
+ "oxc_regular_expression",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+]
+
+[[package]]
+name = "oxc_ast_macros"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d715e3c300c95b1d797b05526567161fd86fcac2ac68235101c61b736f216cde"
+dependencies = [
+ "phf 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "oxc_ast_visit"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81b9d77b5c27575ef7d624de1f226caeca3c0d3fcc2347bdaa788d5c4a85512d"
+dependencies = [
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_span",
+ "oxc_syntax",
+]
+
+[[package]]
+name = "oxc_data_structures"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d15a23b57a931fda6bc9a4fdc3fbabcac6a2edfd0b7216cb7c81432f0e9f54d9"
+
+[[package]]
+name = "oxc_diagnostics"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2d0ce1ec51b07b6501eecedd5ab50835b7ebe5c8463cada3b2e6d984d0943af"
+dependencies = [
+ "bytecount",
+ "cow-utils",
+ "itoa",
+ "memchr",
+ "owo-colors",
+ "oxc_span",
+ "percent-encoding",
+ "smallvec",
+ "textwrap",
+ "unicode-segmentation",
+ "unicode-width",
+]
+
+[[package]]
+name = "oxc_ecmascript"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b5d3d07165b7aadcd021f62cd95fb7d62cb6977b8bbfb42fa12adbfb7e75257"
+dependencies = [
+ "dragonbox_ecma",
+ "itoa",
+ "num-bigint",
+ "num-traits",
+ "oxc_ast",
+ "oxc_data_structures",
+ "oxc_span",
+ "oxc_syntax",
+]
+
+[[package]]
+name = "oxc_estree"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7af86a59b7aeb2845ffea2cc21ae259053865b175e9ac936a7d72f2744abe5"
+
+[[package]]
+name = "oxc_index"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "191884bee6c3744909a51acc7d78d4ae370d817b25875b10642f632327b6296e"
+dependencies = [
+ "nonmax",
+ "serde",
+]
+
+[[package]]
+name = "oxc_parser"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "311c29dfdf55ea8bf065cf300b3d0dca5fe1c0fb8059c9ba70a6c98cce75306e"
+dependencies = [
+ "bitflags 2.13.1",
+ "cow-utils",
+ "memchr",
+ "num-bigint",
+ "num-traits",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_data_structures",
+ "oxc_diagnostics",
+ "oxc_ecmascript",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+ "rustc-hash 2.1.1",
+ "seq-macro",
+]
+
+[[package]]
+name = "oxc_regular_expression"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31839a373ad02a37fad54244a3eb710f9a94b5e2e16ca0e1d28a37b4c75b8ebc"
+dependencies = [
+ "bitflags 2.13.1",
+ "oxc_allocator",
+ "oxc_ast_macros",
+ "oxc_diagnostics",
+ "oxc_span",
+ "oxc_str",
+ "phf 0.14.0",
+ "rustc-hash 2.1.1",
+ "unicode-id-start",
+]
+
+[[package]]
+name = "oxc_semantic"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "366191309f606847936aade62707b06683ed5e0b0c8cb66c27710a61f64a50f1"
+dependencies = [
+ "itertools 0.15.0",
+ "memchr",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_ast_visit",
+ "oxc_data_structures",
+ "oxc_diagnostics",
+ "oxc_ecmascript",
+ "oxc_index",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+ "rustc-hash 2.1.1",
+ "self_cell",
+ "smallvec",
+]
+
+[[package]]
+name = "oxc_span"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c355ae1fa3e865c28cb8a85735ecafd1bb6340a5b880c638d127c1f2d61a98a5"
+dependencies = [
+ "compact_str",
+ "oxc_allocator",
+ "oxc_ast_macros",
+ "oxc_estree",
+ "oxc_str",
+]
+
+[[package]]
+name = "oxc_str"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ba45ef9efa8296e647aa37b2b21936cb520953031edc1ef6352281bbea22faa"
+dependencies = [
+ "compact_str",
+ "hashbrown 0.17.1",
+ "oxc_allocator",
+ "oxc_estree",
+]
+
+[[package]]
+name = "oxc_syntax"
+version = "0.146.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0970d9be099a082711b574d58add258549580a70fe6546b99a067bbd7ad4a264"
+dependencies = [
+ "bitflags 2.13.1",
+ "cow-utils",
+ "dragonbox_ecma",
+ "nonmax",
+ "oxc_allocator",
+ "oxc_ast_macros",
+ "oxc_estree",
+ "oxc_index",
+ "oxc_span",
+ "oxc_str",
+ "phf 0.14.0",
+ "unicode-id-start",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -3300,8 +3616,19 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
- "phf_macros",
- "phf_shared",
+ "phf_macros 0.13.1",
+ "phf_shared 0.13.1",
+ "serde",
+]
+
+[[package]]
+name = "phf"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
+dependencies = [
+ "phf_macros 0.14.0",
+ "phf_shared 0.14.0",
  "serde",
 ]
 
@@ -3311,8 +3638,8 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
 ]
 
 [[package]]
@@ -3322,7 +3649,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
 dependencies = [
  "fastrand",
- "phf_shared",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"
+dependencies = [
+ "fastrand",
+ "phf_shared 0.14.0",
 ]
 
 [[package]]
@@ -3331,8 +3668,21 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fa8d0ca26d424d27630da600c6624696e7dec8bf7b3b492b383c5dc49e5e085"
+dependencies = [
+ "phf_generator 0.14.0",
+ "phf_shared 0.14.0",
  "proc-macro2",
  "quote",
  "syn 2.0.114",
@@ -3347,6 +3697,15 @@ dependencies = [
  "siphasher",
 ]
 
+[[package]]
+name = "phf_shared"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
@@ -3461,7 +3820,7 @@ version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bee689443a2bd0a16ab0348b52ee43e3b2d1b1f931c8aa5c9f8de4c86fbe8c40"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "num-traits",
  "rand",
  "rand_chacha",
@@ -3626,7 +3985,7 @@ version = "0.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5407465600fb0548f1442edf71dd20683c6ed326200ace4b1ef0763521bb3b77"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -3648,7 +4007,7 @@ dependencies = [
  "chrono",
  "crossterm",
  "fd-lock",
- "itertools",
+ "itertools 0.13.0",
  "nu-ansi-term",
  "serde",
  "strip-ansi-escapes",
@@ -3867,7 +4226,7 @@ version = "0.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1c93dd1c9683b438c392c492109cb702b8090b2bfc8fed6f6e4eb4523f17af3"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "libsqlite3-sys",
@@ -3899,7 +4258,7 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -3908,9 +4267,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.35"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "log",
  "once_cell",
@@ -3945,9 +4304,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4137,7 +4496,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc198e42d9b7510827939c9a15f5062a0c913f3371d765977e586d2fe6c16f4a"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -4160,12 +4519,12 @@ version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "feef350c36147532e1b79ea5c1f3791373e61cbd9a6a2615413b3807bb164fb7"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "cssparser",
  "derive_more",
  "log",
  "new_debug_unreachable",
- "phf",
+ "phf 0.13.1",
  "phf_codegen",
  "precomputed-hash",
  "rustc-hash 2.1.1",
@@ -4173,6 +4532,12 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "self_cell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813"
+
 [[package]]
 name = "semver"
 version = "1.0.28"
@@ -4183,6 +4548,12 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "seq-macro"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
+
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -4491,9 +4862,18 @@ checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "smawk"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8e2fb0f499abb4d162f2bedad68f5ef91a1682b5a03596ddb67efd37768d100"
 
 [[package]]
 name = "socket2"
@@ -4537,7 +4917,7 @@ checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
 dependencies = [
  "new_debug_unreachable",
  "parking_lot",
- "phf_shared",
+ "phf_shared 0.13.1",
  "precomputed-hash",
 ]
 
@@ -4547,8 +4927,8 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
  "proc-macro2",
  "quote",
 ]
@@ -4745,6 +5125,11 @@ name = "textwrap"
 version = "0.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057"
+dependencies = [
+ "smawk",
+ "unicode-linebreak",
+ "unicode-width",
+]
 
 [[package]]
 name = "thiserror"
@@ -5032,7 +5417,7 @@ version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "bytes",
  "futures-util",
  "http",
@@ -5224,12 +5609,24 @@ version = "2.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
 
+[[package]]
+name = "unicode-id-start"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81b79ad29b5e19de4260020f8919b443b2ef0277d242ce532ec7b7a2cc8b6007"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
+[[package]]
+name = "unicode-linebreak"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
+
 [[package]]
 name = "unicode-normalization"
 version = "0.1.24"
@@ -5247,9 +5644,9 @@ checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "unicode-width"
@@ -5501,7 +5898,7 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57a9779e9f04d2ac1ce317aee707aa2f6b773afba7b931222bff6983843b1576"
 dependencies = [
- "phf",
+ "phf 0.13.1",
  "phf_codegen",
  "string_cache",
  "string_cache_codegen",
diff --git a/Cargo.toml b/Cargo.toml
index 49fe5c828..2dc2fc4e1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -76,6 +76,7 @@ dyn-clone = { version = "1", default-features = false }
 dyn-hash = { version = "1", default-features = false }
 eventsource-stream = { version = "0.2", default-features = false }
 fancy-regex = { version = "0.19", default-features = false }
+form_urlencoded = { version = "1", default-features = false, features = ["alloc"] }
 futures = { version = "0.3", default-features = false }
 gemini_client_rs = { git = "https://github.com/JeanMertz/gemini-client", default-features = false } # <https://github.com/Adriftdev/gemini-client/pull/16>
 gimli = { version = "0.33" }
@@ -104,6 +105,10 @@ object = { version = "0.39" }
 # which is the last release on reqwest 0.12.
 ollama-rs = { git = "https://github.com/JeanMertz/ollama-rs", rev = "6270148236d2d8e199580ee8f5a529868134c0a5", default-features = false }
 openai_responses = { version = "0.1", default-features = false }
+oxc_allocator = { version = "0.146", default-features = false }
+oxc_parser = { version = "0.146", default-features = false }
+oxc_semantic = { version = "0.146", default-features = false }
+oxc_span = { version = "0.146", default-features = false }
 parking_lot = { version = "0.12", default-features = false, features = ["arc_lock"] }
 paste = { version = "1", default-features = false }
 percent-encoding = { version = "2", default-features = false }
diff --git a/crates/jp_cli/src/cmd/plugin/dispatch.rs b/crates/jp_cli/src/cmd/plugin/dispatch.rs
index 02612e36f..7bd9bb1ad 100644
--- a/crates/jp_cli/src/cmd/plugin/dispatch.rs
+++ b/crates/jp_cli/src/cmd/plugin/dispatch.rs
@@ -4,7 +4,7 @@
 //! the plugin sends `exit` or the process terminates.
 
 use std::{
-    collections::{BTreeSet, HashSet},
+    collections::{BTreeSet, HashMap, HashSet},
     fmt::Write as _,
     fs,
     io::{self, BufRead, BufReader, Write},
@@ -40,25 +40,33 @@ use jp_plugin::{
         ComposeMode, ComposeOption, ComposeRequest, ComposeResponse, ConfigEntry, ConfigResponse,
         ConfigsResponse, ConversationSummary, ConversationsResponse, CreatedResponse,
         DescribeResponse, DoneResponse, DraftResponse, ErrorResponse, EventsResponse, HostToPlugin,
-        InitMessage, LogMessage, PathsInfo, PluginToHost, QueryCompleteResponse, QueryRequest,
-        SetTitleRequest, WorkspaceInfo, WriteDraftRequest,
+        InitMessage, InterruptAction as WireAction, InterruptRequest, LockState, LogMessage,
+        OutputFormat as PluginOutputFormat, PathsInfo, PluginToHost, QueryCompleteResponse,
+        QueryRequest, SetTitleRequest, WorkspaceInfo, WriteDraftRequest,
     },
 };
-use jp_printer::Printer;
+use jp_printer::{OutputFormat, Printer};
 use jp_storage::backend::{FsStorageBackend, Projection};
+use jp_task::task::TitleGeneratorTask;
 use jp_workspace::{ConversationLock, LockResult, Workspace, session::Session};
 use serde_json::Value;
-use tokio::{sync::mpsc, task::JoinSet};
+use tokio::{
+    sync::mpsc::{self, error::TrySendError},
+    task::JoinSet,
+};
 use tracing::{debug, error, info, trace, warn};
 
 use super::registry;
 use crate::{
     Ctx, KeyValueOrPath, cmd,
-    cmd::query::{PendingStreamTrim, TurnInputs, interrupt::reply_edit_mode},
+    cmd::query::{
+        NewTitle, PendingStreamTrim, TurnInputs,
+        interrupt::{InterruptAction, TurnInterruptSender, TurnInterrupts, reply_edit_mode},
+        resolve_new_title,
+    },
     config_pipeline::{build_partial_over, config_search_roots},
     ctx::McpServerScope,
     editor::{draft_query_text, draft_revision, report_editor_failure},
-    signals::SignalRouter,
 };
 
 /// Runs the prompts a plugin asks for.
@@ -249,6 +257,7 @@ fn init_message(
     paths: PluginPaths<'_>,
     config: &Arc<AppConfig>,
     log_level: u8,
+    format: OutputFormat,
 ) -> Result<(HostToPlugin, Value), cmd::Error> {
     let config_json = serde_json::to_value(config.as_ref().to_partial())
         .map_err(|e| cmd::Error::from(format!("failed to serialize config: {e}")))?;
@@ -276,6 +285,7 @@ fn init_message(
         options,
         args: args.to_vec(),
         log_level,
+        output_format: output_format(format),
     });
 
     Ok((init, config_json))
@@ -313,6 +323,7 @@ pub(crate) async fn run_plugin(
         paths,
         &config,
         ctx.term.args.verbose,
+        ctx.printer.format(),
     )?;
 
     let composer = Composer {
@@ -394,6 +405,7 @@ pub(crate) async fn run_plugin(
         &shutdown_sent,
         &composer,
         &mut turns,
+        &RunningTurns::default(),
     )
     .await;
 
@@ -530,6 +542,19 @@ fn stop_plugin(stdin: &Mutex<impl Write>, sent: &AtomicBool, child_id: u32, grac
     kill_child(child_id);
 }
 
+/// The host's output format, in the protocol's vocabulary.
+///
+/// Two enums rather than one shared type: the protocol should not depend on a
+/// particular renderer, so it carries its own.
+fn output_format(format: OutputFormat) -> PluginOutputFormat {
+    match format {
+        OutputFormat::Text => PluginOutputFormat::Text,
+        OutputFormat::TextPretty => PluginOutputFormat::TextPretty,
+        OutputFormat::Json => PluginOutputFormat::Json,
+        OutputFormat::JsonPretty => PluginOutputFormat::JsonPretty,
+    }
+}
+
 /// The JP directories a plugin is told about, so it needs no platform logic of
 /// its own.
 fn well_known_paths(user_storage_path: Option<&Utf8Path>) -> PathsInfo {
@@ -587,6 +612,7 @@ async fn message_loop(
     shutdown_sent: &AtomicBool,
     composer: &Composer,
     turns: &mut JoinSet<()>,
+    running: &RunningTurns,
 ) -> Result<(), cmd::Error> {
     while let Some(line) = requests.recv().await {
         if line.trim().is_empty() {
@@ -612,7 +638,7 @@ async fn message_loop(
 
             PluginToHost::Query(request) => {
                 // `None` means the turn is running and will answer for itself.
-                if let Some(response) = run_query(ctx, request, stdin, turns).await {
+                if let Some(response) = run_query(ctx, request, stdin, turns, running).await {
                     let mut writer = stdin.lock().expect("stdin lock poisoned");
                     write_message(&mut *writer, &response)
                         .map_err(|e| cmd::Error::from(format!("failed to answer a query: {e}")))?;
@@ -623,7 +649,6 @@ async fn message_loop(
                 let config = ctx.config();
                 let fs_backend = ctx.fs_backend.clone();
                 let session = ctx.session.clone();
-                let signals = ctx.signals.clone();
                 let mut writer = stdin.lock().expect("stdin lock poisoned");
 
                 if handle_request(
@@ -634,7 +659,7 @@ async fn message_loop(
                     session.as_ref(),
                     fs_backend.as_deref(),
                     &config,
-                    &signals,
+                    running,
                 )? == Flow::Stop
                 {
                     return Ok(());
@@ -674,6 +699,7 @@ async fn run_query(
     request: QueryRequest,
     stdin: &Arc<Mutex<ChildStdin>>,
     turns: &mut JoinSet<()>,
+    running: &RunningTurns,
 ) -> Option<HostToPlugin> {
     let reply_id = request.id.clone();
     let failed = |message: String| Some(query_error(reply_id.clone(), message));
@@ -693,7 +719,7 @@ async fn run_query(
     // dispatched while the task may not have started. A handler registered by
     // the task itself would not exist yet, and the stop request would be
     // reported as reaching nothing.
-    let turn_interrupt = ctx.signals.turn_interrupt(lock.id());
+    let turn_interrupt = ctx.signals.turn_interrupt();
 
     // Read from the lock, not the request: a new conversation was named by the
     // host, and the plugin has no other way to learn its id.
@@ -737,24 +763,54 @@ async fn run_query(
         "Running a delegated query.",
     );
 
+    let chat_request = ChatRequest {
+        content: request.content,
+        author: config.user.name.clone(),
+        ..ChatRequest::default()
+    };
+
+    // Registered before the turn starts, so an interrupt that arrives while it
+    // is still being prepared is delivered rather than refused as "no turn is
+    // running".
+    let interrupts = running.register(lock.id());
+
     // Swapped around collecting only, because that is the part that reads the
     // context. The turn itself carries the config it was given.
     let host_config = ctx.swap_config(Arc::clone(&config));
-    let prepared = prepare_turn(ctx, config, &lock, request.content).await;
+    let prepared = prepare_turn(
+        ctx,
+        Arc::clone(&config),
+        &lock,
+        chat_request.clone(),
+        interrupts,
+    )
+    .await;
     ctx.swap_config(host_config);
 
     let (inputs, stream) = match prepared {
         Ok(prepared) => prepared,
-        Err(error) => return failed(error.to_string()),
+        Err(error) => {
+            running.finished(lock.id());
+            return failed(error.to_string());
+        }
     };
 
+    let title_task = resolve_title(&config, &lock, &stream, &chat_request);
+
     // Hand the turn to its own task. It owns everything it needs and the lock owns
     // itself, so nothing here is borrowed for the minutes a turn can take, which
     // is what keeps the message loop answering reads while it runs.
     let stdin = Arc::clone(stdin);
+    let running = running.clone();
 
     turns.spawn(async move {
-        let outcome = inputs.run(&lock, stream, turn_interrupt).await;
+        // Alongside the turn rather than after it: the two are independent
+        // requests, and whoever is looking at a list of conversations wants a
+        // name for this one long before the answer arrives.
+        let (outcome, ()) = tokio::join!(
+            inputs.run(&lock, stream, turn_interrupt),
+            write_generated_title(title_task, &lock),
+        );
 
         // Reported through tracing rather than to the terminal. These are facts
         // about the host, not content: the turn's output belongs to the
@@ -776,6 +832,14 @@ async fn run_query(
             }
         };
 
+        // Both before the answer goes out, because the answer is what a client
+        // waits on before sending its next request. Reporting the turn as
+        // finished while it still held the conversation would have that request
+        // refused as already-locked, and an interrupt aimed at a turn that has
+        // stopped reading would be accepted and then dropped.
+        running.finished(lock.id());
+        drop(lock);
+
         let mut writer = stdin.lock().expect("stdin lock poisoned");
         drop(write_message(&mut *writer, &reply));
     });
@@ -914,7 +978,8 @@ async fn prepare_turn(
     ctx: &mut Ctx,
     config: Arc<AppConfig>,
     lock: &ConversationLock,
-    content: String,
+    chat_request: ChatRequest,
+    interrupts: TurnInterrupts,
 ) -> Result<(TurnInputs, ConversationStream), cmd::Error> {
     // The client was built from the config this host read at startup. A provider
     // added to the workspace since then is otherwise unknown to it, and starting
@@ -931,12 +996,6 @@ async fn prepare_turn(
         .configure_active_mcp_servers(forced_tool, McpServerScope::Shared)
         .await?;
 
-    let chat_request = ChatRequest {
-        content,
-        author: config.user.name.clone(),
-        ..ChatRequest::default()
-    };
-
     // The message has moved from draft to request, so the draft is done. Clearing
     // it here rather than from the caller gives it one owner: a client that
     // cleared its own draft would be racing its debounced save, and losing.
@@ -1001,12 +1060,90 @@ async fn prepare_turn(
         // tool at `ask` runs rather than stopping for approval, matching what
         // `jp query --no-interactive` does.
         false,
+        interrupts,
     )
     .await?;
 
     Ok((inputs, stream))
 }
 
+/// Decide how a conversation nobody has named gets a title from its first
+/// message.
+///
+/// A leading markdown heading is written straight to the conversation.
+/// Anything else needs the model, and comes back as a task for the caller to
+/// run.
+/// Returns `None` when the conversation already has a title, already has
+/// events, or the configuration asks for neither route.
+fn resolve_title(
+    config: &AppConfig,
+    lock: &ConversationLock,
+    stream: &ConversationStream,
+    chat_request: &ChatRequest,
+) -> Option<TitleGeneratorTask> {
+    if lock.metadata().title.is_some() || !stream.is_empty() {
+        return None;
+    }
+
+    match resolve_new_title(
+        config.conversation.title.from_heading,
+        config.conversation.title.generate.auto,
+        &chat_request.content,
+    ) {
+        NewTitle::FromHeading(title) => {
+            debug!(conversation = %lock.id(), "Titling from the prompt's leading heading.");
+            lock.as_mut()
+                .update_metadata(|meta| meta.title = Some(title));
+            None
+        }
+        NewTitle::Generate => {
+            // The title model is configured separately from the assistant's, so
+            // a broken one must not take the turn down with it.
+            let mut events = stream.clone();
+            events.start_turn(chat_request.clone());
+
+            match TitleGeneratorTask::new(lock.id(), events, config, false) {
+                Ok(task) => Some(task),
+                Err(error) => {
+                    warn!(%error, "Skipping title generation.");
+                    None
+                }
+            }
+        }
+        NewTitle::Skip => None,
+    }
+}
+
+/// Run a title task and record what it produced.
+///
+/// Writes through the turn's own lock, so the name is on disk as soon as the
+/// model answers rather than when the turn ends.
+async fn write_generated_title(task: Option<TitleGeneratorTask>, lock: &ConversationLock) {
+    let Some(task) = task else {
+        return;
+    };
+
+    let title = match task.generate().await {
+        Ok(Some(title)) => title,
+        Ok(None) => {
+            warn!(conversation = %lock.id(), "The title model answered without a title.");
+            return;
+        }
+        Err(error) => {
+            warn!(%error, conversation = %lock.id(), "Failed to generate a title.");
+            return;
+        }
+    };
+
+    debug!(conversation = %lock.id(), %title, "Generated a conversation title.");
+
+    let mut conv = lock.as_mut();
+    conv.update_metadata(|meta| meta.title = Some(title));
+    if let Err(error) = conv.flush() {
+        warn!(%error, "Failed to persist the generated title.");
+    }
+}
+
 /// Flatten an error and its sources into one line.
 ///
 /// JP's error types label a category and carry the cause underneath, so the
@@ -1046,6 +1183,135 @@ enum Flow {
     Stop,
 }
 
+/// The turns this host is running, and how to reach each one.
+///
+/// An interrupt names the conversation it means, because a host runs several
+/// turns at once and stopping the wrong one is worse than stopping nothing.
+///
+/// An entry lives for exactly as long as its turn: registered before the turn
+/// starts, removed once it ends.
+/// A request that arrives a moment too late therefore finds nothing, and is
+/// told so rather than being dropped — which is what lets a client tell an
+/// interrupted turn from one that had already finished.
+#[derive(Clone, Default)]
+struct RunningTurns(Arc<Mutex<HashMap<ConversationId, TurnInterruptSender>>>);
+
+impl RunningTurns {
+    /// Open the interrupt channel for a turn about to start on `conversation`.
+    ///
+    /// Returns the end the turn keeps.
+    /// Any earlier entry for the same conversation is replaced, which cannot
+    /// happen while the conversation lock is doing its job.
+    fn register(&self, conversation: ConversationId) -> TurnInterrupts {
+        let (tx, interrupts) = TurnInterrupts::channel();
+        self.0
+            .lock()
+            .expect("running turns lock poisoned")
+            .insert(conversation, tx);
+
+        interrupts
+    }
+
+    /// Forget the turn on `conversation`.
+    fn finished(&self, conversation: ConversationId) {
+        self.0
+            .lock()
+            .expect("running turns lock poisoned")
+            .remove(&conversation);
+    }
+
+    /// Deliver `action` to the turn running on `conversation`.
+    ///
+    /// The error is the message to report, phrased for whoever sent the
+    /// interrupt.
+    fn interrupt(
+        &self,
+        conversation: ConversationId,
+        action: InterruptAction,
+    ) -> Result<(), String> {
+        let sender = self
+            .0
+            .lock()
+            .expect("running turns lock poisoned")
+            .get(&conversation)
+            .cloned()
+            .ok_or_else(|| format!("no turn is running on conversation {conversation}"))?;
+
+        sender.try_send(action).map_err(|error| match error {
+            TrySendError::Closed(_) => {
+                format!("the turn on conversation {conversation} has ended")
+            }
+            TrySendError::Full(_) => format!(
+                "the turn on conversation {conversation} has not caught up with the interrupts \
+                 already sent"
+            ),
+        })
+    }
+}
+
+/// Deliver an interrupt to the turn it names.
+///
+/// Returns the answer to send, or `None` when the request carried no id: a
+/// plugin that is not waiting for one has nowhere to put an uncorrelated
+/// response.
+fn handle_interrupt(req: InterruptRequest, turns: &RunningTurns) -> Option<HostToPlugin> {
+    let delivered = parse_conversation_id(&req.conversation)
+        .and_then(|id| Ok((id, requested_action(&req)?)))
+        .and_then(|(id, action)| turns.interrupt(id, action));
+
+    match &delivered {
+        Ok(()) => debug!(
+            conversation = %req.conversation,
+            action = ?req.action,
+            "Interrupted a turn on a plugin's behalf."
+        ),
+        Err(error) => debug!(
+            conversation = %req.conversation,
+            action = ?req.action,
+            error,
+            "Could not interrupt a turn on a plugin's behalf."
+        ),
+    }
+
+    let id = req.id?;
+
+    Some(match delivered {
+        Ok(()) => HostToPlugin::Done(DoneResponse { id: Some(id) }),
+        Err(message) => HostToPlugin::Error(ErrorResponse {
+            id: Some(id),
+            request: Some("interrupt".to_owned()),
+            message,
+        }),
+    })
+}
+
+/// Read the interrupt a request is asking for.
+///
+/// The error is the message to report: a `reply` without anything to say is the
+/// one combination the wire format allows and a turn cannot act on.
+fn requested_action(request: &InterruptRequest) -> Result<InterruptAction, String> {
+    match request.action {
+        WireAction::Stop => Ok(InterruptAction::Stop),
+        WireAction::Abort => Ok(InterruptAction::Abort),
+        WireAction::Reply => {
+            let content = request
+                .content
+                .as_deref()
+                .map(str::trim)
+                .filter(|content| !content.is_empty())
+                .ok_or("a reply needs `content`")?;
+
+            Ok(InterruptAction::Reply {
+                content: content.to_owned(),
+
+                // Typed somewhere else entirely, so the terminal the turn runs
+                // in has never seen it.
+                echo: true,
+            })
+        }
+    }
+}
+
 /// Answer one request from the plugin.
 ///
 /// Runs with the writer lock held, so everything here has to be quick: anything
@@ -1058,7 +1324,7 @@ fn handle_request(
     session: Option<&Session>,
     fs_backend: Option<&FsStorageBackend>,
     config: &AppConfig,
-    signals: &SignalRouter,
+    turns: &RunningTurns,
 ) -> Result<Flow, cmd::Error> {
     match msg {
         PluginToHost::Ready(ready) => {
@@ -1113,39 +1379,8 @@ fn handle_request(
         }
 
         PluginToHost::Interrupt(req) => {
-            // Aimed at the named conversation, not at whatever is topmost.
-            //
-            // Several turns can be running at once, and the request already said
-            // which one it means. Falling back to the untargeted path would stop
-            // an arbitrary other turn, which is worse than stopping nothing.
-            //
-            // Nothing to answer: what the interrupt did lands in the
-            // conversation, and the turn's own outcome is still the reply to its
-            // `query`.
-            //
-            // A scope with no handler is benign, so it stays at debug: the turn
-            // finished before the request arrived. An id that does not parse is
-            // the plugin's bug, and silence would leave its author unable to
-            // tell the two apart.
-            //
-            // `interrupt_scope` is called before the macro, not inside it: a
-            // tracing field expression only runs when the callsite is enabled,
-            // and a run whose log file could not be created installs no
-            // subscriber at all. The interrupt has to happen either way.
-            match parse_conversation_id(&req.conversation) {
-                Ok(id) => {
-                    let reached = signals.interrupt_scope(id);
-                    debug!(
-                        conversation = %req.conversation,
-                        reached,
-                        "Interrupting on a plugin's behalf."
-                    );
-                }
-                Err(error) => warn!(
-                    conversation = %req.conversation,
-                    %error,
-                    "Ignoring an interrupt that names an unparseable conversation."
-                ),
+            if let Some(response) = handle_interrupt(req, turns) {
+                write_message(writer, &response)?;
             }
         }
 
@@ -1655,13 +1890,44 @@ fn handle_read_events(
         jp_conversation::decode_event_value(value);
     }
 
+    // Carried here so labelling one conversation doesn't cost a plugin the whole
+    // conversation list, which reads every conversation's metadata.
+    let title = workspace
+        .metadata(&handle)
+        .ok()
+        .and_then(|meta| meta.title.clone());
+
     HostToPlugin::Events(EventsResponse {
         id: req_id,
         conversation: conversation_id.to_owned(),
+        lock: lock_state(workspace, &conv_id),
+        title,
         data: event_values,
     })
 }
 
+/// Whether a turn is running on a conversation, and whose it is.
+///
+/// Read from the lock rather than from the transcript: a stream ending in a
+/// request looks identical whether a turn is running, was interrupted, or
+/// failed outright.
+///
+/// A lock file outlives the process that wrote it when that process is killed,
+/// so a recorded holder that is no longer alive counts as no holder at all.
+/// Otherwise a crashed run would leave a conversation looking busy forever.
+fn lock_state(workspace: &Workspace, id: &ConversationId) -> LockState {
+    workspace
+        .conversation_lock_info(id)
+        .filter(|info| is_process_alive(info.pid))
+        .map_or(LockState::Free, |info| {
+            if info.pid == std::process::id() {
+                LockState::Here
+            } else {
+                LockState::Elsewhere
+            }
+        })
+}
+
 fn handle_read_config(
     config_json: &Value,
     path: Option<String>,
diff --git a/crates/jp_cli/src/cmd/plugin/dispatch_tests.rs b/crates/jp_cli/src/cmd/plugin/dispatch_tests.rs
index 4d3fbbf11..abe7165aa 100644
--- a/crates/jp_cli/src/cmd/plugin/dispatch_tests.rs
+++ b/crates/jp_cli/src/cmd/plugin/dispatch_tests.rs
@@ -16,14 +16,6 @@ fn bare_workspace() -> Workspace {
     Workspace::in_memory("/tmp/jp-test-plugin")
 }
 
-/// A router with no signal source, for requests that never reach one.
-///
-/// Must be called inside a tokio runtime, which is why the tests using it are
-/// `#[tokio::test]` despite `handle_request` being synchronous.
-fn router() -> SignalRouter {
-    crate::signals::testing::detached_router()
-}
-
 /// How a conversation is spelled on the wire, matching `list_conversations`.
 fn wire_id(id: ConversationId) -> String {
     id.to_string()
@@ -42,63 +34,61 @@ fn conversation_id(secs: u64) -> ConversationId {
 /// A run whose `--log-file` names a directory that does not exist installs no
 /// tracing subscriber at all, and a `tracing` field expression does not run
 /// when its callsite is disabled.
-/// These tests install no subscriber either, so an `interrupt_scope` call
-/// written inside the macro is never made.
-#[tokio::test]
-async fn an_interrupt_is_issued_without_a_tracing_subscriber() {
+/// These tests install no subscriber either, so a delivery written inside the
+/// macro is never made.
+#[test]
+fn an_interrupt_is_issued_without_a_tracing_subscriber() {
     let mut ws = bare_workspace();
     let mut sink: Vec<u8> = Vec::new();
-    let signals = router();
+    let turns = RunningTurns::default();
 
     let id = conversation_id(1_700_000_000);
-    let (_guard, mut interrupted) = signals.push_handler_for(id);
+    let mut interrupted = turns.register(id);
 
     handle_request(
-        PluginToHost::Interrupt(InterruptRequest {
-            conversation: wire_id(id),
-        }),
+        PluginToHost::Interrupt(InterruptRequest::stop(wire_id(id))),
         &mut sink,
         &mut ws,
         &json!({}),
         None,
         None,
         &AppConfig::new_test(),
-        &signals,
+        &turns,
     )
     .unwrap();
 
-    assert!(
-        interrupted.try_recv().is_ok(),
+    assert_eq!(
+        interrupted.try_next(),
+        Some(InterruptAction::Stop),
         "the turn was never told to stop"
     );
 }
 
 /// An interrupt naming something that is not a conversation id is the plugin's
 /// bug, and must not be mistaken for a turn that already finished.
-#[tokio::test]
-async fn an_unparseable_interrupt_reaches_no_handler() {
+#[test]
+fn an_unparseable_interrupt_reaches_no_handler() {
     let mut ws = bare_workspace();
     let mut sink: Vec<u8> = Vec::new();
-    let signals = router();
+    let turns = RunningTurns::default();
 
-    let (_guard, mut interrupted) = signals.push_handler_for(conversation_id(1_700_000_000));
+    let mut interrupted = turns.register(conversation_id(1_700_000_000));
 
     handle_request(
-        PluginToHost::Interrupt(InterruptRequest {
-            conversation: "not-an-id".to_owned(),
-        }),
+        PluginToHost::Interrupt(InterruptRequest::stop("not-an-id".to_owned())),
         &mut sink,
         &mut ws,
         &json!({}),
         None,
         None,
         &AppConfig::new_test(),
-        &signals,
+        &turns,
     )
     .unwrap();
 
-    assert!(
-        interrupted.try_recv().is_err(),
+    assert_eq!(
+        interrupted.try_next(),
+        None,
         "a malformed id must not stop an unrelated turn"
     );
 }
@@ -600,7 +590,7 @@ async fn a_conversation_written_after_startup_is_listed() {
         None,
         None,
         &AppConfig::new_test(),
-        &router(),
+        &RunningTurns::default(),
     )
     .unwrap();
     assert_eq!(response, Flow::Continue);
@@ -650,7 +640,7 @@ async fn an_event_written_after_a_read_is_served_by_the_next_read() {
         None,
         None,
         &AppConfig::new_test(),
-        &router(),
+        &RunningTurns::default(),
     )
     .unwrap();
 
@@ -672,7 +662,7 @@ async fn an_event_written_after_a_read_is_served_by_the_next_read() {
         None,
         None,
         &AppConfig::new_test(),
-        &router(),
+        &RunningTurns::default(),
     )
     .unwrap();
 
@@ -738,7 +728,7 @@ async fn a_ready_carries_on_and_a_clean_exit_stops() {
             None,
             None,
             &AppConfig::new_test(),
-            &router(),
+            &RunningTurns::default(),
         )
         .unwrap(),
         Flow::Continue
@@ -756,7 +746,7 @@ async fn a_ready_carries_on_and_a_clean_exit_stops() {
             None,
             None,
             &AppConfig::new_test(),
-            &router(),
+            &RunningTurns::default(),
         )
         .unwrap(),
         Flow::Stop
@@ -781,7 +771,7 @@ async fn a_failing_exit_carries_its_code_and_reason() {
         None,
         None,
         &AppConfig::new_test(),
-        &router(),
+        &RunningTurns::default(),
     )
     .expect_err("a non-zero exit is an error");
 
@@ -961,7 +951,7 @@ async fn a_plugin_needing_a_newer_protocol_is_refused() {
         None,
         None,
         &AppConfig::new_test(),
-        &router(),
+        &RunningTurns::default(),
     )
     .expect_err("a plugin needing a newer protocol must be refused");
 
@@ -971,6 +961,149 @@ async fn a_plugin_needing_a_newer_protocol_is_refused() {
     );
 }
 
+/// An interrupt reaches the turn it names and no other.
+///
+/// The failure this guards against is stopping the wrong turn: a host runs
+/// several at once, and the request is the only thing that says which.
+#[test]
+fn an_interrupt_reaches_only_the_turn_it_names() {
+    let turns = RunningTurns::default();
+    let wanted = conversation_id(1_700_000_000);
+    let other = conversation_id(1_700_000_001);
+
+    let mut wanted_rx = turns.register(wanted);
+    let mut other_rx = turns.register(other);
+
+    turns.interrupt(wanted, InterruptAction::Stop).unwrap();
+
+    assert_eq!(wanted_rx.try_next(), Some(InterruptAction::Stop));
+    assert_eq!(other_rx.try_next(), None);
+}
+
+/// A turn that has finished is reported as gone rather than silently accepting
+/// an interrupt nothing will read.
+///
+/// This is what lets a client tell "interrupted" from "it had already
+/// finished", and send its message as a new turn instead of losing it.
+#[test]
+fn interrupting_a_finished_turn_says_so() {
+    let turns = RunningTurns::default();
+    let id = conversation_id(1_700_000_000);
+
+    let _rx = turns.register(id);
+    turns.interrupt(id, InterruptAction::Stop).unwrap();
+
+    turns.finished(id);
+
+    let error = turns
+        .interrupt(id, InterruptAction::Stop)
+        .expect_err("the turn is gone");
+
+    assert_eq!(
+        error,
+        format!("no turn is running on conversation {id}"),
+        "the message names the conversation, because a client can be watching several"
+    );
+}
+
+/// A turn whose receiver is gone is reported as ended, not as never having
+/// existed: the entry is still registered, so the two are distinguishable.
+#[test]
+fn interrupting_a_turn_that_stopped_reading_says_it_ended() {
+    let turns = RunningTurns::default();
+    let id = conversation_id(1_700_000_000);
+
+    drop(turns.register(id));
+
+    let error = turns
+        .interrupt(id, InterruptAction::Stop)
+        .expect_err("nothing is reading");
+
+    assert_eq!(error, format!("the turn on conversation {id} has ended"));
+}
+
+/// The wire's `reply` carries the text the turn answers with.
+#[test]
+fn a_reply_request_carries_its_content_to_the_turn() {
+    let action = requested_action(&InterruptRequest::reply(
+        "jp-c17000000000".to_owned(),
+        "  use Rust instead  ".to_owned(),
+    ))
+    .expect("a reply with content is deliverable");
+
+    assert_eq!(action, InterruptAction::Reply {
+        // Trimmed, because a browser's textarea keeps the newline a user
+        // pressed Enter on before deciding to send.
+        content: "use Rust instead".to_owned(),
+
+        // Nobody watched this arrive at the terminal the turn runs in.
+        echo: true,
+    });
+}
+
+/// A `reply` with nothing to say is refused rather than delivered as an empty
+/// message the assistant has to answer.
+#[test]
+fn a_reply_request_without_content_is_refused() {
+    let blank = InterruptRequest {
+        content: Some("   \n ".to_owned()),
+        ..InterruptRequest::reply("jp-c17000000000".to_owned(), String::new())
+    };
+
+    assert_eq!(
+        requested_action(&blank).expect_err("a blank reply is not deliverable"),
+        "a reply needs `content`"
+    );
+
+    let missing = InterruptRequest {
+        action: WireAction::Reply,
+        ..InterruptRequest::stop("jp-c17000000000".to_owned())
+    };
+
+    assert_eq!(
+        requested_action(&missing).expect_err("a reply with no content field is not deliverable"),
+        "a reply needs `content`"
+    );
+}
+
+/// An `interrupt` from a protocol 8 plugin carries no action, and means the
+/// stop it meant then.
+#[test]
+fn an_interrupt_without_an_action_stops_the_turn() {
+    let request: InterruptRequest =
+        serde_json::from_value(json!({ "conversation": "jp-c17000000000" })).unwrap();
+
+    assert_eq!(requested_action(&request).unwrap(), InterruptAction::Stop);
+}
+
+/// A request that asked for an answer gets one; one that did not is left alone.
+///
+/// An uncorrelated response is a message the plugin has nowhere to put, and the
+/// dispatcher pairs replies to requests by id.
+#[test]
+fn only_an_interrupt_with_an_id_is_answered() {
+    let turns = RunningTurns::default();
+    let id = conversation_id(1_700_000_000);
+    let _rx = turns.register(id);
+
+    assert!(
+        handle_interrupt(InterruptRequest::stop(id.to_string()), &turns).is_none(),
+        "a fire-and-forget interrupt is not answered"
+    );
+
+    let answered = handle_interrupt(
+        InterruptRequest::stop(id.to_string()).with_id("req-1".to_owned()),
+        &turns,
+    );
+
+    assert_eq!(
+        answered,
+        Some(HostToPlugin::Done(DoneResponse {
+            id: Some("req-1".to_owned())
+        }))
+    );
+}
+
 /// The user-global root is `<config dir>/config/`, the directory `--cfg` itself
 /// searches, so a listing built from its parent reports nothing.
 ///
diff --git a/crates/jp_cli/src/cmd/query.rs b/crates/jp_cli/src/cmd/query.rs
index 1c59dca42..894d0fe91 100644
--- a/crates/jp_cli/src/cmd/query.rs
+++ b/crates/jp_cli/src/cmd/query.rs
@@ -68,6 +68,7 @@ use chrono::{DateTime, Utc};
 use clap::{ArgAction, builder::TypedValueParser as _};
 use crossterm::style::Stylize as _;
 use indexmap::IndexMap;
+use interrupt::TurnInterrupts;
 use jp_attachment::Attachment;
 use jp_config::{
     AppConfig, PartialAppConfig, PartialConfig as _, PartialConfigDelta as _,
@@ -705,11 +706,14 @@ impl Query {
             mcp_servers_handle,
             ctx.printer.clone(),
             ctx.term.interactive,
+            // Ctrl-C is how this turn is interrupted, and that arrives through
+            // the signal router.
+            TurnInterrupts::none(),
         )
         .await?;
 
         let mut turn_result = inputs
-            .run(lock, stream, ctx.signals.turn_interrupt(lock.id()))
+            .run(lock, stream, ctx.signals.turn_interrupt())
             .await
             .map_err(|error| cmd::Error::from(error).with_persistence(true));
 
@@ -1054,6 +1058,7 @@ impl Query {
         invocation: InvocationContext,
         pending_trim: PendingStreamTrim,
         mut turn_interrupt: TurnInterrupt,
+        interrupts: TurnInterrupts,
     ) -> Result<()> {
         let model_id = cfg.assistant.model.id.resolved();
         let provider: Arc<dyn jp_llm::Provider> = Arc::from(provider::get_provider(
@@ -1113,6 +1118,7 @@ impl Query {
             invocation,
             pending_trim,
             turn_interrupt,
+            interrupts,
         )
         .await
     }
@@ -1376,6 +1382,13 @@ pub(crate) struct TurnInputs {
 
     /// MCP servers starting in the background, awaited by [`TurnInputs::run`].
     mcp_servers: StartupSet,
+
+    /// Interrupts aimed at this turn by whoever asked for it.
+    ///
+    /// A turn typed at a terminal is interrupted through the signal router and
+    /// takes [`TurnInterrupts::none`]; a turn asked for from elsewhere is
+    /// reached through here.
+    interrupts: TurnInterrupts,
 }
 
 impl TurnInputs {
@@ -1407,6 +1420,7 @@ impl TurnInputs {
         mcp_servers: StartupSet,
         printer: Arc<Printer>,
         interactive: bool,
+        interrupts: TurnInterrupts,
     ) -> Result<Self> {
         let urls: Vec<Url> = config
             .conversation
@@ -1456,6 +1470,7 @@ impl TurnInputs {
             chat_request,
             pending_trim,
             config,
+            interrupts,
         })
     }
 
@@ -1561,6 +1576,7 @@ impl TurnInputs {
             },
             self.pending_trim,
             turn_interrupt,
+            self.interrupts,
         )
         .await
     }
@@ -2242,7 +2258,7 @@ enum QuerySource {
 /// How a new conversation's title is set from its first prompt, before the turn
 /// runs.
 #[derive(Debug, PartialEq)]
-enum NewTitle {
+pub(crate) enum NewTitle {
     /// Use this text, taken verbatim from a leading markdown heading.
     FromHeading(String),
 
@@ -2259,7 +2275,11 @@ enum NewTitle {
 /// background generation is chosen when `generate_auto` is enabled.
 /// The two flags are independent: disabling generation does not disable
 /// heading-derived titles.
-fn resolve_new_title(from_heading: bool, generate_auto: bool, content: &str) -> NewTitle {
+pub(crate) fn resolve_new_title(
+    from_heading: bool,
+    generate_auto: bool,
+    content: &str,
+) -> NewTitle {
     if from_heading && let Some(title) = jp_md::heading::leading_heading(content) {
         return NewTitle::FromHeading(title);
     }
diff --git a/crates/jp_cli/src/cmd/query/interrupt.rs b/crates/jp_cli/src/cmd/query/interrupt.rs
index 3657b08c5..853e5ee29 100644
--- a/crates/jp_cli/src/cmd/query/interrupt.rs
+++ b/crates/jp_cli/src/cmd/query/interrupt.rs
@@ -3,10 +3,13 @@
 //! Provides context-aware interrupt menus (streaming vs tool execution) and
 //! routes OS signals to the appropriate handlers.
 
+pub(crate) mod channel;
 pub(crate) mod handler;
 pub(crate) mod signals;
 
+pub(crate) use channel::{TurnInterruptSender, TurnInterrupts};
 pub(crate) use handler::{InterruptAction, reply_edit_mode};
 pub(crate) use signals::{
-    LoopAction, StreamingInterruptResult, handle_llm_event, handle_streaming_interrupt,
+    LoopAction, StreamingInterruptResult, apply_streaming_interrupt, handle_llm_event,
+    handle_streaming_interrupt,
 };
diff --git a/crates/jp_cli/src/cmd/query/interrupt/channel.rs b/crates/jp_cli/src/cmd/query/interrupt/channel.rs
new file mode 100644
index 000000000..d1778fda0
--- /dev/null
+++ b/crates/jp_cli/src/cmd/query/interrupt/channel.rs
@@ -0,0 +1,79 @@
+//! Interrupts aimed at a running turn from outside the process.
+//!
+//! A turn driven from a terminal learns what the user wants through its own
+//! prompt: Ctrl-C notifies the loop, the loop shows the interrupt menu, and the
+//! menu returns an [`InterruptAction`].
+//! A turn nobody is sitting in front of has no menu to show, so the action
+//! arrives already decided, over the channel in this module.
+//!
+//! [`TurnInterrupts`] is the receiving end, owned by the turn.
+//! [`TurnInterruptSender`] is the sending end, held by whoever is driving that
+//! turn from elsewhere.
+
+use std::task::{Context, Poll};
+
+use tokio::sync::mpsc;
+
+use super::InterruptAction;
+
+/// How many undelivered interrupts a turn will hold.
+///
+/// A turn consumes these between provider events, so the queue only builds up
+/// while one is in flight.
+/// Small on purpose: a client that has sent eight unanswered interrupts is not
+/// going to be helped by a ninth being accepted.
+const CAPACITY: usize = 8;
+
+/// Sends interrupts to one running turn.
+///
+/// Cloneable, and every clone reaches the same turn.
+/// Sending fails once the turn has ended, which is how a client learns there
+/// was nothing left to interrupt.
+pub(crate) type TurnInterruptSender = mpsc::Sender<InterruptAction>;
+
+/// Receives interrupts aimed at this turn.
+pub(crate) struct TurnInterrupts(mpsc::Receiver<InterruptAction>);
+
+impl TurnInterrupts {
+    /// Create both ends of a turn's interrupt channel.
+    pub(crate) fn channel() -> (TurnInterruptSender, Self) {
+        let (tx, rx) = mpsc::channel(CAPACITY);
+        (tx, Self(rx))
+    }
+
+    /// An end nothing can send to.
+    ///
+    /// For a turn whose only user is at the terminal it is running in: the
+    /// keyboard reaches it through the signal router, and no client holds a
+    /// sender.
+    /// Reads as an ended stream, so a caller polling it alongside other sources
+    /// drops it on the first poll.
+    pub(crate) fn none() -> Self {
+        let (_, rx) = mpsc::channel(1);
+        Self(rx)
+    }
+
+    /// Take the next interrupt if one has already arrived.
+    ///
+    /// Never waits.
+    pub(crate) fn try_next(&mut self) -> Option<InterruptAction> {
+        self.0.try_recv().ok()
+    }
+
+    /// Wait for the next interrupt.
+    ///
+    /// Yields `None` once every sender is gone, which for
+    /// [`TurnInterrupts::none`] is immediately.
+    /// Cancel-safe, so it can be raced against other work.
+    pub(crate) async fn next(&mut self) -> Option<InterruptAction> {
+        self.0.recv().await
+    }
+
+    /// Poll for the next interrupt.
+    ///
+    /// Yields `Ready(None)` once every sender is gone, which for
+    /// [`TurnInterrupts::none`] is immediately.
+    pub(crate) fn poll_next(&mut self, cx: &mut Context<'_>) -> Poll<Option<InterruptAction>> {
+        self.0.poll_recv(cx)
+    }
+}
diff --git a/crates/jp_cli/src/cmd/query/interrupt/handler.rs b/crates/jp_cli/src/cmd/query/interrupt/handler.rs
index b2f89f86f..3b0857a37 100644
--- a/crates/jp_cli/src/cmd/query/interrupt/handler.rs
+++ b/crates/jp_cli/src/cmd/query/interrupt/handler.rs
@@ -98,13 +98,14 @@ pub enum InterruptAction {
         /// The reply text.
         content: String,
 
-        /// Whether the reply was composed in the external editor.
+        /// Whether the caller has to render the reply to the terminal.
         ///
-        /// An editor-composed reply never appeared on the terminal, so the
-        /// caller should echo it back.
-        /// An inline-composed reply is already visible in scrollback on the
-        /// widget's own line.
-        from_editor: bool,
+        /// `false` when the text is already on the terminal because that is
+        /// where it was typed — an inline-composed reply sits in scrollback on
+        /// the widget's own line, and rendering it again would double it.
+        /// `true` for a reply the terminal never saw: composed in the external
+        /// editor, or sent by a client somewhere else entirely.
+        echo: bool,
     },
 
     /// Resume generation (if stream is alive) or wait (if tool is running).
@@ -283,7 +284,10 @@ impl<P: PromptBackend> InterruptHandler<P> {
                     ReplyResult::Reply { text, from_editor } => {
                         return InterruptAction::Reply {
                             content: text,
-                            from_editor,
+                            // The editor took over the screen and gave it back:
+                            // whatever was composed there was never rendered
+                            // here.
+                            echo: from_editor,
                         };
                     }
                     // Empty submit or `Ctrl+C` in a menu-driven reply re-shows
diff --git a/crates/jp_cli/src/cmd/query/interrupt/handler_tests.rs b/crates/jp_cli/src/cmd/query/interrupt/handler_tests.rs
index 23bd69704..a26aa26f1 100644
--- a/crates/jp_cli/src/cmd/query/interrupt/handler_tests.rs
+++ b/crates/jp_cli/src/cmd/query/interrupt/handler_tests.rs
@@ -172,7 +172,7 @@ fn streaming_interrupt_reply_submits() {
     );
     assert_eq!(action, InterruptAction::Reply {
         content: "my reply message".into(),
-        from_editor: false,
+        echo: false,
     });
 }
 
@@ -206,7 +206,7 @@ fn streaming_interrupt_reply_empty_returns_to_menu_then_submits() {
     );
     assert_eq!(action, InterruptAction::Reply {
         content: "second try".into(),
-        from_editor: false,
+        echo: false,
     });
 }
 
@@ -227,11 +227,11 @@ fn streaming_interrupt_open_editor_re_seeds_then_submits() {
         &make_printer(),
         true,
     );
-    // The `Ctrl+X` round-trip ends with a widget submission, so the reply
-    // counts as inline-composed (visible in scrollback).
+    // The `Ctrl+X` round-trip ends with a widget submission, so the text is on
+    // the terminal and echoing it would double it.
     assert_eq!(action, InterruptAction::Reply {
         content: "from the editor, edited inline".into(),
-        from_editor: false,
+        echo: false,
     });
 }
 
@@ -424,7 +424,7 @@ fn configured_streaming_reply_uses_inline_prompt() {
     );
     assert_eq!(action, InterruptAction::Reply {
         content: "changed my mind".into(),
-        from_editor: false,
+        echo: false,
     });
 }
 
@@ -521,7 +521,7 @@ fn compose_in_editor_opens_editor_directly() {
     );
     assert_eq!(action, InterruptAction::Reply {
         content: "written in the editor".into(),
-        from_editor: true,
+        echo: true,
     });
 }
 
@@ -579,7 +579,7 @@ fn compose_never_uses_inline_widget() {
     let action = handler(backend).handle_streaming_interrupt(&config, &make_printer(), true);
     assert_eq!(action, InterruptAction::Reply {
         content: "inline only".into(),
-        from_editor: false,
+        echo: false,
     });
 }
 
@@ -597,7 +597,7 @@ fn compose_in_editor_without_editor_falls_back_to_inline() {
     let action = handler(backend).handle_streaming_interrupt(&config, &make_printer(), true);
     assert_eq!(action, InterruptAction::Reply {
         content: "typed inline".into(),
-        from_editor: false,
+        echo: false,
     });
 }
 
@@ -621,7 +621,7 @@ fn compose_in_editor_spawn_failure_falls_back_to_inline() {
     );
     assert_eq!(action, InterruptAction::Reply {
         content: "typed inline".into(),
-        from_editor: false,
+        echo: false,
     });
 }
 
@@ -646,6 +646,6 @@ fn inline_editor_escape_spawn_failure_keeps_buffer() {
     );
     assert_eq!(action, InterruptAction::Reply {
         content: "draft, then more".into(),
-        from_editor: false,
+        echo: false,
     });
 }
diff --git a/crates/jp_cli/src/cmd/query/interrupt/signals.rs b/crates/jp_cli/src/cmd/query/interrupt/signals.rs
index 867751873..7829b54ff 100644
--- a/crates/jp_cli/src/cmd/query/interrupt/signals.rs
+++ b/crates/jp_cli/src/cmd/query/interrupt/signals.rs
@@ -82,6 +82,37 @@ pub fn handle_streaming_interrupt(
     config: &StreamingInterruptConfig,
     llm_stream_finished: bool,
 ) -> StreamingInterruptResult {
+    let action = decide_streaming_interrupt(
+        turn_coordinator,
+        printer,
+        backend,
+        editor,
+        edit_mode,
+        config,
+        llm_stream_finished,
+    );
+
+    apply_streaming_interrupt(action, turn_coordinator, conversation_stream)
+}
+
+/// Ask the user what an interrupt during LLM streaming should do.
+///
+/// Shows the menu when `config.action` is `prompt`, and otherwise resolves the
+/// configured action without asking.
+/// Decides only: nothing is committed to the conversation and the turn's phase
+/// does not move until the action reaches [`apply_streaming_interrupt`].
+///
+/// `llm_stream_finished` narrows the menu to what a dead stream can still
+/// offer.
+pub fn decide_streaming_interrupt(
+    turn_coordinator: &mut TurnCoordinator,
+    printer: &Printer,
+    backend: &dyn PromptBackend,
+    editor: Option<Arc<dyn EditorBackend>>,
+    edit_mode: ReplyEditMode,
+    config: &StreamingInterruptConfig,
+    llm_stream_finished: bool,
+) -> InterruptAction {
     info!("Interrupt received during streaming.");
 
     // Flush the renderer's markdown buffer to the printer queue, then drain
@@ -93,6 +124,26 @@ pub fn handle_streaming_interrupt(
     let action = InterruptHandler::with_backend(backend, editor, edit_mode)
         .handle_streaming_interrupt(config, printer, !llm_stream_finished);
 
+    debug!(
+        ?action,
+        llm_stream_finished, "Streaming interrupt resolved."
+    );
+
+    action
+}
+
+/// Apply an already-decided interrupt action to a streaming turn.
+///
+/// Commits partial assistant content, appends a reply, or moves the phase,
+/// depending on the action, and reports what the streaming loop should do next.
+///
+/// The action's source does not matter here: a menu choice and a command that
+/// arrived from a client are applied identically.
+pub fn apply_streaming_interrupt(
+    action: InterruptAction,
+    turn_coordinator: &mut TurnCoordinator,
+    conversation_stream: &mut ConversationStream,
+) -> StreamingInterruptResult {
     // `Resume` means "keep waiting for the current stream." The state
     // machine is a no-op for it, and we must NOT break the inner loop:
     // breaking drops the live `SelectAll` and forces a redundant new
@@ -100,10 +151,6 @@ pub fn handle_streaming_interrupt(
     // polling instead.
     let is_resume = matches!(action, InterruptAction::Resume);
     let is_escalate = matches!(action, InterruptAction::Escalate);
-    debug!(
-        ?action,
-        llm_stream_finished, "Streaming interrupt resolved."
-    );
 
     // A menu that never ran decided nothing, so the state machine is left
     // untouched: no partial commit, no phase change.
@@ -277,6 +324,46 @@ pub fn handle_tool_interrupt(
         .handle_tool_interrupt(config, printer);
     debug!(?action, "Tool interrupt resolved.");
 
+    apply_tool_interrupt(action, cancellation_token, turn_coordinator)
+}
+
+/// Restate an interrupt decided elsewhere in the terms tool execution acts on.
+///
+/// The two menus offer different verbs for the same intents, and only these
+/// ones mean anything while tools are running: a reply becomes the answer each
+/// cancelled tool gives back, which is what `[r] Stop & respond` does at the
+/// terminal, and stopping cancels them and ends the turn.
+#[must_use]
+pub fn as_tool_interrupt(action: InterruptAction) -> InterruptAction {
+    match action {
+        InterruptAction::Reply { content, .. } => InterruptAction::ToolCancelled {
+            response: Some(content),
+            exit: false,
+        },
+
+        // Abort discards the turn's uncommitted work, and cancelling the
+        // running tools is as much of that as this phase owns.
+        InterruptAction::Stop | InterruptAction::Abort => InterruptAction::ToolCancelled {
+            response: None,
+            exit: true,
+        },
+
+        other => other,
+    }
+}
+
+/// Apply an already-decided interrupt action to running tools.
+///
+/// Cancels the running tools where the action calls for it, and reports what
+/// the execution loop should do with the results.
+///
+/// The action's source does not matter here: a menu choice and a command that
+/// arrived from a client are applied identically.
+pub fn apply_tool_interrupt(
+    action: InterruptAction,
+    cancellation_token: &CancellationToken,
+    turn_coordinator: &mut TurnCoordinator,
+) -> ToolInterruptResult {
     // A menu that never ran decided nothing: the running tools are left alone
     // and the state machine is not notified.
     if matches!(action, InterruptAction::PromptFailed) {
diff --git a/crates/jp_cli/src/cmd/query/stream/retry.rs b/crates/jp_cli/src/cmd/query/stream/retry.rs
index 2d5db0f80..e5f0e8504 100644
--- a/crates/jp_cli/src/cmd/query/stream/retry.rs
+++ b/crates/jp_cli/src/cmd/query/stream/retry.rs
@@ -390,13 +390,8 @@ pub async fn handle_stream_error(
     // scope (stacked above the streaming handler for the duration of the
     // wait) catches the press, so the caller can show the interrupt menu
     // immediately instead of after the wait.
-    //
-    // Scoped to the conversation, because this is the handler being polled for
-    // the length of the backoff. An unscoped one would leave a targeted
-    // interrupt queued on the streaming handler instead, and a `Retry` outcome
-    // drops that receiver on its way out of the streaming loop.
     let delay = retry_state.backoff_duration(&error);
-    let (interrupt_guard, mut interrupt_rx) = signals.push_handler_for(conv.id());
+    let (interrupt_guard, mut interrupt_rx) = signals.push_handler();
     let notice = tokio::select! {
         biased;
         notice = interrupt_rx.recv() => notice,
diff --git a/crates/jp_cli/src/cmd/query/tool/coordinator.rs b/crates/jp_cli/src/cmd/query/tool/coordinator.rs
index 93f7ea56b..db303fab6 100644
--- a/crates/jp_cli/src/cmd/query/tool/coordinator.rs
+++ b/crates/jp_cli/src/cmd/query/tool/coordinator.rs
@@ -122,7 +122,12 @@ use super::{
 use crate::{
     Error,
     cmd::query::{
-        interrupt::signals::{ToolInterruptResult, handle_tool_interrupt},
+        interrupt::{
+            InterruptAction, TurnInterrupts,
+            signals::{
+                ToolInterruptResult, apply_tool_interrupt, as_tool_interrupt, handle_tool_interrupt,
+            },
+        },
         turn::{
             TurnCoordinator,
             state::{PermissionCacheKey, ToolAnswerCacheKey, TurnState},
@@ -132,11 +137,59 @@ use crate::{
     signals::{InterruptNotice, SignalRouter},
 };
 
+/// Fold a resolved tool interrupt into the execution loop's state.
+///
+/// The tools with no result yet are the ones a cancellation answers for, so
+/// they are collected as the interrupt lands rather than after the loop, where
+/// a result that arrived in between would have filled one in.
+fn record_tool_interrupt(
+    result: &ToolInterruptResult,
+    results: &[Option<ToolCallResponse>],
+    outcome: &mut ExecutionOutcome,
+    tools_cancelled: &mut bool,
+    cancellation_message: &mut Option<String>,
+    cancelled_indices: &mut Vec<usize>,
+) {
+    match result {
+        // Either the user chose to keep waiting, or the menu could not be shown
+        // and nothing happened. A declined press was already handed down the
+        // stack.
+        ToolInterruptResult::Continue
+        | ToolInterruptResult::PromptFailed
+        | ToolInterruptResult::Declined => {}
+
+        ToolInterruptResult::Restart => outcome.upgrade(ExecutionOutcome::Restart),
+
+        ToolInterruptResult::Cancelled { response, exit } => {
+            *cancelled_indices = results
+                .iter()
+                .enumerate()
+                .filter(|(_, r)| r.is_none())
+                .map(|(i, _)| i)
+                .collect();
+            *tools_cancelled = true;
+            *cancellation_message = response.clone();
+            if *exit {
+                outcome.upgrade(ExecutionOutcome::Stopped);
+            }
+        }
+
+        // The menu itself was cancelled with Ctrl-C: the tools are already
+        // cancelled; surface the escalation so the turn loop begins a graceful
+        // shutdown.
+        ToolInterruptResult::Escalate => outcome.upgrade(ExecutionOutcome::Escalated),
+    }
+}
+
 #[derive(Debug)]
 enum ExecutionEvent {
     /// A Ctrl-C press delivered to this execution phase's interrupt handler.
     Interrupt(InterruptNotice),
 
+    /// An interrupt from a client driving this turn from outside the process,
+    /// which arrives already decided because there was no menu to show.
+    ClientInterrupt(InterruptAction),
+
     ToolResult {
         index: usize,
         result: ExecutorResult,
@@ -953,6 +1006,7 @@ impl ToolCoordinator {
         root: &Utf8Path,
         tool_renderer: &mut ToolRenderer,
         interactive: bool,
+        interrupts: &mut TurnInterrupts,
     ) -> ExecutionResult {
         if executors.is_empty() {
             return ExecutionResult {
@@ -966,12 +1020,7 @@ impl ToolCoordinator {
         // Register the tool interrupt handler for this execution phase. While
         // registered, the first Ctrl-C press is delivered to this event loop;
         // the guard deregisters the handler when execution completes.
-        //
-        // Scoped to the conversation, so an interrupt that names one reaches the
-        // handler this loop is polling. Tool execution has no timeout of its
-        // own, so an unscoped handler here would leave a targeted interrupt
-        // waiting for the longest tool to finish.
-        let (interrupt_guard, mut interrupt_rx) = signals.push_handler_for(conv.id());
+        let (interrupt_guard, mut interrupt_rx) = signals.push_handler();
 
         // The caller's `index` values come from the execution plan and may
         // be sparse (e.g. when some tools in the same plan are
@@ -1060,7 +1109,18 @@ impl ToolCoordinator {
         let mut cancellation_message: Option<String> = None;
         let mut cancelled_indices: Vec<usize> = Vec::new();
 
-        while let Some(event) = event_rx.recv().await {
+        loop {
+            // A client's interrupt arrives on its own channel rather than
+            // through the router, so it is polled alongside the tools rather
+            // than forwarded by a task: the receiver belongs to the turn, and
+            // the turn outlives this phase.
+            let event = tokio::select! {
+                event = event_rx.recv() => event,
+                Some(action) = interrupts.next() => Some(ExecutionEvent::ClientInterrupt(action)),
+            };
+
+            let Some(event) = event else { break };
+
             match event {
                 ExecutionEvent::ToolResult { index, result } => {
                     let Some(tool) = executing_tools.get_mut(&index) else {
@@ -1265,39 +1325,37 @@ impl ToolCoordinator {
                             ToolInterruptResult::Escalate | ToolInterruptResult::PromptFailed => {}
                         }
 
-                        match result {
-                            // Either the user chose to keep waiting, or the menu
-                            // could not be shown and nothing happened. A
-                            // declined press was already handed down the stack.
-                            ToolInterruptResult::Continue
-                            | ToolInterruptResult::PromptFailed
-                            | ToolInterruptResult::Declined => {}
-                            ToolInterruptResult::Restart => {
-                                outcome.upgrade(ExecutionOutcome::Restart);
-                            }
-                            ToolInterruptResult::Cancelled { response, exit } => {
-                                cancelled_indices = results
-                                    .iter()
-                                    .enumerate()
-                                    .filter(|(_, r)| r.is_none())
-                                    .map(|(i, _)| i)
-                                    .collect();
-                                tools_cancelled = true;
-                                cancellation_message = response;
-                                if exit {
-                                    outcome.upgrade(ExecutionOutcome::Stopped);
-                                }
-                            }
-                            // The menu itself was cancelled with Ctrl-C: the
-                            // tools are already cancelled; surface the
-                            // escalation so the turn loop begins a graceful
-                            // shutdown.
-                            ToolInterruptResult::Escalate => {
-                                outcome.upgrade(ExecutionOutcome::Escalated);
-                            }
-                        }
+                        record_tool_interrupt(
+                            &result,
+                            &results,
+                            &mut outcome,
+                            &mut tools_cancelled,
+                            &mut cancellation_message,
+                            &mut cancelled_indices,
+                        );
                     }
                 }
+
+                ExecutionEvent::ClientInterrupt(action) => {
+                    // Applied even while a tool prompt is active, unlike a
+                    // Ctrl-C: the press competes with the prompt for the
+                    // terminal, and this does not. The prompt is cancelled
+                    // along with the tool that asked.
+                    let result = apply_tool_interrupt(
+                        as_tool_interrupt(action),
+                        &cancellation_token,
+                        turn_coordinator,
+                    );
+
+                    record_tool_interrupt(
+                        &result,
+                        &results,
+                        &mut outcome,
+                        &mut tools_cancelled,
+                        &mut cancellation_message,
+                        &mut cancelled_indices,
+                    );
+                }
             }
 
             if results.iter().all(Option::is_some) {
diff --git a/crates/jp_cli/src/cmd/query/turn/coordinator.rs b/crates/jp_cli/src/cmd/query/turn/coordinator.rs
index 6981d1227..474b26925 100644
--- a/crates/jp_cli/src/cmd/query/turn/coordinator.rs
+++ b/crates/jp_cli/src/cmd/query/turn/coordinator.rs
@@ -564,10 +564,7 @@ impl TurnCoordinator {
                 self.prepare_continuation();
             }
 
-            InterruptAction::Reply {
-                content,
-                from_editor,
-            } => {
+            InterruptAction::Reply { content, echo } => {
                 // Inject partial reasoning + message as assistant events first,
                 // before the user's reply, so the resumed model sees its own
                 // interrupted reasoning as context.
@@ -581,14 +578,12 @@ impl TurnCoordinator {
                     author: self.author.clone(),
                 };
 
-                // An editor-composed reply never appeared on the terminal, so
-                // echo it through the view (labeled user header + body), same
-                // as replay would emit for this `ChatRequest`. An
-                // inline-composed reply is already visible in scrollback on
-                // the widget's own line, so skip the echo — but still reset
-                // the assistant-header gate so the next assistant chunk
-                // prints a fresh `── jp …` header.
-                if from_editor {
+                // A reply the terminal never saw goes through the view
+                // (labeled user header + body), the same way replay would emit
+                // this `ChatRequest`. One that is already in scrollback is
+                // skipped — but the assistant-header gate still resets, so the
+                // next assistant chunk prints a fresh `── jp …` header.
+                if echo {
                     self.view.render_user_request(&request);
                 } else {
                     self.view.begin_turn();
diff --git a/crates/jp_cli/src/cmd/query/turn/coordinator_tests.rs b/crates/jp_cli/src/cmd/query/turn/coordinator_tests.rs
index 515c5a76e..9e518b6f3 100644
--- a/crates/jp_cli/src/cmd/query/turn/coordinator_tests.rs
+++ b/crates/jp_cli/src/cmd/query/turn/coordinator_tests.rs
@@ -800,12 +800,12 @@ fn interrupt_continue_before_first_chunk_emits_assistant_header_on_resume() {
     assert_eq!(*out.lock(), "hi there\n\n");
 }
 
-/// Regression: an editor-composed Reply interrupt inserts a new `ChatRequest`
-/// boundary whose text never appeared on the terminal, so live mode must echo
-/// it: a labeled user header AND a fresh assistant header for the following
-/// content, matching what replay renders for this `ChatRequest`.
+/// Regression: a Reply interrupt the terminal never saw inserts a new
+/// `ChatRequest` boundary that live mode must echo: a labeled user header AND a
+/// fresh assistant header for the following content, matching what replay
+/// renders for this `ChatRequest`.
 #[test]
-fn interrupt_reply_from_editor_renders_user_header_for_new_request() {
+fn an_unseen_interrupt_reply_renders_a_user_header_for_the_new_request() {
     let mut stream = ConversationStream::new_test();
     let (printer, _out, err) = Printer::memory(OutputFormat::Text);
     let printer = Arc::new(printer);
@@ -822,11 +822,12 @@ fn interrupt_reply_from_editor_renders_user_header_for_new_request() {
     // Some assistant content arrives so the assistant header is emitted.
     coordinator.handle_event(&mut stream, Event::message(0, "partial answer"));
 
-    // User interrupts with a follow-up reply composed in the external editor.
+    // User interrupts with a follow-up reply composed in the external editor,
+    // which took over the screen and gave it back with nothing rendered here.
     coordinator.handle_streaming_interrupt(
         InterruptAction::Reply {
             content: "actually, ignore that".into(),
-            from_editor: true,
+            echo: true,
         },
         &mut stream,
     );
@@ -878,7 +879,7 @@ fn interrupt_reply_inline_skips_user_header_but_resets_assistant_header() {
     coordinator.handle_streaming_interrupt(
         InterruptAction::Reply {
             content: "actually, ignore that".into(),
-            from_editor: false,
+            echo: false,
         },
         &mut stream,
     );
@@ -942,7 +943,7 @@ fn interrupt_reply_during_reasoning_preserves_partial_reasoning() {
     coordinator.handle_streaming_interrupt(
         InterruptAction::Reply {
             content: "actually, do X instead".into(),
-            from_editor: false,
+            echo: false,
         },
         &mut stream,
     );
diff --git a/crates/jp_cli/src/cmd/query/turn_loop.rs b/crates/jp_cli/src/cmd/query/turn_loop.rs
index 739ff2657..09b44ff62 100644
--- a/crates/jp_cli/src/cmd/query/turn_loop.rs
+++ b/crates/jp_cli/src/cmd/query/turn_loop.rs
@@ -47,8 +47,8 @@ use tracing::{debug, info, warn};
 use super::{
     PendingStreamTrim, build_sections, build_thread,
     interrupt::{
-        LoopAction, StreamingInterruptResult, handle_llm_event, handle_streaming_interrupt,
-        reply_edit_mode,
+        InterruptAction, LoopAction, StreamingInterruptResult, TurnInterrupts,
+        apply_streaming_interrupt, handle_llm_event, handle_streaming_interrupt, reply_edit_mode,
     },
     stream::{
         ResponseBoundary, StreamErrorOutcome, StreamRetryState, commit_partial_response,
@@ -77,6 +77,9 @@ enum StreamingLoopEvent {
     /// A Ctrl-C press delivered by the signal router, carried as the notice the
     /// loop resolves once it has decided what the press did.
     Interrupt(InterruptNotice),
+    /// An interrupt from a client driving this turn from outside the process,
+    /// which arrives already decided because there was no menu to show.
+    ClientInterrupt(InterruptAction),
     /// An event from the LLM provider stream.
     Llm(Box<Result<Event, StreamError>>),
 }
@@ -87,14 +90,16 @@ enum StreamingLoopEvent {
 /// [`StreamingLoopEvent`].
 /// This avoids boxing while allowing `select_all` to poll them as a single
 /// merged stream.
-enum StreamSource<S, L> {
+enum StreamSource<S, C, L> {
     Interrupt(S),
+    Client(C),
     Llm(L),
 }
 
-impl<S, L> Stream for StreamSource<S, L>
+impl<S, C, L> Stream for StreamSource<S, C, L>
 where
     S: Stream<Item = StreamingLoopEvent> + Unpin,
+    C: Stream<Item = StreamingLoopEvent> + Unpin,
     L: Stream<Item = StreamingLoopEvent> + Unpin,
 {
     type Item = StreamingLoopEvent;
@@ -102,6 +107,7 @@ where
     fn poll_next(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
         match self.get_mut() {
             Self::Interrupt(s) => Pin::new(s).poll_next(cx),
+            Self::Client(s) => Pin::new(s).poll_next(cx),
             Self::Llm(s) => Pin::new(s).poll_next(cx),
         }
     }
@@ -146,7 +152,7 @@ fn event_keeps_waiting_indicator(event: &StreamingLoopEvent) -> bool {
             result.as_ref(),
             Ok(Event::KeepAlive | Event::Patch(_) | Event::Flush { .. })
         ),
-        StreamingLoopEvent::Interrupt(_) => false,
+        StreamingLoopEvent::Interrupt(_) | StreamingLoopEvent::ClientInterrupt(_) => false,
     }
 }
 
@@ -188,6 +194,7 @@ pub(super) async fn run_turn_loop(
     invocation: InvocationContext,
     pending_trim: PendingStreamTrim,
     mut turn_interrupt: TurnInterrupt,
+    mut interrupts: TurnInterrupts,
 ) -> Result<(), Error> {
     // The turn-level interrupt handler (RFD 045) is the outermost handler scope
     // within the turn: it owns the gaps between phases (persistence, thread
@@ -270,6 +277,30 @@ pub(super) async fn run_turn_loop(
             notice.handled();
         }
 
+        // A client's interrupt that landed between phases is applied the same
+        // way the streaming loop applies one: a stop completes the turn, a
+        // reply becomes the next request.
+        //
+        // One per iteration, because applying one can end the turn, and
+        // whatever followed it was aimed at a turn that no longer exists.
+        //
+        // Not before the turn has started: a client can reach this turn from
+        // the moment it is registered, which is a little before its own request
+        // is appended, and a reply applied in that window would sit above the
+        // message it answers.
+        if turn_coordinator.current_phase() != TurnPhase::Idle
+            && let Some(action) = interrupts.try_next()
+        {
+            info!(?action, "Client interrupt received between turn phases.");
+            let result = lock.as_mut().update_events(|stream| {
+                apply_streaming_interrupt(action, &mut turn_coordinator, stream)
+            });
+
+            if result == StreamingInterruptResult::Abort {
+                return Ok(());
+            }
+        }
+
         match turn_coordinator.current_phase() {
             TurnPhase::Idle => {
                 // The turn-start commit point: any replay trim deferred while
@@ -325,15 +356,19 @@ pub(super) async fn run_turn_loop(
                 // set up is delivered as soon as the loop starts polling. The
                 // guard deregisters the handler when the cycle ends.
                 //
-                // Scoped like the turn-level handler above, and for the same
-                // reason: this is the handler being polled while a response
-                // streams, so an interrupt naming this conversation has to be
-                // able to reach it rather than wait for the phase to end.
-                let (interrupt_guard, interrupt_rx) = signals.push_handler_for(lock.id());
+                let (interrupt_guard, interrupt_rx) = signals.push_handler();
                 let interrupt_stream = StreamSource::Interrupt(
                     ReceiverStream::new(interrupt_rx).map(StreamingLoopEvent::Interrupt),
                 );
 
+                // Polled alongside the provider stream so a client's interrupt
+                // lands while the turn is streaming, rather than waiting for
+                // the phase to end on its own.
+                let client_stream = StreamSource::Client(
+                    stream::poll_fn(|cx| interrupts.poll_next(cx))
+                        .map(StreamingLoopEvent::ClientInterrupt),
+                );
+
                 let raw_stream = provider
                     .chat_completion_stream(model, query)
                     .await
@@ -381,7 +416,7 @@ pub(super) async fn run_turn_loop(
                 let mut received_provider_event = false;
 
                 let mut streams: SelectAll<_> =
-                    SelectAll::from_iter([interrupt_stream, llm_stream]);
+                    SelectAll::from_iter([interrupt_stream, client_stream, llm_stream]);
 
                 let mut conv = lock.as_mut();
 
@@ -445,6 +480,32 @@ pub(super) async fn run_turn_loop(
                             }
                         }
 
+                        StreamingLoopEvent::ClientInterrupt(action) => {
+                            // Nothing is about to prompt, but the partial
+                            // content this commits has to reach the terminal in
+                            // the order it was produced, which is what the menu
+                            // path flushes for too.
+                            turn_coordinator.flush_renderer();
+                            printer.flush_instant();
+
+                            info!(?action, "Client interrupt received during streaming.");
+
+                            let result = conv.update_events(|stream| {
+                                apply_streaming_interrupt(action, &mut turn_coordinator, stream)
+                            });
+
+                            match result {
+                                StreamingInterruptResult::Continue
+                                | StreamingInterruptResult::PromptFailed => {}
+                                StreamingInterruptResult::Break => break,
+                                StreamingInterruptResult::Abort => return Ok(()),
+                                StreamingInterruptResult::Escalate => {
+                                    signals.shutdown_token().cancel();
+                                    return Err(cmd::Error::interrupted().into());
+                                }
+                            }
+                        }
+
                         StreamingLoopEvent::Llm(event) => {
                             let event = *event;
 
@@ -861,6 +922,7 @@ pub(super) async fn run_turn_loop(
                         root,
                         &mut tool_renderer,
                         interactive,
+                        &mut interrupts,
                     )
                     .await;
 
diff --git a/crates/jp_cli/src/cmd/query/turn_loop_tests.rs b/crates/jp_cli/src/cmd/query/turn_loop_tests.rs
index f3dd7dae3..bc7ba3f52 100644
--- a/crates/jp_cli/src/cmd/query/turn_loop_tests.rs
+++ b/crates/jp_cli/src/cmd/query/turn_loop_tests.rs
@@ -321,6 +321,308 @@ impl Provider for StallingMockProvider {
     }
 }
 
+/// A provider that stalls on its first request and answers the next.
+///
+/// The stall is the window a mid-turn interrupt has to land in; the answer is
+/// how the test can tell the turn carried on rather than ending there.
+#[derive(Debug)]
+struct StallThenAnswerProvider {
+    /// Streamed before the first request parks.
+    partial: String,
+
+    /// The whole of the second request's response.
+    answer: String,
+
+    calls: AtomicUsize,
+    model: ModelDetails,
+
+    /// Notified on the first poll of the first request's pending tail.
+    stalled: Arc<Notify>,
+}
+
+impl StallThenAnswerProvider {
+    fn new(partial: &str, answer: &str, stalled: &Arc<Notify>) -> Self {
+        Self {
+            partial: partial.to_owned(),
+            answer: answer.to_owned(),
+            calls: AtomicUsize::new(0),
+            model: ModelDetails::empty(id::ModelIdConfig {
+                provider: ProviderId::Test,
+                name: "stall-then-answer".parse().expect("valid name"),
+            }),
+            stalled: Arc::clone(stalled),
+        }
+    }
+
+    /// How many requests the turn has sent.
+    fn calls(&self) -> usize {
+        self.calls.load(Ordering::SeqCst)
+    }
+}
+
+#[async_trait]
+impl Provider for StallThenAnswerProvider {
+    async fn model_details(&self, name: &id::Name) -> Result<ModelDetails, LlmError> {
+        let mut model = self.model.clone();
+        model.id.name = name.clone();
+        Ok(model)
+    }
+
+    async fn models(&self) -> Result<Vec<ModelDetails>, LlmError> {
+        Ok(vec![self.model.clone()])
+    }
+
+    async fn chat_completion_stream(
+        &self,
+        _model: &ModelDetails,
+        _query: ChatQuery,
+    ) -> Result<EventStream, LlmError> {
+        if self.calls.fetch_add(1, Ordering::SeqCst) > 0 {
+            let events = vec![
+                Event::message(0, &self.answer),
+                Event::flush(0),
+                Event::Finished(FinishReason::Completed),
+            ];
+
+            return Ok(Box::pin(stream::iter(events.into_iter().map(Ok))));
+        }
+
+        let events: Vec<Result<Event, StreamError>> =
+            vec![Ok(Event::message(0, &self.partial)), Ok(Event::flush(0))];
+
+        let stalled = Arc::clone(&self.stalled);
+        let mut notified = false;
+        let tail = stream::poll_fn(move |_| {
+            if !notified {
+                notified = true;
+                stalled.notify_one();
+            }
+            std::task::Poll::Pending
+        });
+
+        Ok(Box::pin(stream::iter(events).chain(tail)))
+    }
+}
+
+/// A reply from a client lands in the running turn and the turn carries on.
+///
+/// This is the Ctrl-C `[r] Reply` path reached without a keyboard: the partial
+/// answer is kept, the reply follows it, and the assistant answers it in the
+/// same turn rather than a second one.
+#[tokio::test(flavor = "multi_thread")]
+async fn a_client_reply_continues_the_running_turn() {
+    let test_result = Box::pin(timeout(Duration::from_secs(10), async {
+        let tmp = tempdir().unwrap();
+        let root = tmp.path();
+        let storage = root.join(".jp");
+
+        let config = AppConfig::new_test();
+        let fs = Arc::new(FsStorageBackend::new(&storage).expect("failed to create backend"));
+        let mut workspace = Workspace::in_memory(root).with_backend(fs.clone());
+
+        let lock = workspace
+            .create_and_lock_conversation(Conversation::default(), config.clone().into(), None)
+            .unwrap();
+        let conv_id = lock.id();
+
+        let stalled = Arc::new(Notify::new());
+        let provider = Arc::new(StallThenAnswerProvider::new(
+            "Let me start with Python.",
+            "Rust it is.",
+            &stalled,
+        ));
+        let model = provider
+            .model_details(&"test-model".parse().unwrap())
+            .await
+            .unwrap();
+
+        let (printer, _out, _err) = Printer::memory(OutputFormat::TextPretty);
+        let printer = Arc::new(printer);
+        let mcp_client = jp_mcp::Client::default();
+        let router = detached_router();
+
+        let (interrupt_tx, interrupts) = TurnInterrupts::channel();
+
+        // Sent once the first request has parked, which is the only window in
+        // which this is an interrupt rather than the next turn's question.
+        let reply_handle = tokio::spawn({
+            let stalled = Arc::clone(&stalled);
+            async move {
+                stalled.notified().await;
+                interrupt_tx
+                    .send(InterruptAction::Reply {
+                        content: "No, use Rust.".to_owned(),
+                        echo: true,
+                    })
+                    .await
+                    .expect("the turn is still running");
+            }
+        });
+
+        let result = run_turn_loop(
+            provider.clone() as Arc<dyn Provider>,
+            &model,
+            &config,
+            &router,
+            &mcp_client,
+            root,
+            false, // is_tty
+            &[],   // attachments
+            &lock,
+            ToolChoice::Auto,
+            &[], // tools
+            printer.clone(),
+            Arc::new(MockPromptBackend::new()),
+            ToolCoordinator::new(config.conversation.tools.clone(), empty_executor_source()),
+            ChatRequest::from("Which language?"),
+            InvocationContext::default(),
+            PendingStreamTrim::default(),
+            router.turn_interrupt(),
+            interrupts,
+        )
+        .await;
+
+        reply_handle.await.unwrap();
+        assert!(result.is_ok(), "the turn should complete: {result:?}");
+
+        assert_eq!(
+            provider.calls(),
+            2,
+            "the reply belongs to the turn that was interrupted, so it is asked again rather than \
+             left for a second turn"
+        );
+
+        let content = fs
+            .read_test_events_raw(&conv_id)
+            .expect("events should be persisted");
+
+        let question = content.find("Which language?").expect("the first request");
+        let partial = content
+            .find("Let me start with Python.")
+            .expect("the interrupted answer, kept");
+        let reply = content.find("No, use Rust.").expect("the reply");
+        let answer = content
+            .find("Rust it is.")
+            .expect("the answer to the reply");
+
+        assert!(
+            question < partial && partial < reply && reply < answer,
+            "the assistant's interrupted answer must precede the reply, so the model reads its \
+             own partial output as context.\nFile contents:\n{content}"
+        );
+
+        assert_eq!(
+            content.matches("turn_start").count(),
+            1,
+            "the reply belongs to the turn that was interrupted; a second `turn_start` would mean \
+             it started a new one.\nFile contents:\n{content}"
+        );
+    }))
+    .await;
+
+    assert!(test_result.is_ok(), "Test timed out after 10 seconds");
+}
+
+/// A stop from a client ends the turn where it is, mid-stream.
+///
+/// The provider parks after its first response and would never finish on its
+/// own, so a turn that ends at all is one the stop reached while it was
+/// streaming.
+#[tokio::test(flavor = "multi_thread")]
+async fn a_client_stop_ends_the_turn_mid_stream() {
+    let test_result = Box::pin(timeout(Duration::from_secs(10), async {
+        let tmp = tempdir().unwrap();
+        let root = tmp.path();
+        let storage = root.join(".jp");
+
+        let config = AppConfig::new_test();
+        let fs = Arc::new(FsStorageBackend::new(&storage).expect("failed to create backend"));
+        let mut workspace = Workspace::in_memory(root).with_backend(fs.clone());
+
+        let lock = workspace
+            .create_and_lock_conversation(Conversation::default(), config.clone().into(), None)
+            .unwrap();
+        let conv_id = lock.id();
+
+        let stalled = Arc::new(Notify::new());
+        let provider = Arc::new(StallThenAnswerProvider::new(
+            "Thinking about it.",
+            "never asked",
+            &stalled,
+        ));
+        let model = provider
+            .model_details(&"test-model".parse().unwrap())
+            .await
+            .unwrap();
+
+        let (printer, _out, _err) = Printer::memory(OutputFormat::TextPretty);
+        let printer = Arc::new(printer);
+        let mcp_client = jp_mcp::Client::default();
+        let router = detached_router();
+
+        let (interrupt_tx, interrupts) = TurnInterrupts::channel();
+
+        let stop_handle = tokio::spawn({
+            let stalled = Arc::clone(&stalled);
+            async move {
+                stalled.notified().await;
+                interrupt_tx
+                    .send(InterruptAction::Stop)
+                    .await
+                    .expect("the turn is still running");
+            }
+        });
+
+        let result = run_turn_loop(
+            provider.clone() as Arc<dyn Provider>,
+            &model,
+            &config,
+            &router,
+            &mcp_client,
+            root,
+            false, // is_tty
+            &[],   // attachments
+            &lock,
+            ToolChoice::Auto,
+            &[], // tools
+            printer.clone(),
+            Arc::new(MockPromptBackend::new()),
+            ToolCoordinator::new(config.conversation.tools.clone(), empty_executor_source()),
+            ChatRequest::from("What is 2+2?"),
+            InvocationContext::default(),
+            PendingStreamTrim::default(),
+            router.turn_interrupt(),
+            interrupts,
+        )
+        .await;
+
+        stop_handle.await.unwrap();
+        assert!(result.is_ok(), "the turn should complete: {result:?}");
+
+        assert_eq!(
+            provider.calls(),
+            1,
+            "a stop ends the turn, so nothing is asked again"
+        );
+
+        let content = fs
+            .read_test_events_raw(&conv_id)
+            .expect("events should be persisted");
+
+        assert!(
+            content.contains("Thinking about it."),
+            "what the assistant had produced is kept.\nFile contents:\n{content}"
+        );
+        assert!(
+            !content.contains("never asked"),
+            "the turn ended, so the provider was never asked again.\nFile contents:\n{content}"
+        );
+    }))
+    .await;
+
+    assert!(test_result.is_ok(), "Test timed out after 10 seconds");
+}
+
 #[tokio::test]
 async fn test_interrupt_stop_during_streaming_persists_content() {
     // A Ctrl-C press is routed to the streaming loop's registered interrupt
@@ -395,7 +697,8 @@ async fn test_interrupt_stop_during_streaming_persists_content() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -495,7 +798,8 @@ async fn a_completed_block_is_persisted_before_the_turn_ends() {
             ChatRequest::from("What is 2+2?"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -579,7 +883,8 @@ async fn a_refusal_takes_back_content_it_had_persisted() {
         ChatRequest::from("something declined"),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await
     .unwrap();
@@ -666,7 +971,8 @@ async fn test_streaming_interrupt_menu_cancel_escalates() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -750,7 +1056,8 @@ async fn test_normal_completion_persists_content() {
         chat_request.clone(),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await
     .unwrap();
@@ -836,7 +1143,8 @@ async fn premature_stream_end_without_finished_returns_error() {
             ChatRequest::from("hi"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         ),
     )
     .await
@@ -900,7 +1208,8 @@ async fn premature_stream_end_exhausts_retry_budget() {
             ChatRequest::from("hi"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         ),
     )
     .await
@@ -980,7 +1289,8 @@ async fn output_ceiling_ends_turn_without_re_requesting() {
             ChatRequest::from("hi"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         ),
     )
     .await
@@ -1085,7 +1395,8 @@ async fn orphan_tool_call_is_sanitized_before_provider_request() {
         ChatRequest::from("new query"),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await
     .unwrap();
@@ -1170,7 +1481,8 @@ async fn test_tool_call_cycle_completes_with_followup() {
         chat_request.clone(),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await;
 
@@ -1468,7 +1780,8 @@ async fn test_tool_interrupt_menu_cancel_escalates() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -1618,7 +1931,8 @@ async fn test_tool_stop_on_interrupt_commits_responses_without_follow_up() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -1761,7 +2075,8 @@ async fn test_interrupt_during_tool_prompt_completes_turn_early() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -1873,7 +2188,8 @@ async fn test_multiple_tool_calls_in_sequence() {
         chat_request.clone(),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await;
 
@@ -1964,7 +2280,8 @@ async fn test_empty_tool_response_continues_cycle() {
         chat_request.clone(),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await;
 
@@ -2110,7 +2427,8 @@ async fn test_tool_restart_on_interrupt() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -2232,7 +2550,8 @@ async fn test_merged_stream_exits_after_tool_response() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -2360,7 +2679,8 @@ async fn test_tool_call_with_run_mode_ask_approves() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -2503,7 +2823,8 @@ async fn test_tool_call_with_run_mode_ask_skips() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -2657,7 +2978,8 @@ async fn test_permission_prompt_follows_interactive_not_is_tty() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -2781,7 +3103,8 @@ async fn test_tool_call_with_run_mode_unattended() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -2929,7 +3252,8 @@ async fn test_tool_call_with_run_mode_skip() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -3133,7 +3457,8 @@ async fn test_multiple_tools_with_different_run_modes() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -3282,7 +3607,8 @@ async fn test_tool_call_returns_error() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -3518,7 +3844,8 @@ async fn test_waiting_indicator_shows_during_delay() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -3619,7 +3946,8 @@ async fn test_waiting_indicator_survives_keep_alive_and_shows_status() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -3734,7 +4062,8 @@ async fn test_waiting_indicator_cleared_before_retry_notice() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -3822,7 +4151,8 @@ async fn test_waiting_indicator_not_shown_when_disabled() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -3902,7 +4232,8 @@ async fn test_waiting_indicator_not_shown_for_non_tty() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -3983,7 +4314,8 @@ async fn test_waiting_indicator_follows_stderr_not_stdout() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -4169,7 +4501,8 @@ async fn test_multi_part_tool_call_shows_preparing_spinner() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -4257,7 +4590,8 @@ async fn test_turn_start_event_is_emitted() {
         chat_request.clone(),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await
     .unwrap();
@@ -4321,7 +4655,8 @@ async fn test_turn_start_index_increments_across_turns() {
         chat_request.clone(),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await
     .unwrap();
@@ -4357,7 +4692,8 @@ async fn test_turn_start_index_increments_across_turns() {
         chat_request.clone(),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await
     .unwrap();
@@ -4453,7 +4789,8 @@ async fn test_markdown_flushed_before_tool_header() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -4639,7 +4976,8 @@ async fn test_parallel_tool_calls_rendered_atomically() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -4799,7 +5137,8 @@ async fn test_single_tool_call_rendered_with_args() {
             chat_request.clone(),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -5046,7 +5385,8 @@ async fn a_running_tools_stderr_reaches_the_progress_window() {
             ChatRequest::from("Build it"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -5144,7 +5484,8 @@ async fn parallel_tools_label_their_window_rows() {
             ChatRequest::from("Run both"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -5266,7 +5607,8 @@ async fn a_tool_result_survives_a_live_window() {
             ChatRequest::from("Run both"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -5382,7 +5724,8 @@ async fn a_sink_survives_the_re_spawn_an_answer_triggers() {
             ChatRequest::from("Ask then work"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -5516,7 +5859,8 @@ async fn a_tool_can_opt_out_of_the_progress_window() {
             ChatRequest::from("Run both"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -5741,7 +6085,8 @@ async fn a_tool_prompt_hides_the_window_and_restores_it() {
             ChatRequest::from("Ask me"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -6237,7 +6582,8 @@ async fn test_tool_with_single_inquiry() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -6366,7 +6712,8 @@ async fn test_secret_question_without_tty_fails_tool() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -6476,7 +6823,8 @@ async fn test_secret_question_with_assistant_target_fails_tool() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -6579,7 +6927,8 @@ async fn test_secret_prompter_answer_is_redacted() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -6686,7 +7035,8 @@ async fn test_secret_static_answer_is_redacted() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -6794,7 +7144,8 @@ async fn test_static_answer_records_answered_inquiry() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -6910,7 +7261,8 @@ async fn test_remembered_answer_cache_hit_records_new_inquiry_pair() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -7033,7 +7385,8 @@ async fn test_tool_with_multiple_inquiries() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -7186,7 +7539,8 @@ async fn test_parallel_tools_one_with_inquiry() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -7325,7 +7679,8 @@ async fn test_parallel_tools_both_with_inquiries() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -7476,7 +7831,8 @@ async fn test_retry_counter_resets_on_successful_event() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -7616,7 +7972,8 @@ async fn test_unavailable_tool_before_approved_does_not_panic() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -7727,7 +8084,8 @@ async fn test_inquiry_failure_marks_tool_as_error() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -7922,7 +8280,8 @@ async fn test_live_header_uses_configured_model_id_not_provider_returned() {
             chat_request,
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await
         .unwrap();
@@ -8038,7 +8397,8 @@ async fn reasoning_before_a_tool_call_shades_the_tool_chrome() {
         ChatRequest::from("use the tool"),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await
     .unwrap();
@@ -8167,7 +8527,8 @@ async fn test_rebuild_cap_stops_a_provider_that_keeps_requesting_rebuilds() {
         ChatRequest::from("repair this"),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await;
 
@@ -8259,7 +8620,8 @@ async fn test_refused_rebuild_clears_the_retry_line() {
             ChatRequest::from("answer this"),
             InvocationContext::default(),
             PendingStreamTrim::default(),
-            router.turn_interrupt(lock.id()),
+            router.turn_interrupt(),
+            TurnInterrupts::none(),
         )
         .await;
 
@@ -8344,7 +8706,8 @@ async fn test_refused_rebuild_persists_streamed_content() {
         ChatRequest::from("answer this"),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await;
 
diff --git a/crates/jp_cli/src/cmd/query_tests.rs b/crates/jp_cli/src/cmd/query_tests.rs
index 71cee3596..9a2f71876 100644
--- a/crates/jp_cli/src/cmd/query_tests.rs
+++ b/crates/jp_cli/src/cmd/query_tests.rs
@@ -43,7 +43,7 @@ use crate::{
     cmd::target::{ConversationTarget, PickerFilter},
     config_pipeline::ConfigPipeline,
     resolve_config,
-    signals::testing::detached_router,
+    signals::testing::{detached_router, test_router},
 };
 
 fn make_partial_with_tools() -> PartialAppConfig {
@@ -331,7 +331,7 @@ async fn an_interrupt_during_mcp_startup_stops_the_turn_before_it_runs() {
     });
     let (mcp_servers, _lines) = startup_set(joins, vec![McpServerId::new("bookworm")]);
 
-    let router = detached_router();
+    let (router, signals) = test_router();
     let (printer, _out, _err) = Printer::memory(OutputFormat::TextPretty);
 
     let inputs = TurnInputs {
@@ -347,16 +347,17 @@ async fn an_interrupt_during_mcp_startup_stops_the_turn_before_it_runs() {
         workspace_id: workspace.id().clone(),
         pending_trim: PendingStreamTrim::default(),
         mcp_servers,
+        // Ctrl-C is how this turn is interrupted, and this test drives that
+        // through the router rather than over a channel.
+        interrupts: TurnInterrupts::none(),
     };
 
-    // Registered where the lock is taken, so the request reaches it even though
-    // the turn has not started. The notice waits on the channel until `run`
-    // polls it.
-    let interrupt = router.turn_interrupt(conversation_id);
-    assert!(
-        router.interrupt_scope(conversation_id),
-        "the handler exists as soon as the conversation is locked"
-    );
+    // Registered where the lock is taken, so the press reaches it even though
+    // the turn has not started. It is the only handler on the stack at this
+    // point, so it is the one a Ctrl-C finds, and the notice waits on the
+    // channel until `run` polls it.
+    let interrupt = router.turn_interrupt();
+    signals.interrupt().await;
 
     let stream = lock.events().clone();
     tokio::time::timeout(
@@ -408,7 +409,8 @@ async fn run_mock_turn(
         ChatRequest::from(prompt),
         InvocationContext::default(),
         PendingStreamTrim::default(),
-        router.turn_interrupt(lock.id()),
+        router.turn_interrupt(),
+        TurnInterrupts::none(),
     )
     .await
     .unwrap();
diff --git a/crates/jp_cli/src/signals.rs b/crates/jp_cli/src/signals.rs
index b76877fc8..82206216b 100644
--- a/crates/jp_cli/src/signals.rs
+++ b/crates/jp_cli/src/signals.rs
@@ -46,7 +46,6 @@ use std::{
 };
 
 use futures::{Stream, StreamExt as _};
-use jp_conversation::ConversationId;
 use tokio::{
     runtime::{Handle, Runtime},
     sync::mpsc::{self, error::TrySendError},
@@ -185,30 +184,17 @@ impl SignalRouter {
     /// fires, and resolves the notice with the outcome.
     #[must_use]
     pub fn push_handler(&self) -> (InterruptGuard, mpsc::Receiver<InterruptNotice>) {
-        self.inner.push_handler(None)
-    }
-
-    /// Register an interrupt handler scope that can also be interrupted by
-    /// name.
-    ///
-    /// Behaves as [`push_handler`] for a Ctrl-C, which still goes to whichever
-    /// handler is topmost.
-    /// The scope only matters to [`interrupt_scope`], for interrupts that
-    /// arrive from somewhere with no notion of "topmost".
-    ///
-    /// [`interrupt_scope`]: Self::interrupt_scope
-    /// [`push_handler`]: Self::push_handler
-    #[must_use]
-    pub fn push_handler_for(
-        &self,
-        conversation: ConversationId,
-    ) -> (InterruptGuard, mpsc::Receiver<InterruptNotice>) {
-        self.inner.push_handler(Some(conversation))
+        self.inner.push_handler()
     }
 
     /// Register the handler a turn is driven through, for as long as its
     /// conversation is locked.
     ///
+    /// Reached by a Ctrl-C the same way any other handler is, by being topmost.
+    /// An interrupt that names a conversation does not arrive here at all: it
+    /// reaches the turn over its own channel, carrying the action it has
+    /// already decided.
+    ///
     /// Registered by whoever takes the lock, so every span between taking it
     /// and releasing it reads the same receiver: waiting on MCP servers,
     /// looking up the model, and the turn itself.
@@ -216,30 +202,10 @@ impl SignalRouter {
     /// the rest of it — a press delivered to a receiver nobody polls again is
     /// reported as delivered and then dropped.
     #[must_use]
-    pub fn turn_interrupt(&self, conversation: ConversationId) -> TurnInterrupt {
-        let (guard, rx) = self.inner.push_handler(Some(conversation));
+    pub fn turn_interrupt(&self) -> TurnInterrupt {
+        let (guard, rx) = self.inner.push_handler();
         TurnInterrupt { _guard: guard, rx }
     }
-
-    /// Interrupt one named scope, leaving every other handler alone.
-    ///
-    /// For interrupts that arrive with a target rather than from a keyboard.
-    /// A Ctrl-C means "whatever I am looking at", and the topmost handler is
-    /// the right guess; a request naming a conversation means that
-    /// conversation, and with several turns running the topmost handler is very
-    /// likely the wrong one.
-    ///
-    /// Outside the escalation ladder: a repeat re-asks the same turn to stop.
-    /// A Ctrl-C escalates to cancelling the shutdown token and then to exiting
-    /// the process, neither of which a request naming one conversation should
-    /// reach.
-    ///
-    /// Returns whether the interrupt reached a handler for that scope.
-    /// `false` means nothing is registered for it, which usually means the turn
-    /// has already finished.
-    pub fn interrupt_scope(&self, conversation: ConversationId) -> bool {
-        self.inner.notify_scope(conversation)
-    }
 }
 
 /// The interrupt handler a turn is driven through.
@@ -288,13 +254,6 @@ pub struct InterruptNotice {
     /// with two turns in flight the stack interleaves, so "second from the top"
     /// is very likely a handler belonging to the other turn.
     from: HandlerId,
-
-    /// The conversation this press named, when it named one.
-    ///
-    /// A decline stays inside it.
-    /// `None` is a keypress, which belongs to whatever the user is looking at
-    /// and so declines down the whole stack.
-    scope: Option<ConversationId>,
 }
 
 impl fmt::Debug for InterruptNotice {
@@ -314,16 +273,13 @@ impl InterruptNotice {
 
     /// The handler declined this press.
     ///
-    /// Notifies the next handler below the one this press reached, skipping any
-    /// that belong to another conversation.
+    /// Notifies the next handler below the one this press reached.
     /// The press keeps its place on the escalation ladder: nothing has acted on
     /// it yet.
     ///
-    /// A keypress with nothing left below it requests a graceful shutdown.
-    /// A press that named a conversation does not: a request about one turn
-    /// must not be able to shut the process down.
+    /// With nothing left below it, the press requests a graceful shutdown.
     pub fn decline(self) {
-        self.inner.notify_below(self.from, self.scope);
+        self.inner.notify_below(self.from);
     }
 }
 
@@ -347,21 +303,6 @@ struct HandlerId(u64);
 struct RegisteredHandler {
     id: HandlerId,
 
-    /// The conversation this handler is a scope for, when something other than
-    /// a keypress might want to interrupt it specifically.
-    ///
-    /// A Ctrl-C is aimed at whatever the user is looking at, which is the
-    /// topmost handler, so the terminal path ignores this.
-    /// An interrupt arriving over a protocol names its target instead: several
-    /// turns can be running at once, and stopping the wrong one is worse than
-    /// stopping nothing.
-    ///
-    /// The id itself, not a rendering of it.
-    /// An id has more than one spelling, and comparing one spelling to another
-    /// matches nothing while looking exactly like a stop button that does not
-    /// work.
-    scope: Option<ConversationId>,
-
     /// Notifies the handler's event loop that SIGINT arrived.
     /// The event loop runs the interrupt logic; the router never does.
     notify_tx: mpsc::Sender<InterruptNotice>,
@@ -487,7 +428,7 @@ impl RouterInner {
         }
 
         if let Some((id, notify_tx)) = self.topmost() {
-            return match notify_tx.try_send(self.notice(id, None)) {
+            return match notify_tx.try_send(self.notice(id)) {
                 // A full channel means the handler already has a pending
                 // interrupt notification; nothing to add. The undelivered
                 // notice is dropped unresolved, leaving this press on the
@@ -518,14 +459,10 @@ impl RouterInner {
     }
 
     /// Build a notice for a press about to be delivered to `id`.
-    ///
-    /// `scope` is the conversation the press named, and bounds where a decline
-    /// may go next.
-    fn notice(self: &Arc<Self>, id: HandlerId, scope: Option<ConversationId>) -> InterruptNotice {
+    fn notice(self: &Arc<Self>, id: HandlerId) -> InterruptNotice {
         InterruptNotice {
             inner: Arc::clone(self),
             from: id,
-            scope,
         }
     }
 
@@ -540,20 +477,13 @@ impl RouterInner {
 
     /// Register a handler scope: push a fresh notification channel onto the
     /// stack and return the deregistration guard plus the receiver.
-    fn push_handler(
-        self: &Arc<Self>,
-        scope: Option<ConversationId>,
-    ) -> (InterruptGuard, mpsc::Receiver<InterruptNotice>) {
+    fn push_handler(self: &Arc<Self>) -> (InterruptGuard, mpsc::Receiver<InterruptNotice>) {
         let (notify_tx, notify_rx) = mpsc::channel(1);
         let id = HandlerId(self.next_handler_id.fetch_add(1, Ordering::Relaxed));
         self.stack
             .lock()
             .expect("handler stack lock poisoned")
-            .push(RegisteredHandler {
-                id,
-                scope,
-                notify_tx,
-            });
+            .push(RegisteredHandler { id, notify_tx });
 
         (
             InterruptGuard {
@@ -564,38 +494,6 @@ impl RouterInner {
         )
     }
 
-    /// Notify the handler registered for `scope`, if one still is.
-    ///
-    /// Searched from the top down, so the innermost handler for a conversation
-    /// is the one reached, matching how a Ctrl-C finds the innermost handler
-    /// overall.
-    ///
-    /// Returns whether anything was notified.
-    /// `false` means the scope has no handler, usually because its work already
-    /// finished, and is not an error: there was nothing left to interrupt.
-    fn notify_scope(self: &Arc<Self>, scope: ConversationId) -> bool {
-        let found = self
-            .stack
-            .lock()
-            .expect("handler stack lock poisoned")
-            .iter()
-            .rev()
-            .find(|handler| handler.scope == Some(scope))
-            .map(|handler| (handler.id, handler.notify_tx.clone()));
-
-        match found {
-            // A full channel means the handler already has a notice it has not
-            // picked up yet, so this one has nothing to add and is dropped
-            // unresolved. The handler has still been told, which is what the
-            // caller is asking about.
-            Some((id, tx)) => !matches!(
-                tx.try_send(self.notice(id, Some(scope))),
-                Err(TrySendError::Closed(_))
-            ),
-            None => false,
-        }
-    }
-
     /// Remove a handler by id.
     ///
     /// Id-based rather than positional so guards can drop in any order: early
@@ -607,18 +505,16 @@ impl RouterInner {
         }
     }
 
-    /// Notify the first handler below `from`, skipping any outside `scope`.
+    /// Notify the first handler below `from`.
     ///
     /// Walking from `from` rather than from the top of the stack is what keeps
     /// a decline inside the turn that declined: two turns in flight interleave
     /// their handlers, so the entry below the *topmost* one often belongs to
     /// the other turn.
     ///
-    /// With nothing left below, a keypress (`scope` of `None`) requests a
-    /// graceful shutdown, which is the terminal's escalation ladder.
-    /// A press that named a conversation stops instead: it asked about one
-    /// turn, and shutting the process down is not among the answers.
-    fn notify_below(self: &Arc<Self>, from: HandlerId, scope: Option<ConversationId>) {
+    /// With nothing left below, the press requests a graceful shutdown, which
+    /// is the last rung of the terminal's escalation ladder.
+    fn notify_below(self: &Arc<Self>, from: HandlerId) {
         let next = {
             let stack = self.stack.lock().expect("handler stack lock poisoned");
             stack
@@ -626,25 +522,22 @@ impl RouterInner {
                 .rev()
                 .skip_while(|handler| handler.id != from)
                 .skip(1)
-                .find(|handler| scope.is_none() || handler.scope == scope)
                 .map(|handler| (handler.id, handler.notify_tx.clone()))
+                .next()
         };
 
         let Some((id, notify_tx)) = next else {
-            if scope.is_none() {
-                self.shutdown_token.cancel();
-            }
+            self.shutdown_token.cancel();
             return;
         };
 
-        // A closed channel means that handler's event loop is already gone. For
-        // a keypress that leaves the ladder with nothing further to try, so it
-        // falls through to shutdown; a scoped press has nowhere else to go.
-        let closed = matches!(
-            notify_tx.try_send(self.notice(id, scope)),
+        // A closed channel means that handler's event loop is already gone,
+        // which leaves the ladder with nothing further to try, so it falls
+        // through to shutdown.
+        if matches!(
+            notify_tx.try_send(self.notice(id)),
             Err(TrySendError::Closed(_))
-        );
-        if closed && scope.is_none() {
+        ) {
             self.shutdown_token.cancel();
         }
     }
diff --git a/crates/jp_cli/src/signals_tests.rs b/crates/jp_cli/src/signals_tests.rs
index 37990c850..1a6ba75de 100644
--- a/crates/jp_cli/src/signals_tests.rs
+++ b/crates/jp_cli/src/signals_tests.rs
@@ -6,144 +6,7 @@ use super::*;
 
 /// Push a handler scope onto the router state.
 fn push_handler(inner: &Arc<RouterInner>) -> (InterruptGuard, mpsc::Receiver<InterruptNotice>) {
-    inner.push_handler(None)
-}
-
-/// A fixed conversation id, distinct per `secs`.
-fn conversation(secs: u64) -> ConversationId {
-    ConversationId::try_from(
-        chrono::DateTime::<chrono::Utc>::UNIX_EPOCH + Duration::from_secs(secs),
-    )
-    .unwrap()
-}
-
-/// A targeted interrupt reaches the named scope and nothing else.
-///
-/// The failure this guards against is stopping the wrong turn: with several
-/// running, the topmost handler is very likely not the one that was asked for.
-#[test]
-fn a_scoped_interrupt_notifies_only_its_own_scope() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-    let wanted = conversation(1_700_000_000);
-    let other = conversation(1_700_000_001);
-
-    let (_guard_wanted, mut rx_wanted) = inner.push_handler(Some(wanted));
-    // Pushed after, so it is topmost and would be the one a Ctrl-C reached.
-    let (_guard_other, mut rx_other) = inner.push_handler(Some(other));
-    let (_guard_plain, mut rx_plain) = push_handler(&inner);
-
-    assert!(inner.notify_scope(wanted));
-
-    assert!(took_notice(&mut rx_wanted));
-    assert_eq!(recv_error(&mut rx_other), Some(TryRecvError::Empty));
-    assert_eq!(recv_error(&mut rx_plain), Some(TryRecvError::Empty));
-}
-
-/// A turn registers a handler per phase under the same conversation, and the
-/// innermost one is the one being polled.
-///
-/// The outer turn-level handler is read only between phases, so reaching it
-/// while a response streams or a tool runs would leave a targeted interrupt
-/// waiting for that phase to finish.
-#[test]
-fn a_scoped_interrupt_reaches_the_innermost_handler_for_its_scope() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-    let id = conversation(1_700_000_000);
-
-    // The turn-level handler, then the one a streaming or executing phase adds.
-    let (_turn_guard, mut rx_turn) = inner.push_handler(Some(id));
-    let (phase_guard, mut rx_phase) = inner.push_handler(Some(id));
-
-    assert!(inner.notify_scope(id));
-
-    assert!(took_notice(&mut rx_phase));
-    assert_eq!(recv_error(&mut rx_turn), Some(TryRecvError::Empty));
-
-    // The phase ends, and the turn-level handler is innermost again.
-    drop(phase_guard);
-    assert!(inner.notify_scope(id));
-    assert!(took_notice(&mut rx_turn));
-}
-
-/// A repeat while the handler has not picked up the first one still counts as
-/// reached: the turn has been told, so reporting otherwise would read as "that
-/// conversation is not running".
-#[test]
-fn a_repeat_interrupt_with_one_still_pending_counts_as_reached() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-    let id = conversation(1_700_000_000);
-    let (_guard, mut rx) = inner.push_handler(Some(id));
-
-    // The channel holds one notice, so the second send finds it full.
-    assert!(inner.notify_scope(id));
-    assert!(inner.notify_scope(id));
-
-    assert!(took_notice(&mut rx));
-    assert_eq!(
-        recv_error(&mut rx),
-        Some(TryRecvError::Empty),
-        "the repeat added nothing to a handler that had not looked yet"
-    );
-}
-
-/// A scope whose handler's event loop is gone is not reached, even though its
-/// guard has not dropped yet.
-#[test]
-fn a_scope_whose_receiver_is_gone_is_not_reached() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-    let id = conversation(1_700_000_000);
-    let (_guard, rx) = inner.push_handler(Some(id));
-
-    drop(rx);
-
-    assert!(!inner.notify_scope(id));
-}
-
-/// A scope with no handler is not an error: its work already finished, so there
-/// was nothing left to interrupt.
-#[test]
-fn interrupting_an_unknown_scope_reports_that_nothing_was_reached() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-    let (_guard, mut rx) = push_handler(&inner);
-
-    assert!(!inner.notify_scope(conversation(1_700_000_000)));
-
-    assert_eq!(
-        recv_error(&mut rx),
-        Some(TryRecvError::Empty),
-        "an unscoped handler is not a fallback target"
-    );
-}
-
-/// A dropped guard takes its scope with it, so a later interrupt finds nothing
-/// rather than a stale channel.
-#[test]
-fn a_finished_scope_is_no_longer_reachable() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-    let id = conversation(1_700_000_000);
-
-    let (guard, _rx) = inner.push_handler(Some(id));
-    assert!(inner.notify_scope(id));
-
-    drop(guard);
-    assert!(!inner.notify_scope(id));
-}
-
-/// A Ctrl-C still goes to whichever handler is topmost, scoped or not.
-///
-/// The scope is extra information for targeted interrupts, not a change to how
-/// the keyboard path chooses.
-#[test]
-fn a_scope_does_not_change_where_a_keypress_lands() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-
-    let (_guard_bottom, mut rx_bottom) = inner.push_handler(Some(conversation(1_700_000_000)));
-    let (_guard_top, mut rx_top) = inner.push_handler(Some(conversation(1_700_000_001)));
-
-    assert_eq!(inner.route_interrupt(Instant::now()), Routed::Handler);
-
-    assert!(took_notice(&mut rx_top));
-    assert_eq!(recv_error(&mut rx_bottom), Some(TryRecvError::Empty));
+    inner.push_handler()
 }
 
 /// Take a delivered press off the channel and drop it unresolved.
@@ -359,7 +222,7 @@ fn decline_notifies_next_handler_down() {
     let (_guard_bottom, mut rx_bottom) = push_handler(&inner);
     let (guard_top, mut rx_top) = push_handler(&inner);
 
-    inner.notify_below(guard_top.id, None);
+    inner.notify_below(guard_top.id);
 
     assert!(took_notice(&mut rx_bottom));
     assert_eq!(recv_error(&mut rx_top), Some(TryRecvError::Empty));
@@ -371,66 +234,12 @@ fn decline_with_single_handler_requests_shutdown() {
     let inner = RouterInner::new(Duration::from_secs(2));
     let (guard, mut rx) = push_handler(&inner);
 
-    inner.notify_below(guard.id, None);
+    inner.notify_below(guard.id);
 
     assert_eq!(recv_error(&mut rx), Some(TryRecvError::Empty));
     assert!(inner.shutdown_token.is_cancelled());
 }
 
-/// A declined press walks down from the handler that declined it, not from the
-/// top of the stack.
-///
-/// Two turns in flight interleave their handlers, so the entry below the
-/// topmost one routinely belongs to the other turn.
-/// Declining A's press has to reach A's next handler, not whichever turn
-/// happens to be on top.
-#[test]
-fn a_decline_stays_inside_its_own_conversation() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-    let a = conversation(1_700_000_000);
-    let b = conversation(1_700_000_001);
-
-    // Turn A registers its turn-level and tool handlers, then turn B starts and
-    // pushes its own on top.
-    let (_a_turn, mut rx_a_turn) = inner.push_handler(Some(a));
-    let (a_tool_guard, mut rx_a_tool) = inner.push_handler(Some(a));
-    let (_b_turn, mut rx_b_turn) = inner.push_handler(Some(b));
-    let (_b_stream, mut rx_b_stream) = inner.push_handler(Some(b));
-
-    // A's tool handler declines the press it was given.
-    inner.notify_below(a_tool_guard.id, Some(a));
-
-    assert!(
-        took_notice(&mut rx_a_turn),
-        "the press belongs to A, so A's next handler answers it"
-    );
-    assert_eq!(recv_error(&mut rx_a_tool), Some(TryRecvError::Empty));
-    assert_eq!(
-        recv_error(&mut rx_b_turn),
-        Some(TryRecvError::Empty),
-        "B is topmost but the press was never about B"
-    );
-    assert_eq!(recv_error(&mut rx_b_stream), Some(TryRecvError::Empty));
-    assert!(!inner.shutdown_token.is_cancelled());
-}
-
-/// A scoped press that nothing below it can answer stops there.
-///
-/// A keypress escalates to shutdown at this point, which is right for someone
-/// at a terminal.
-/// A request naming one conversation must not be able to shut the process down.
-#[test]
-fn a_declined_scoped_press_does_not_request_shutdown() {
-    let inner = RouterInner::new(Duration::from_secs(2));
-    let id = conversation(1_700_000_000);
-    let (guard, mut rx) = inner.push_handler(Some(id));
-
-    inner.notify_below(guard.id, Some(id));
-
-    assert_eq!(recv_error(&mut rx), Some(TryRecvError::Empty));
-    assert!(!inner.shutdown_token.is_cancelled());
-}
-
 #[test]
 fn escalation_counter_bumps_and_resets() {
     let mut state = EscalationState::new(Duration::from_secs(2));
diff --git a/crates/jp_plugin/src/message.rs b/crates/jp_plugin/src/message.rs
index 22fdf8ada..e2e29d8e3 100644
--- a/crates/jp_plugin/src/message.rs
+++ b/crates/jp_plugin/src/message.rs
@@ -137,7 +137,7 @@ pub enum PluginToHost {
     /// Ask the host to run a turn on a conversation.
     Query(QueryRequest),
 
-    /// Ask the host to interrupt the turn running on a conversation.
+    /// Ask the host to change what a running turn is doing.
     Interrupt(InterruptRequest),
 
     /// Print user-facing output through JP's printer.
@@ -175,20 +175,102 @@ impl PluginToHost {
             Self::ArchiveConversation(m) | Self::ReadDraft(m) => m.id.as_deref(),
             Self::SetTitle(m) => m.id.as_deref(),
             Self::WriteDraft(m) => m.id.as_deref(),
+            Self::Interrupt(m) => m.id.as_deref(),
 
             // Not requests: nothing is waiting on an answer to any of these.
-            Self::Ready(_)
-            | Self::Interrupt(_)
-            | Self::Print(_)
-            | Self::Log(_)
-            | Self::Describe(_)
-            | Self::Exit(_) => None,
+            Self::Ready(_) | Self::Print(_) | Self::Log(_) | Self::Describe(_) | Self::Exit(_) => {
+                None
+            }
         }
     }
 }
 
 // --- Host-to-Plugin messages ---
 
+/// How the host renders what it prints.
+///
+/// A plugin reads this to decide the shape of its own output, so `jp --format
+/// json` reaches a plugin's listings the way it reaches the host's own commands
+/// and a caller does not have to learn a separate flag per plugin.
+#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum OutputFormat {
+    /// Plain text, with no ANSI colors and no unicode decoration.
+    #[default]
+    Text,
+
+    /// Text with ANSI colors and unicode decoration.
+    TextPretty,
+
+    /// Compact JSON, one line per print.
+    Json,
+
+    /// Indented JSON.
+    JsonPretty,
+}
+
+impl OutputFormat {
+    /// Whether output should be machine-readable.
+    #[must_use]
+    pub const fn is_json(self) -> bool {
+        matches!(self, Self::Json | Self::JsonPretty)
+    }
+
+    /// Whether JSON output should be indented.
+    #[must_use]
+    pub const fn is_json_pretty(self) -> bool {
+        matches!(self, Self::JsonPretty)
+    }
+
+    /// Whether text output can carry ANSI colors and unicode decoration.
+    #[must_use]
+    pub const fn is_pretty(self) -> bool {
+        matches!(self, Self::TextPretty)
+    }
+}
+
+/// Who holds a conversation.
+///
+/// A conversation is locked for the length of a turn, so this says whether one
+/// is running, and whether it is the reader's to interrupt.
+/// A turn in another process can be waited for but not signalled from here.
+#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum LockState {
+    /// Nobody.
+    /// No turn is running.
+    #[default]
+    Free,
+
+    /// A turn in another process.
+    Elsewhere,
+
+    /// A turn in the host answering this request.
+    Here,
+}
+
+impl LockState {
+    /// Whether no turn is running.
+    ///
+    /// Takes a reference because `skip_serializing_if` calls it with one.
+    #[must_use]
+    pub const fn is_free(&self) -> bool {
+        matches!(self, Self::Free)
+    }
+
+    /// Whether a turn is running, wherever it is.
+    #[must_use]
+    pub const fn is_held(&self) -> bool {
+        !self.is_free()
+    }
+
+    /// Whether the running turn can be interrupted through this connection.
+    #[must_use]
+    pub const fn is_here(&self) -> bool {
+        matches!(self, Self::Here)
+    }
+}
+
 /// The `init` message sent to the plugin on startup.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub struct InitMessage {
@@ -227,6 +309,18 @@ pub struct InitMessage {
     /// that stderr output matches the host's `-v` flags.
     #[serde(default)]
     pub log_level: u8,
+
+    /// The shape the host's own output takes, resolved from `--format`.
+    ///
+    /// A plugin that prints listings or records should match it, so one flag
+    /// governs the whole invocation.
+    ///
+    /// Reads as [`OutputFormat::Text`] when the host is old enough not to send
+    /// it, which is the shape plugins printed before they could ask.
+    /// That fallback is why this needs no protocol version of its own: there is
+    /// nothing a plugin has to refuse to run without.
+    #[serde(default)]
+    pub output_format: OutputFormat,
 }
 
 /// Workspace metadata included in the `init` message.
@@ -283,6 +377,21 @@ pub struct EventsResponse {
     /// The conversation ID.
     pub conversation: String,
 
+    /// Who holds this conversation, if anyone.
+    ///
+    /// Read from the conversation lock, which is the only authoritative answer:
+    /// a transcript ending in a request looks identical whether a turn is
+    /// running, was interrupted, or failed outright.
+    #[serde(default, skip_serializing_if = "LockState::is_free")]
+    pub lock: LockState,
+
+    /// The conversation's title, if it has one.
+    ///
+    /// Saves a plugin from asking for the whole conversation list to label one
+    /// conversation, which reads every conversation's metadata.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+
     /// Serialized conversation events.
     pub data: Vec<Value>,
 }
@@ -426,27 +535,105 @@ pub struct QueryRequest {
     pub cfg: Vec<String>,
 }
 
-/// Ask the host to interrupt the turn running on a conversation.
+/// Ask the host to change what a running turn is doing.
 ///
-/// Reaches the turn the way a Ctrl-C does, so it asks the turn to wrap up:
-/// partial output is kept and the conversation is left in a state a later turn
-/// can continue from.
+/// Reaches the turn the way the terminal's Ctrl-C menu does, with the choice
+/// already made: `stop` keeps what the assistant has produced and ends the
+/// turn, `abort` discards it, and `reply` interrupts the assistant and answers
+/// it without leaving the turn.
 ///
 /// A repeat re-asks the same turn.
 /// It does not escalate the way a terminal's second and third Ctrl-C do, since
 /// cancelling the host's shutdown token or exiting the process is not something
 /// a request naming one conversation should reach.
 ///
-/// Fire-and-forget: the host sends no acknowledgement, because what the
-/// interrupt did shows up in the conversation itself.
-/// The outcome of the turn still arrives as the reply to the original `query`.
+/// Answered with [`HostToPlugin::Done`] when `id` is set, and with
+/// [`HostToPlugin::Error`] when there is no turn left to reach — which is how
+/// a client tells "interrupted" from "it had already finished" without guessing
+/// from a timeout.
+/// Without an `id` it stays fire-and-forget.
+/// The outcome of the turn itself still arrives as the reply to the original
+/// `query`.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub struct InterruptRequest {
-    /// The conversation whose turn should stop.
+    /// Optional request correlation ID.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+
+    /// The conversation whose turn to reach.
     ///
     /// Required, and not a convenience: a host can be running several turns at
     /// once, so there is no "the" turn to infer.
     pub conversation: String,
+
+    /// What the turn should do.
+    ///
+    /// Defaults to `stop`.
+    #[serde(default)]
+    pub action: InterruptAction,
+
+    /// What to say to the assistant, for `reply`.
+    ///
+    /// Required by `reply` and ignored by every other action.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub content: Option<String>,
+}
+
+impl InterruptRequest {
+    /// Stop the turn running on `conversation`.
+    #[must_use]
+    pub fn stop(conversation: String) -> Self {
+        Self {
+            id: None,
+            conversation,
+            action: InterruptAction::Stop,
+            content: None,
+        }
+    }
+
+    /// Interrupt the turn running on `conversation` and answer it with
+    /// `content`.
+    #[must_use]
+    pub fn reply(conversation: String, content: String) -> Self {
+        Self {
+            id: None,
+            conversation,
+            action: InterruptAction::Reply,
+            content: Some(content),
+        }
+    }
+
+    /// Correlate the answer to this request with `id`.
+    #[must_use]
+    pub fn with_id(mut self, id: String) -> Self {
+        self.id = Some(id);
+        self
+    }
+}
+
+/// What an interrupt asks a running turn to do.
+#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum InterruptAction {
+    /// Keep what the assistant has produced so far and end the turn.
+    ///
+    /// What a terminal user gets from `[s] Stop`.
+    #[default]
+    Stop,
+
+    /// End the turn, discarding what the assistant produced since the last
+    /// persisted boundary.
+    ///
+    /// What a terminal user gets from `[a] Abort`.
+    Abort,
+
+    /// Interrupt the assistant and answer it, staying in the same turn.
+    ///
+    /// What the assistant had produced so far is kept as context, `content`
+    /// follows it as the user's next message, and the turn continues from
+    /// there.
+    /// What a terminal user gets from `[r] Reply`.
+    Reply,
 }
 
 /// Response to `query`, sent once the turn has finished.
diff --git a/crates/jp_plugin/src/message_tests.rs b/crates/jp_plugin/src/message_tests.rs
index 1e213f52a..065eb9d3a 100644
--- a/crates/jp_plugin/src/message_tests.rs
+++ b/crates/jp_plugin/src/message_tests.rs
@@ -21,6 +21,7 @@ fn host_init_roundtrip() {
         options: Map::from_iter([("port".to_owned(), json!(8080))]),
         args: vec!["--web".to_owned()],
         log_level: 0,
+        output_format: OutputFormat::JsonPretty,
     });
 
     let json = serde_json::to_string(&msg).unwrap();
diff --git a/crates/jp_plugin/src/protocol.rs b/crates/jp_plugin/src/protocol.rs
index 9d4df5292..63b45baa5 100644
--- a/crates/jp_plugin/src/protocol.rs
+++ b/crates/jp_plugin/src/protocol.rs
@@ -16,7 +16,9 @@ use crate::message::{ExitMessage, ReadyMessage};
 /// | 5       | `list_configs`, naming the configurations a query can select.   |
 /// | 6       | `query`, with `created` and `query_complete` in reply.          |
 /// | 7       | `interrupt`, for stopping a turn the host is running.           |
-pub const PROTOCOL_VERSION: u32 = 7;
+/// | 8       | `lock` on `events`, saying whether a turn is running.           |
+/// | 9       | `action` on `interrupt`, and an answer when it carries an `id`. |
+pub const PROTOCOL_VERSION: u32 = 9;
 
 /// Answer a host's `init`, refusing it when it is too old to serve this plugin.
 ///
diff --git a/crates/jp_task/src/task/title_generator.rs b/crates/jp_task/src/task/title_generator.rs
index e54c97d1f..c263c841a 100644
--- a/crates/jp_task/src/task/title_generator.rs
+++ b/crates/jp_task/src/task/title_generator.rs
@@ -56,6 +56,16 @@ impl TitleGeneratorTask {
         })
     }
 
+    /// Ask the model for a title and return it.
+    ///
+    /// For a caller that already holds the conversation lock and can write the
+    /// title itself.
+    /// Returns `None` when the model answered without a usable title.
+    pub async fn generate(mut self) -> Result<Option<String>, Box<dyn Error + Send + Sync>> {
+        self.update_title().await?;
+        Ok(self.title)
+    }
+
     async fn update_title(&mut self) -> Result<(), Box<dyn Error + Send + Sync>> {
         trace!(conversation_id = %self.conversation_id, "Updating conversation title.");
 
diff --git a/crates/plugins/command/gui/src/main_tests.rs b/crates/plugins/command/gui/src/main_tests.rs
index e8cc34395..b2bfe26a7 100644
--- a/crates/plugins/command/gui/src/main_tests.rs
+++ b/crates/plugins/command/gui/src/main_tests.rs
@@ -1,6 +1,6 @@
 use std::{cell::RefCell, env, io::Cursor};
 
-use jp_plugin::message::{PathsInfo, ReadyMessage, WorkspaceInfo};
+use jp_plugin::message::{OutputFormat, PathsInfo, ReadyMessage, WorkspaceInfo};
 use pretty_assertions::assert_eq;
 
 use super::*;
@@ -48,6 +48,7 @@ fn init_message(root: &str, args: &[&str]) -> String {
         options: serde_json::Map::new(),
         args: args.iter().map(|a| (*a).to_owned()).collect(),
         log_level: 0,
+        output_format: OutputFormat::default(),
     };
 
     format!(
diff --git a/crates/plugins/command/serve-web/Cargo.toml b/crates/plugins/command/serve-web/Cargo.toml
index bc959e27a..810e11516 100644
--- a/crates/plugins/command/serve-web/Cargo.toml
+++ b/crates/plugins/command/serve-web/Cargo.toml
@@ -2,7 +2,7 @@
 name = "jp-serve-web"
 
 authors.workspace = true
-description = "Read-only web UI for browsing JP conversations."
+description = "Web UI for browsing JP conversations and continuing them."
 documentation.workspace = true
 edition.workspace = true
 homepage.workspace = true
@@ -15,16 +15,24 @@ version.workspace = true
 [dependencies]
 jp_plugin = { workspace = true }
 
-axum = { workspace = true, features = ["http1", "tokio"] }
+axum = { workspace = true, features = ["form", "http1", "json", "query", "tokio"] }
 chrono = { workspace = true }
 comrak = { workspace = true }
+form_urlencoded = { workspace = true }
 maud = { workspace = true, features = ["axum"] }
+serde = { workspace = true, features = ["derive", "std"] }
 serde_json = { workspace = true, features = ["std"] }
 sha2 = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true, features = ["ansi", "env-filter", "fmt", "std"] }
 
+[build-dependencies]
+oxc_allocator = { workspace = true }
+oxc_parser = { workspace = true }
+oxc_semantic = { workspace = true }
+oxc_span = { workspace = true }
+
 [dev-dependencies]
 pretty_assertions = { workspace = true, features = ["std"] }
 tracing = { workspace = true, features = ["std"] }
@@ -35,7 +43,7 @@ workspace = true
 [package.metadata.jp-registry]
 id = "serve-web"
 command = ["serve", "web"]
-description = "Read-only web UI for browsing conversations"
+description = "Web UI for browsing conversations and continuing them"
 official = true
 requires = ["serve"]
 repository = "https://github.com/dcdpr/jp"
diff --git a/crates/plugins/command/serve-web/README.md b/crates/plugins/command/serve-web/README.md
new file mode 100644
index 000000000..f98f770e5
--- /dev/null
+++ b/crates/plugins/command/serve-web/README.md
@@ -0,0 +1,150 @@
+# jp-serve-web
+
+A command plugin that serves JP conversations over HTTP, and lets you continue
+them from a browser.
+
+Run it with `jp serve-web`.
+The server is read-write: it renders the transcript, takes a message from a
+composer, and asks the host to run the turn.
+
+```sh
+jp serve-web --bind 127.0.0.1 --port 3000
+```
+
+## What it does and does not own
+
+The plugin is a presentation layer.
+It never talks to a model, holds a credential, executes a tool, or writes to a
+conversation.
+Everything it shows it asked the host for, and every turn it starts the host
+runs.
+
+That split is the reason the protocol exists.
+A plugin that ran its own agent loop would need the user's API keys, the tool
+registry, the MCP servers, and a second copy of the turn loop to keep in step
+with the first.
+
+| Concern                     | Owner  |
+| --------------------------- | ------ |
+| Rendering, routing, styling | Plugin |
+| Conversation storage        | Host   |
+| Config resolution           | Host   |
+| Model calls and tool runs   | Host   |
+| Interrupting a turn         | Host   |
+
+## Protocol
+
+Needs protocol 9 (`REQUIRED_PROTOCOL`).
+The host refuses an older pairing at the handshake rather than failing later, so
+a stale `jp` alongside a fresh plugin is an error message and not a mystery.
+
+| Message                | Direction | Used for                                           |
+| ---------------------- | --------- | -------------------------------------------------- |
+| `list_conversations`   | → host    | The conversation index                             |
+| `read_events`          | → host    | One conversation's transcript, title and lock      |
+| `list_configs`         | → host    | The configurations a message can name              |
+| `query`                | → host    | Start a turn, or start a conversation              |
+| `created`              | ← host    | The id of a conversation just created              |
+| `query_complete`       | ← host    | That turn finished                                 |
+| `interrupt`            | → host    | Stop a named turn, or answer one without ending it |
+| `read_draft`           | → host    | The message being composed, as the CLI stores it   |
+| `write_draft`          | → host    | Save it back, conditional on a revision            |
+| `archive_conversation` | → host    | Move one conversation to the archive               |
+| `set_title`            | → host    | Rename one conversation                            |
+
+Starting a conversation is answered twice: `created` as soon as there is
+somewhere to send the reader, and `query_complete` when the first turn ends.
+The client registers both waiters before sending, because a turn that finishes
+quickly would otherwise arrive before anything was listening for it.
+
+## How the page stays current
+
+There is no push channel yet, so the page polls `/conversations/{id}/messages`
+every second while a turn is running and every three when it isn't.
+The page says how much of the transcript it holds and how far back its copy is
+provisional; the answer carries only the part it does not have, or drew in a
+form that has since changed, so a tick that brings nothing new costs one small
+response and no re-render.
+
+That second half is what a tool call needs.
+A call is drawn when it is requested and gains its result later, so the entry on
+the page is not final when it first appears — and by the time the result lands,
+the server's own boundary has moved on to the next call still waiting.
+Only the page knows how far back to ask from, so it is the page that says.
+
+A boundary is not enough for the newest entry, though, so while a turn is
+running that one is re-sent on every tick if it is one that can still change.
+A run of assistant text is rendered as one block that the next flush adds to,
+and it sits at the end — nothing after it is provisional and the count does not
+move, so neither the boundary nor the page's own floor reaches back for it.
+An entry that is finished the moment it appears, such as the request itself, is
+not re-sent; waiting for the first token is the longest stretch of a turn, and
+nothing changes on the page during it.
+
+The host re-reads the conversation from disk on each request, which means a turn
+you started in a terminal shows up in the browser too, without a restart.
+
+Sending while a turn is running interrupts the assistant and answers it, inside
+the turn that was already going: what it had produced is kept, the message
+follows it, and it carries on from there.
+This is Ctrl-C then `[r] Reply` at a terminal, and the conversation is never
+unlocked in between, so there is no window in which the message could be refused.
+
+Events arrive in batches rather than token by token: the turn loop persists at
+each streaming boundary, so a page sees a complete assistant response or tool
+call at a time.
+Per-token updates need the host to push, which is future work.
+
+Everything on the page works without JavaScript except the polling.
+The composer and the stop button are plain form posts, and the transcript is
+server-rendered.
+
+## Endpoints
+
+| Path                            | Method | Purpose                          |
+| ------------------------------- | ------ | -------------------------------- |
+| `/conversations`                | GET    | Index                            |
+| `/conversations/{id}`           | GET    | Transcript and composer          |
+| `/conversations/{id}/turn`      | POST   | Send a message                   |
+| `/conversations/{id}/messages`  | GET    | Transcript as JSON, for the poll |
+| `/conversations/{id}/interrupt` | POST   | Stop the running turn            |
+| `/configs`                      | GET    | The configuration chooser        |
+| `/status`                       | GET    | Whether a turn is in flight      |
+
+The chooser offers the configurations on the load paths by name, and rows for
+setting a value directly.
+Both reach the host as `--cfg` arguments, the typed values last, so one of those
+overrides the same key set by a configuration chosen beside it.
+
+`/configs` answers with markup rather than data.
+The new-conversation form offers the same chooser, and rendering it in one place
+is what keeps the two grouping, labelling and posting the choices alike.
+
+`/status` exists for whoever supervises the process: restarting to pick up a new
+build aborts a turn in flight, so a supervisor polls it and waits for `busy` to
+go false.
+
+## Security
+
+No authentication, and every conversation in the workspace is readable.
+Anyone who can reach the port can also start a turn, which spends tokens and
+runs whatever tools the conversation allows.
+
+Binding to a non-loopback address hands that to the network.
+The plugin warns on startup when you do.
+
+Writing requests are refused when they come from a page on another origin, which
+is checked from `Sec-Fetch-Site` and `Origin`.
+Loopback is no defence on its own here: a form post is not subject to a
+preflight, so any site a browser visits can submit one to `127.0.0.1` and start
+a turn, and the same-origin policy only stops it reading the answer.
+A request that carries neither header — `curl`, a script, another tool — is
+allowed, since no browser can be made to omit both.
+
+## Development
+
+A file watcher that restarts on save can't be used here: a turn started from the
+browser runs inside the host process the plugin is attached to, so restarting on
+save aborts whatever the assistant was in the middle of — including the
+assistant editing these files.
+Poll `/status` and restart only once `busy` is false.
diff --git a/crates/plugins/command/serve-web/build.rs b/crates/plugins/command/serve-web/build.rs
new file mode 100644
index 000000000..265ca93b5
--- /dev/null
+++ b/crates/plugins/command/serve-web/build.rs
@@ -0,0 +1,75 @@
+//! Fails the build when an embedded script cannot run.
+//!
+//! The scripts are served verbatim inside `<script>` tags and are otherwise
+//! opaque to the toolchain: a syntax error or a duplicate declaration compiles
+//! perfectly well and only shows up as a blank page in a browser console.
+
+use std::{fs, process};
+
+use oxc_allocator::Allocator;
+use oxc_parser::Parser;
+use oxc_semantic::SemanticBuilder;
+use oxc_span::SourceType;
+
+/// The scripts each page loads, in the order its `<script>` tags appear.
+///
+/// Grouped per page rather than checked one file at a time because classic
+/// scripts share a single global lexical scope.
+/// A `const` in one collides with the same name in the next, and neither file
+/// is wrong on its own.
+const PAGES: &[&[&str]] = &[
+    &["src/views/configs.js", "src/views/new.js"],
+    &["src/views/configs.js", "src/views/detail.js"],
+    &["src/views/list.js", "src/views/filter.js"],
+];
+
+fn main() {
+    let mut failed = false;
+
+    for page in PAGES {
+        let mut source = String::new();
+        for path in *page {
+            println!("cargo::rerun-if-changed={path}");
+
+            let text = fs::read_to_string(path)
+                .unwrap_or_else(|error| panic!("cannot read {path}: {error}"));
+            source.push_str(&text);
+            source.push('\n');
+        }
+
+        for problem in check(&source) {
+            // One line per directive, so a multi-line diagnostic is flattened.
+            let problem = problem.replace('\n', " ");
+            println!("cargo::error={}: {problem}", page.join(" + "));
+            failed = true;
+        }
+    }
+
+    if failed {
+        process::exit(1);
+    }
+}
+
+/// Parse as a classic script and apply the spec's early-error rules.
+fn check(source: &str) -> Vec<String> {
+    let allocator = Allocator::default();
+
+    // Script rather than module, which is what a `<script>` tag runs. Module
+    // mode implies strict mode and would reject things a page may legitimately
+    // do.
+    let parsed = Parser::new(&allocator, source, SourceType::cjs()).parse();
+
+    if !parsed.diagnostics.is_empty() {
+        return parsed.diagnostics.iter().map(ToString::to_string).collect();
+    }
+
+    // The parser deliberately leaves redeclarations and the rest of the early
+    // errors to the semantic pass, so grammar alone is not enough.
+    SemanticBuilder::new()
+        .with_check_syntax_error(true)
+        .build(&parsed.program)
+        .diagnostics
+        .iter()
+        .map(ToString::to_string)
+        .collect()
+}
diff --git a/crates/plugins/command/serve-web/src/client.rs b/crates/plugins/command/serve-web/src/client.rs
index ce99bd975..3f0a814ec 100644
--- a/crates/plugins/command/serve-web/src/client.rs
+++ b/crates/plugins/command/serve-web/src/client.rs
@@ -5,7 +5,7 @@
 //! Thread-safe and shareable across axum handlers via `Arc`.
 
 use std::{
-    collections::HashMap,
+    collections::{HashMap, VecDeque},
     io::{BufRead, Write},
     sync::{
         Arc, Mutex,
@@ -16,8 +16,9 @@ use std::{
 };
 
 use jp_plugin::message::{
-    ConversationSummary, EventsResponse, ExitMessage, HostToPlugin, OptionalId, PluginToHost,
-    ReadEventsRequest,
+    ConfigEntry, ConversationRequest, ConversationSummary, DraftResponse, EventsResponse,
+    ExitMessage, HostToPlugin, InterruptRequest, OptionalId, PluginToHost, QueryRequest,
+    ReadEventsRequest, SetTitleRequest, WriteDraftRequest,
 };
 use tokio::sync::{oneshot, watch};
 use tracing::{debug, error, trace, warn};
@@ -40,9 +41,47 @@ pub struct PluginClient {
     inner: Arc<Inner>,
 }
 
+/// The still-running turn a newly created conversation was started with.
+///
+/// Held by whoever needs to know when that turn ends — which is not the
+/// request that created the conversation, since it returned as soon as there
+/// was somewhere to send the reader.
+pub struct TurnOutcome {
+    rx: oneshot::Receiver<HostToPlugin>,
+}
+
+impl TurnOutcome {
+    /// Wait for the turn to finish.
+    ///
+    /// Takes as long as the turn does, which is however long the assistant
+    /// takes: an agent loop that calls tools between thoughts can run for the
+    /// better part of an hour.
+    /// Waits without a deadline for that reason.
+    /// The wait is already bounded by the connection — the reader drops every
+    /// waiter when the host's stdout closes — so a deadline here could only
+    /// report a failure for a turn that is still running, and the host would go
+    /// on holding the conversation after this said it had stopped.
+    pub async fn finished(self) -> Result<(), ClientError> {
+        match self.rx.await {
+            Ok(HostToPlugin::QueryComplete(_)) => Ok(()),
+            Ok(HostToPlugin::Error(e)) => Err(ClientError::Host(e.message)),
+            Ok(other) => Err(ClientError::Unexpected(format!("{other:?}"))),
+            Err(_) => Err(ClientError::ChannelClosed),
+        }
+    }
+}
+
 struct Inner {
     writer: SharedWriter,
-    pending: Mutex<HashMap<String, oneshot::Sender<HostToPlugin>>>,
+
+    /// Waiters per request, in the order their replies are expected.
+    ///
+    /// A queue rather than one waiter, because a request can be answered more
+    /// than once: starting a conversation is told the id as soon as it exists
+    /// and told again when its first turn ends.
+    /// Both waiters are registered before the request goes out, so a turn that
+    /// finishes quickly cannot arrive before anything is listening for it.
+    pending: Mutex<HashMap<String, VecDeque<oneshot::Sender<HostToPlugin>>>>,
     next_id: AtomicU64,
 }
 
@@ -103,6 +142,223 @@ impl PluginClient {
         }
     }
 
+    /// Ask the host to run a turn on a conversation.
+    ///
+    /// Returns once the turn has finished and its events are persisted; read
+    /// them back with [`Self::read_events`].
+    /// The host owns the agent loop, so this resolves the model, calls the
+    /// provider, and runs tools without the plugin seeing any of it.
+    ///
+    /// Waits without a deadline, for the reason [`TurnOutcome::finished`]
+    /// gives.
+    pub async fn query(
+        &self,
+        conversation: &str,
+        content: &str,
+        cfg: Vec<String>,
+    ) -> Result<(), ClientError> {
+        let id = self.next_id();
+        let msg = PluginToHost::Query(QueryRequest {
+            new: false,
+            title: None,
+            cfg,
+            id: Some(id.clone()),
+            conversation: conversation.to_owned(),
+            content: content.to_owned(),
+        });
+
+        match self.request_within(&id, &msg, None).await? {
+            HostToPlugin::QueryComplete(_) => Ok(()),
+            HostToPlugin::Error(e) => Err(ClientError::Host(e.message)),
+            other => Err(ClientError::Unexpected(format!("{other:?}"))),
+        }
+    }
+
+    /// List the configurations a new conversation can be started with.
+    pub async fn list_configs(&self) -> Result<Vec<ConfigEntry>, ClientError> {
+        let id = self.next_id();
+        let msg = PluginToHost::ListConfigs(OptionalId {
+            id: Some(id.clone()),
+        });
+
+        match self.request(&id, &msg).await? {
+            HostToPlugin::Configs(resp) => Ok(resp.data),
+            HostToPlugin::Error(e) => Err(ClientError::Host(e.message)),
+            other => Err(ClientError::Unexpected(format!("{other:?}"))),
+        }
+    }
+
+    /// Start a conversation and set its first turn running.
+    ///
+    /// Returns the id the host gave it, which is the only place that id exists:
+    /// the conversation did not exist when the request was sent.
+    ///
+    /// Returns as soon as the conversation exists, not when the turn finishes.
+    /// The turn's progress is in the conversation's events, which is where a
+    /// reader sent to it will be looking anyway.
+    pub async fn start_conversation(
+        &self,
+        content: &str,
+        title: Option<String>,
+        cfg: Vec<String>,
+    ) -> Result<(String, TurnOutcome), ClientError> {
+        let id = self.next_id();
+        let msg = PluginToHost::Query(QueryRequest {
+            id: Some(id.clone()),
+            conversation: String::new(),
+            content: content.to_owned(),
+            new: true,
+            title,
+            cfg,
+        });
+
+        // Both waiters before the request goes out. Registering the second one
+        // after the first reply arrives would race a turn that finished in between,
+        // and a lost completion leaves the conversation marked busy forever.
+        let created = self.register(&id);
+        let finished = self.register(&id);
+
+        if let Err(error) = self.send(&msg) {
+            self.forget(&id);
+            return Err(error);
+        }
+
+        // The default timeout, not the turn's: the host answers as soon as the
+        // conversation exists, without waiting for its first turn.
+        let conversation = match tokio::time::timeout(REQUEST_TIMEOUT, created).await {
+            Ok(Ok(HostToPlugin::Created(resp))) => resp.conversation,
+            Ok(Ok(HostToPlugin::Error(e))) => {
+                self.forget(&id);
+                return Err(ClientError::Host(e.message));
+            }
+            Ok(Ok(other)) => {
+                self.forget(&id);
+                return Err(ClientError::Unexpected(format!("{other:?}")));
+            }
+            Ok(Err(_)) => {
+                self.forget(&id);
+                return Err(ClientError::ChannelClosed);
+            }
+            Err(_) => {
+                self.forget(&id);
+                return Err(ClientError::Timeout);
+            }
+        };
+
+        Ok((conversation, TurnOutcome { rx: finished }))
+    }
+
+    /// Move a conversation to the archive.
+    pub async fn archive(&self, conversation: &str) -> Result<(), ClientError> {
+        let id = self.next_id();
+        let msg = PluginToHost::ArchiveConversation(ConversationRequest {
+            id: Some(id.clone()),
+            conversation: conversation.to_owned(),
+        });
+
+        self.done(&id, &msg).await
+    }
+
+    /// Rename a conversation.
+    /// An empty title clears it.
+    pub async fn set_title(&self, conversation: &str, title: &str) -> Result<(), ClientError> {
+        let id = self.next_id();
+        let msg = PluginToHost::SetTitle(SetTitleRequest {
+            id: Some(id.clone()),
+            conversation: conversation.to_owned(),
+            title: Some(title.to_owned()),
+        });
+
+        self.done(&id, &msg).await
+    }
+
+    /// Send a request whose only answer is whether it worked.
+    async fn done(&self, id: &str, msg: &PluginToHost) -> Result<(), ClientError> {
+        match self.request(id, msg).await? {
+            HostToPlugin::Done(_) => Ok(()),
+            HostToPlugin::Error(e) => Err(ClientError::Host(e.message)),
+            other => Err(ClientError::Unexpected(format!("{other:?}"))),
+        }
+    }
+
+    /// Read a conversation's query draft.
+    pub async fn read_draft(&self, conversation: &str) -> Result<DraftResponse, ClientError> {
+        let id = self.next_id();
+        let msg = PluginToHost::ReadDraft(ConversationRequest {
+            id: Some(id.clone()),
+            conversation: conversation.to_owned(),
+        });
+
+        match self.request(&id, &msg).await? {
+            HostToPlugin::Draft(resp) => Ok(resp),
+            HostToPlugin::Error(e) => Err(ClientError::Host(e.message)),
+            other => Err(ClientError::Unexpected(format!("{other:?}"))),
+        }
+    }
+
+    /// Replace a conversation's query draft, if it still matches `revision`.
+    ///
+    /// A refusal comes back as a [`DraftResponse`] with `conflict` set and the
+    /// current draft attached, rather than as an error: the caller needs the
+    /// other side's text to do anything sensible about it.
+    pub async fn write_draft(
+        &self,
+        conversation: &str,
+        content: &str,
+        revision: Option<String>,
+    ) -> Result<DraftResponse, ClientError> {
+        let id = self.next_id();
+        let msg = PluginToHost::WriteDraft(WriteDraftRequest {
+            id: Some(id.clone()),
+            conversation: conversation.to_owned(),
+            content: content.to_owned(),
+            revision,
+        });
+
+        match self.request(&id, &msg).await? {
+            HostToPlugin::Draft(resp) => Ok(resp),
+            HostToPlugin::Error(e) => Err(ClientError::Host(e.message)),
+            other => Err(ClientError::Unexpected(format!("{other:?}"))),
+        }
+    }
+
+    /// Ask the host to stop the turn it is running.
+    ///
+    /// Returns as soon as the request is on the wire.
+    /// There is no reply to wait for: the interrupt lands in the conversation,
+    /// and the turn's own outcome still arrives as the answer to the `query`
+    /// that started it.
+    pub fn interrupt(&self, conversation: &str) -> Result<(), ClientError> {
+        self.send(&PluginToHost::Interrupt(InterruptRequest::stop(
+            conversation.to_owned(),
+        )))
+    }
+
+    /// Interrupt the turn the host is running and answer it with `content`.
+    ///
+    /// The assistant stops where it is, what it had produced is kept, and
+    /// `content` becomes the next thing it reads — all within the turn that
+    /// was already running, so the conversation is never unlocked in between.
+    ///
+    /// Awaited rather than fired off, because the answer is the difference
+    /// between a delivered reply and one aimed at a turn that had just
+    /// finished.
+    /// An `Err` means the message was not delivered and the caller still owns
+    /// it.
+    pub async fn reply(&self, conversation: &str, content: &str) -> Result<(), ClientError> {
+        let id = self.next_id();
+        let msg = PluginToHost::Interrupt(
+            InterruptRequest::reply(conversation.to_owned(), content.to_owned())
+                .with_id(id.clone()),
+        );
+
+        match self.request(&id, &msg).await? {
+            HostToPlugin::Done(_) => Ok(()),
+            HostToPlugin::Error(e) => Err(ClientError::Host(e.message)),
+            other => Err(ClientError::Unexpected(format!("{other:?}"))),
+        }
+    }
+
     /// Register a request, send it, and await the matching response.
     ///
     /// Removes the pending entry on a transport failure (send error or timeout)
@@ -111,10 +367,20 @@ impl PluginClient {
     /// leaves nothing to remove, so the cleanup here targets only the
     /// transport-error paths.
     async fn request(&self, id: &str, msg: &PluginToHost) -> Result<HostToPlugin, ClientError> {
+        self.request_within(id, msg, Some(REQUEST_TIMEOUT)).await
+    }
+
+    /// [`Self::request`], with a deadline of the caller's choosing, or none.
+    async fn request_within(
+        &self,
+        id: &str,
+        msg: &PluginToHost,
+        timeout: Option<Duration>,
+    ) -> Result<HostToPlugin, ClientError> {
         let rx = self.register(id);
 
         let result = match self.send(msg) {
-            Ok(()) => await_response(rx).await,
+            Ok(()) => await_response(rx, timeout).await,
             Err(e) => Err(e),
         };
 
@@ -147,10 +413,21 @@ impl PluginClient {
             .pending
             .lock()
             .expect("pending lock poisoned")
-            .insert(id.to_owned(), tx);
+            .entry(id.to_owned())
+            .or_default()
+            .push_back(tx);
         rx
     }
 
+    /// Drop every waiter for a request that will never be answered again.
+    fn forget(&self, id: &str) {
+        self.inner
+            .pending
+            .lock()
+            .expect("pending lock poisoned")
+            .remove(id);
+    }
+
     fn send(&self, msg: &PluginToHost) -> Result<(), ClientError> {
         let json = serde_json::to_string(msg).map_err(|e| ClientError::Protocol(e.to_string()))?;
         let mut writer = self.inner.writer.lock().expect("writer lock poisoned");
@@ -178,8 +455,19 @@ pub enum ClientError {
 
 /// Await a pending response, failing with [`ClientError`] on a closed channel
 /// or timeout instead of blocking forever.
-async fn await_response(rx: oneshot::Receiver<HostToPlugin>) -> Result<HostToPlugin, ClientError> {
-    tokio::time::timeout(REQUEST_TIMEOUT, rx)
+///
+/// Without a timeout the wait ends only with the answer or with the host: the
+/// reader drops every waiter when stdout closes, which resolves this as
+/// [`ClientError::ChannelClosed`].
+async fn await_response(
+    rx: oneshot::Receiver<HostToPlugin>,
+    timeout: Option<Duration>,
+) -> Result<HostToPlugin, ClientError> {
+    let Some(timeout) = timeout else {
+        return rx.await.map_err(|_| ClientError::ChannelClosed);
+    };
+
+    tokio::time::timeout(timeout, rx)
         .await
         .map_err(|_| ClientError::Timeout)?
         .map_err(|_| ClientError::ChannelClosed)
@@ -227,6 +515,11 @@ fn reader_loop(reader: impl BufRead, inner: &Inner, shutdown_tx: &watch::Sender<
             HostToPlugin::Conversations(r) => r.id.clone(),
             HostToPlugin::Events(r) => r.id.clone(),
             HostToPlugin::Config(r) => r.id.clone(),
+            HostToPlugin::QueryComplete(r) => r.id.clone(),
+            HostToPlugin::Configs(r) => r.id.clone(),
+            HostToPlugin::Created(r) => r.id.clone(),
+            HostToPlugin::Done(r) => r.id.clone(),
+            HostToPlugin::Draft(r) => r.id.clone(),
             HostToPlugin::Error(r) => r.id.clone(),
             _ => None,
         };
@@ -237,25 +530,21 @@ fn reader_loop(reader: impl BufRead, inner: &Inner, shutdown_tx: &watch::Sender<
                 let _ = shutdown_tx.send(true);
             }
 
-            HostToPlugin::Init(_) | HostToPlugin::Describe => {
+            // `Composed` answers a `Compose` request, which this plugin never
+            // sends: it serves HTTP and has no prompts to raise.
+            HostToPlugin::Init(_) | HostToPlugin::Describe | HostToPlugin::Composed(_) => {
                 warn!("Unexpected message after startup");
             }
 
-            // This plugin only reads, so neither of these answers a request it
-            // sent: they belong to something that isn't ours.
-            HostToPlugin::Composed(_)
-            | HostToPlugin::Done(_)
-            | HostToPlugin::Draft(_)
-            | HostToPlugin::Configs(_)
-            | HostToPlugin::QueryComplete(_)
-            | HostToPlugin::Created(_) => {
-                warn!(?msg, "Received a response to a request we never sent");
-            }
-
             // Response messages — dispatch to the pending request.
             msg @ (HostToPlugin::Conversations(_)
             | HostToPlugin::Events(_)
             | HostToPlugin::Config(_)
+            | HostToPlugin::QueryComplete(_)
+            | HostToPlugin::Configs(_)
+            | HostToPlugin::Created(_)
+            | HostToPlugin::Done(_)
+            | HostToPlugin::Draft(_)
             | HostToPlugin::Error(_)) => {
                 dispatch(&inner.pending, req_id.as_deref(), msg);
             }
@@ -273,7 +562,7 @@ fn reader_loop(reader: impl BufRead, inner: &Inner, shutdown_tx: &watch::Sender<
 
 /// Dispatch a response to the pending request with the given ID.
 fn dispatch(
-    pending: &Mutex<HashMap<String, oneshot::Sender<HostToPlugin>>>,
+    pending: &Mutex<HashMap<String, VecDeque<oneshot::Sender<HostToPlugin>>>>,
     id: Option<&str>,
     msg: HostToPlugin,
 ) {
@@ -282,7 +571,16 @@ fn dispatch(
         return;
     };
 
-    let tx = pending.lock().expect("pending lock poisoned").remove(id);
+    // Taken in order, and the entry removed once its last waiter is served, so an
+    // id that expects one reply behaves exactly as it did before.
+    let tx = {
+        let mut pending = pending.lock().expect("pending lock poisoned");
+        let tx = pending.get_mut(id).and_then(VecDeque::pop_front);
+        if pending.get(id).is_some_and(VecDeque::is_empty) {
+            pending.remove(id);
+        }
+        tx
+    };
 
     match tx {
         Some(tx) => {
diff --git a/crates/plugins/command/serve-web/src/client_tests.rs b/crates/plugins/command/serve-web/src/client_tests.rs
index ad6e17cd2..b04cce5cc 100644
--- a/crates/plugins/command/serve-web/src/client_tests.rs
+++ b/crates/plugins/command/serve-web/src/client_tests.rs
@@ -29,6 +29,36 @@ fn channel_client() -> (PluginClient, std::sync::mpsc::Sender<u8>) {
     (client, tx)
 }
 
+/// A writer whose bytes stay readable, for asserting what reached the host.
+#[derive(Clone)]
+struct Recorder(Arc<Mutex<Vec<u8>>>);
+
+impl Recorder {
+    fn written(&self) -> String {
+        String::from_utf8(self.0.lock().unwrap().clone()).unwrap()
+    }
+}
+
+impl std::io::Write for Recorder {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        self.0.lock().unwrap().write(buf)
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+/// [`channel_client`], keeping what the client sends.
+fn recording_client() -> (PluginClient, std::sync::mpsc::Sender<u8>, Recorder) {
+    let (tx, rx) = std::sync::mpsc::channel::<u8>();
+    let stdin = BufReader::new(BlockingReader { rx });
+    let recorder = Recorder(Arc::new(Mutex::new(Vec::new())));
+    let writer: SharedWriter = Arc::new(Mutex::new(Box::new(recorder.clone())));
+    let (client, _shutdown) = PluginClient::start(stdin, writer);
+    (client, tx, recorder)
+}
+
 /// Deliver `line` to the reader once `client` has a pending request, so the
 /// response is dispatched to a waiting receiver rather than dropped.
 fn feed_after_register(client: &PluginClient, tx: std::sync::mpsc::Sender<u8>, line: String) {
@@ -43,6 +73,99 @@ fn feed_after_register(client: &PluginClient, tx: std::sync::mpsc::Sender<u8>, l
     });
 }
 
+/// Two replies to one request reach two waiters, in the order they registered.
+///
+/// Starting a conversation is answered twice: once with the id as soon as it
+/// exists, and again when its first turn ends.
+/// The second reply is what clears the turn from the busy map, so a dispatcher
+/// that served only the first would leave the conversation marked running for
+/// the life of the process.
+#[tokio::test]
+async fn two_replies_to_one_request_reach_both_waiters() {
+    let (client, _tx) = channel_client();
+
+    let first = client.register("7");
+    let second = client.register("7");
+
+    dispatch(
+        &client.inner.pending,
+        Some("7"),
+        HostToPlugin::Created(CreatedResponse {
+            id: Some("7".to_owned()),
+            conversation: "jp-c1".to_owned(),
+        }),
+    );
+    dispatch(
+        &client.inner.pending,
+        Some("7"),
+        HostToPlugin::QueryComplete(QueryCompleteResponse {
+            id: Some("7".to_owned()),
+            conversation: "jp-c1".to_owned(),
+        }),
+    );
+
+    assert!(
+        matches!(first.await, Ok(HostToPlugin::Created(_))),
+        "the first waiter gets the first reply"
+    );
+    assert!(
+        matches!(second.await, Ok(HostToPlugin::QueryComplete(_))),
+        "the second waiter gets the second, rather than the first being served twice or the \
+         second being dropped"
+    );
+
+    assert!(
+        client.inner.pending.lock().unwrap().is_empty(),
+        "the request is forgotten once its last waiter is served"
+    );
+}
+
+/// One waiter still behaves as it always did.
+///
+/// The queue is only there for requests answered more than once; every other
+/// request registers one waiter and must be cleaned up by the reply that serves
+/// it, not left behind for a second that never comes.
+#[tokio::test]
+async fn a_single_reply_still_clears_its_request() {
+    let (client, _tx) = channel_client();
+
+    let only = client.register("3");
+
+    dispatch(
+        &client.inner.pending,
+        Some("3"),
+        HostToPlugin::QueryComplete(QueryCompleteResponse {
+            id: Some("3".to_owned()),
+            conversation: "jp-c1".to_owned(),
+        }),
+    );
+
+    assert!(matches!(only.await, Ok(HostToPlugin::QueryComplete(_))));
+    assert!(
+        client.inner.pending.lock().unwrap().is_empty(),
+        "a request with one waiter is forgotten when that waiter is served"
+    );
+}
+
+/// Abandoning a request drops every waiter it registered.
+///
+/// The error paths in `start_conversation` register two and may bail after the
+/// first; leaving the second behind would keep a sender alive for a reply that
+/// is never coming.
+#[tokio::test]
+async fn forgetting_a_request_drops_all_of_its_waiters() {
+    let (client, _tx) = channel_client();
+
+    let first = client.register("9");
+    let second = client.register("9");
+
+    client.forget("9");
+
+    assert!(client.inner.pending.lock().unwrap().is_empty());
+    assert!(first.await.is_err(), "a dropped sender closes its channel");
+    assert!(second.await.is_err());
+}
+
 #[tokio::test]
 async fn list_conversations_roundtrip() {
     let response = HostToPlugin::Conversations(ConversationsResponse {
@@ -68,6 +191,8 @@ async fn list_conversations_roundtrip() {
 #[tokio::test]
 async fn read_events_roundtrip() {
     let response = HostToPlugin::Events(EventsResponse {
+        lock: jp_plugin::message::LockState::Free,
+        title: None,
         id: Some("1".to_owned()),
         conversation: "456".to_owned(),
         data: vec![json!({"type": "turn_start", "timestamp": "2025-01-01T00:00:00Z"})],
@@ -96,6 +221,66 @@ async fn host_error_propagated() {
     assert!(matches!(err, ClientError::Host(msg) if msg.contains("something went wrong")));
 }
 
+/// Sending to a busy conversation asks the host to interrupt the turn and
+/// answer it, rather than to start a second one.
+///
+/// Asserted as the exact line on the wire, because this is the contract with
+/// the host: an `action` an older host does not read leaves the turn stopped
+/// and the message discarded.
+#[tokio::test]
+async fn a_reply_is_sent_as_an_interrupt_carrying_the_message() {
+    let (client, tx, sent) = recording_client();
+    feed_after_register(
+        &client,
+        tx,
+        format!(
+            "{}\n",
+            host_line(&HostToPlugin::Done(DoneResponse {
+                id: Some("1".to_owned()),
+            }))
+        ),
+    );
+
+    client
+        .reply("jp-c17000000000", "use Rust instead")
+        .await
+        .unwrap();
+
+    let expected = r#"{"type":"interrupt","id":"1","conversation":"jp-c17000000000","action":"reply","content":"use Rust instead"}"#;
+
+    assert_eq!(sent.written(), format!("{expected}\n"));
+}
+
+/// A host with no turn left to interrupt says so, and the caller still owns the
+/// message.
+#[tokio::test]
+async fn a_reply_to_a_finished_turn_reports_the_hosts_reason() {
+    let (client, tx, _sent) = recording_client();
+    feed_after_register(
+        &client,
+        tx,
+        format!(
+            "{}\n",
+            host_line(&HostToPlugin::Error(ErrorResponse {
+                id: Some("1".to_owned()),
+                request: Some("interrupt".to_owned()),
+                message: "no turn is running on conversation jp-c17000000000".to_owned(),
+            }))
+        ),
+    );
+
+    let error = client
+        .reply("jp-c17000000000", "use Rust instead")
+        .await
+        .expect_err("there is nothing to interrupt");
+
+    assert!(matches!(
+        error,
+        ClientError::Host(message)
+            if message == "no turn is running on conversation jp-c17000000000"
+    ));
+}
+
 #[tokio::test]
 async fn shutdown_signals_watch() {
     let shutdown_msg = HostToPlugin::Shutdown;
diff --git a/crates/plugins/command/serve-web/src/icon.svg b/crates/plugins/command/serve-web/src/icon.svg
new file mode 100644
index 000000000..9b159d382
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/icon.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 180 180" width="180" height="180">
+  <rect width="180" height="180" rx="40" fill="#1a1a1a"/>
+  <text
+    x="90"
+    y="92"
+    fill="#f5f5f5"
+    font-family="ui-monospace, SFMono-Regular, Menlo, monospace"
+    font-size="84"
+    font-weight="600"
+    text-anchor="middle"
+    dominant-baseline="central"
+  >jp</text>
+</svg>
diff --git a/crates/plugins/command/serve-web/src/main.rs b/crates/plugins/command/serve-web/src/main.rs
index 45082bfa7..9b53dff8a 100644
--- a/crates/plugins/command/serve-web/src/main.rs
+++ b/crates/plugins/command/serve-web/src/main.rs
@@ -1,9 +1,11 @@
-//! `jp-serve-web`: read-only web UI plugin for JP.
+//! `jp-serve-web`: web UI plugin for JP.
 //!
 //! Communicates with the `jp` host over the JSON-lines plugin protocol
-//! (stdin/stdout) and serves a read-only conversation browser over HTTP.
+//! (stdin/stdout) and serves a conversation browser over HTTP.
+//! Turns composed in the browser are delegated to the host, which owns the
+//! agent loop.
 //!
-//! See: `docs/rfd/D17-command-plugin-system.md`
+//! See: `docs/rfd/072-command-plugin-system.md`
 
 mod client;
 mod log_layer;
@@ -28,27 +30,36 @@ use crate::{
 
 /// The protocol version this plugin needs from the host.
 ///
-/// It reads conversations, events, and config, all of which the first version
-/// carries.
-const REQUIRED_PROTOCOL: u32 = 1;
+/// It archives and renames conversations (3), syncs what is being typed through
+/// the draft messages (4), offers the configurations a turn can name (5), posts
+/// turns with `query` and learns their id from `created` (6), stops them with
+/// `interrupt` (7), reads whether a turn is already running from `lock` on
+/// `events` (8), and answers a running turn with `interrupt`'s `reply` action
+/// (9).
+///
+/// The last is what makes 9 the floor rather than 8: an older host reads the
+/// action as the stop it defaults to, so sending a message to a busy
+/// conversation would end its turn and discard what was typed.
+const REQUIRED_PROTOCOL: u32 = 9;
 
 const HELP_TEXT: &str = "\
-Start the read-only web interface for browsing JP conversations.
+Start the web interface for browsing JP conversations and continuing them.
 
-Usage: jp serve web [OPTIONS]
+Usage: jp serve-web [OPTIONS]
 
 Options:
   --bind <ADDR>    Address to bind to [default: 127.0.0.1]
   --port <PORT>    Port to listen on [default: 3000]
 
 Configuration (in .jp/config.toml):
-  [plugins.command.serve.options]
+  [plugins.command.serve-web.options]
   bind = \"127.0.0.1\"
   port = 8080
 
 The server has no authentication and exposes every conversation in the
-workspace. Binding to a non-loopback address (e.g. 0.0.0.0) makes all of them
-reachable from the network.";
+workspace, and anyone who reaches it can start a turn, which spends tokens and
+runs whatever tools the conversation allows. Binding to a non-loopback address
+(e.g. 0.0.0.0) hands that to the network.";
 
 fn main() {
     let log_handle = init_tracing();
@@ -61,7 +72,7 @@ fn main() {
         drop(writeln!(err));
         drop(writeln!(
             err,
-            "Note: this binary is a JP plugin. Run it via `jp serve web`."
+            "Note: this binary is a JP plugin. Run it via `jp serve-web`."
         ));
         std::process::exit(0);
     }
@@ -142,7 +153,8 @@ fn run_server(
     if !is_loopback {
         warn!(
             %socket_addr,
-            "Binding to a non-loopback address exposes all conversations without authentication"
+            "Binding to a non-loopback address exposes all conversations, and lets anyone who \
+             reaches it start a turn, without authentication"
         );
     }
 
@@ -168,7 +180,8 @@ fn run_server(
             &mut stdout,
             &PluginToHost::Print(PrintMessage {
                 text: "Warning: bound to a non-loopback address; every conversation in this \
-                       workspace is reachable over the network without authentication.\n"
+                       workspace is readable over the network without authentication, and anyone \
+                       who reaches it can start a turn.\n"
                     .into(),
                 channel: "content".into(),
                 format: "plain".into(),
@@ -225,7 +238,7 @@ fn send_describe(stdout: &mut impl Write) -> Result<(), String> {
         &PluginToHost::Describe(DescribeResponse {
             name: "serve-web".to_owned(),
             version: env!("CARGO_PKG_VERSION").to_owned(),
-            description: "Read-only web UI for browsing conversations".to_owned(),
+            description: "Web UI for browsing conversations and continuing them".to_owned(),
             command: vec!["serve".to_owned(), "web".to_owned()],
             author: Some("Jean Mertz <git@jeanmertz.com>".to_owned()),
             help: Some(HELP_TEXT.to_owned()),
diff --git a/crates/plugins/command/serve-web/src/render.rs b/crates/plugins/command/serve-web/src/render.rs
index 9b7c6f8e5..c2ace3618 100644
--- a/crates/plugins/command/serve-web/src/render.rs
+++ b/crates/plugins/command/serve-web/src/render.rs
@@ -31,6 +31,71 @@ pub(crate) enum RenderedEvent {
     },
 }
 
+/// The first event that can still change, or the end if none can.
+///
+/// A tool call is rendered when it is requested and gains its result later, so
+/// its entry is not final the moment it appears.
+/// Anything from here on has to be sent again rather than assumed unchanged —
+/// without this, a caller that only ever appends keeps the request and never
+/// learns the answer.
+pub(crate) fn settled_upto(events: &[RenderedEvent]) -> usize {
+    events
+        .iter()
+        .position(|event| matches!(event, RenderedEvent::ToolCall { result: None, .. }))
+        .unwrap_or(events.len())
+}
+
+/// Whether the newest entry can still change where it stands.
+///
+/// A tool call gains its result after it has been rendered, and a run of
+/// assistant text or reasoning renders as one block that the next flush adds
+/// to.
+/// Neither moves the count, so a caller that has already counted the entry has
+/// no way to learn that it changed, and has to be sent it again.
+///
+/// A request, a structured response and a turn separator are finished the
+/// moment they appear.
+/// Waiting for the first token of a reply is the longest stretch of a turn, and
+/// the transcript ends in the request throughout it, so the distinction is
+/// worth making.
+pub(crate) fn tail_can_change(events: &[RenderedEvent]) -> bool {
+    matches!(
+        events.last(),
+        Some(
+            RenderedEvent::ToolCall { .. }
+                | RenderedEvent::AssistantMessage { .. }
+                | RenderedEvent::Reasoning { .. }
+        )
+    )
+}
+
+/// Whether the conversation is waiting on the assistant.
+///
+/// True when the last thing in the transcript is the user's message, or a tool
+/// call with no result yet.
+/// Read from the transcript rather than from any bookkeeping, so it holds for a
+/// turn started from another process, and survives this server restarting
+/// mid-turn.
+///
+/// A turn that was interrupted and never resumed looks the same as one still
+/// running.
+/// Both are "the assistant owes you a reply", which is what the page reports,
+/// so the conflation is honest rather than merely convenient.
+pub(crate) fn awaiting_response(events: &[RenderedEvent]) -> bool {
+    events
+        .iter()
+        .rev()
+        .find(|event| !matches!(event, RenderedEvent::TurnSeparator))
+        .is_some_and(|event| match event {
+            RenderedEvent::UserMessage { .. } => true,
+            RenderedEvent::ToolCall { result, .. } => result.is_none(),
+            RenderedEvent::AssistantMessage { .. }
+            | RenderedEvent::Reasoning { .. }
+            | RenderedEvent::Structured { .. }
+            | RenderedEvent::TurnSeparator => false,
+        })
+}
+
 /// Which kind of text a [`PendingText`] region holds.
 #[derive(Clone, Copy, PartialEq)]
 enum TextKind {
@@ -213,7 +278,21 @@ pub(crate) fn markdown_to_html(md: &str) -> String {
     options.extension.autolink = true;
     options.extension.tasklist = true;
 
-    comrak::markdown_to_html(md, &options)
+    wrap_tables(comrak::markdown_to_html(md, &options))
+}
+
+/// Put every table in a scroll container.
+///
+/// Raw HTML is escaped, so a literal `<table>` tag can only have come from
+/// comrak's own table rendering, and GFM has no nested tables, so a plain
+/// string replacement is enough.
+fn wrap_tables(html: String) -> String {
+    if !html.contains("<table>") {
+        return html;
+    }
+
+    html.replace("<table>", "<div class=\"table-scroll\"><table>")
+        .replace("</table>", "</table></div>")
 }
 
 #[cfg(test)]
diff --git a/crates/plugins/command/serve-web/src/render_tests.rs b/crates/plugins/command/serve-web/src/render_tests.rs
index b6c8d21d9..057f3cab3 100644
--- a/crates/plugins/command/serve-web/src/render_tests.rs
+++ b/crates/plugins/command/serve-web/src/render_tests.rs
@@ -243,6 +243,34 @@ fn markdown_html_is_escaped() {
     assert!(html.contains("hi"));
 }
 
+#[test]
+fn markdown_table_is_wrapped_in_a_scroll_container() {
+    let html = markdown_to_html("| a | b |\n| - | - |\n| 1 | 2 |");
+
+    let expected = "<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>a</th>\n<th>b</th>\n</\
+                    tr>\n</thead>\n<tbody>\n<tr>\n<td>1</td>\n<td>2</td>\n</tr>\n</tbody>\n</\
+                    table></div>\n";
+    assert_eq!(html, expected);
+}
+
+#[test]
+fn markdown_aligned_table_is_wrapped() {
+    // Alignment lands on the cells, so the opening tag stays a bare `<table>` and
+    // the string replacement still finds it.
+    let html = markdown_to_html("| a | b |\n| :- | -: |\n| 1 | 2 |");
+
+    let expected =
+        "<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th align=\"left\">a</th>\n<th \
+         align=\"right\">b</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td align=\"left\">1</td>\n<td \
+         align=\"right\">2</td>\n</tr>\n</tbody>\n</table></div>\n";
+    assert_eq!(html, expected);
+}
+
+#[test]
+fn markdown_without_a_table_is_not_wrapped() {
+    assert_eq!(markdown_to_html("hi"), "<p>hi</p>\n");
+}
+
 #[test]
 fn truncate_multibyte_is_boundary_safe() {
     // 4 bytes each; 3 chars = 12 bytes, over the 10-byte budget.
diff --git a/crates/plugins/command/serve-web/src/routes.rs b/crates/plugins/command/serve-web/src/routes.rs
index ffce15d60..d548a3485 100644
--- a/crates/plugins/command/serve-web/src/routes.rs
+++ b/crates/plugins/command/serve-web/src/routes.rs
@@ -1,16 +1,23 @@
 //! Axum router and HTTP handlers.
 
-use std::future::Future;
+use std::{
+    collections::HashMap,
+    future::Future,
+    sync::{Arc, Mutex},
+};
 
 use axum::{
-    Router,
-    extract::{Path, State},
-    http::{StatusCode, header},
+    Form, Json, Router,
+    extract::{Path, Query, Request, State},
+    http::{HeaderMap, Method, StatusCode, header},
+    middleware::{self, Next},
     response::{IntoResponse, Redirect, Response},
 };
+use jp_plugin::message::LockState;
 use maud::Markup;
+use serde::{Deserialize, Serialize};
 use tokio::net::TcpListener;
-use tracing::{debug, info};
+use tracing::{debug, error, info, warn};
 
 use crate::{
     client::{ClientError, PluginClient},
@@ -21,6 +28,87 @@ use crate::{
 #[derive(Clone)]
 struct AppState {
     client: PluginClient,
+
+    /// What each conversation's most recent delegated turn is doing.
+    ///
+    /// A turn outlives the request that started it, so its outcome has to live
+    /// somewhere the polling endpoint can find it.
+    turns: Arc<Mutex<HashMap<String, TurnStatus>>>,
+
+    /// Identifies this run of the server.
+    ///
+    /// A page polls it and can tell that the process it loaded from has been
+    /// replaced, which is the only way it can know its own markup and styles
+    /// are out of date.
+    /// Data recovers on its own; the page itself does not.
+    boot: String,
+}
+
+/// The state of a turn started from the browser.
+#[derive(Debug, Clone)]
+enum TurnStatus {
+    /// The host is working on it.
+    ///
+    /// `pending` is the message the browser submitted, held until it shows up
+    /// in the transcript.
+    /// The host appends the request only after it has waited for MCP servers
+    /// and resolved tools, so there are a few seconds where the turn is
+    /// underway and the conversation has no record of what was asked.
+    /// Showing it from here closes that gap without moving the host's commit
+    /// point.
+    Running {
+        pending: Option<String>,
+
+        /// Which client asked for it, when one said.
+        ///
+        /// Kept here rather than on the lock: this distinction never leaves the
+        /// process, so it is nobody else's business.
+        /// Another peer only needs to know the turn is this server's, which the
+        /// lock already says.
+        client: Option<String>,
+
+        /// How long the transcript was when the message was submitted, when the
+        /// submitter said.
+        ///
+        /// What tells `pending` it can go: the request is recorded as soon as
+        /// the transcript is longer than this, whether or not the assistant has
+        /// already begun answering it.
+        sent_at: Option<usize>,
+    },
+
+    /// It failed, and nobody has been told yet.
+    Failed(String),
+}
+
+/// What the page needs to know about a turn this server started.
+struct TurnView {
+    running: bool,
+    error: Option<String>,
+    pending: Option<String>,
+    client: Option<String>,
+}
+
+/// What stopping the running turn would take.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "snake_case")]
+enum StopMode {
+    /// Nothing to stop.
+    None,
+
+    /// The asker started it.
+    /// Stopping is theirs to do.
+    Own,
+
+    /// This server is running it, for somebody else.
+    /// Stoppable, with a warning: the work belongs to another window, and they
+    /// get no say.
+    Shared,
+
+    /// Another process entirely.
+    /// There is no way to reach it from here — a signal would run that
+    /// process's own interrupt policy, which may be to prompt a terminal nobody
+    /// is watching.
+    Unreachable,
 }
 
 /// Start the HTTP server on an already-bound listener and block until
@@ -30,7 +118,13 @@ pub(crate) async fn serve(
     listener: std::net::TcpListener,
     shutdown: impl Future<Output = ()> + Send + 'static,
 ) -> Result<(), String> {
-    let state = AppState { client };
+    let state = AppState {
+        client,
+        turns: Arc::new(Mutex::new(HashMap::new())),
+        boot: std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map_or_else(|_| "unknown".to_owned(), |d| d.as_millis().to_string()),
+    };
 
     let app = Router::new()
         .route("/", axum::routing::get(index))
@@ -39,7 +133,35 @@ pub(crate) async fn serve(
             "/conversations/{id}",
             axum::routing::get(conversation_detail),
         )
+        .route("/conversations/{id}/turn", axum::routing::post(start_turn))
+        .route("/conversations/{id}/messages", axum::routing::get(messages))
+        .route(
+            "/conversations/{id}/interrupt",
+            axum::routing::post(interrupt),
+        )
+        .route(
+            "/conversations/new",
+            axum::routing::get(new_conversation_form).post(start_conversation),
+        )
+        .route(
+            "/conversations/{id}/draft",
+            axum::routing::get(read_draft).post(write_draft),
+        )
+        .route(
+            "/conversations/digest",
+            axum::routing::get(conversation_digest),
+        )
+        .route(
+            "/conversations/{id}/archive",
+            axum::routing::post(archive_conversation),
+        )
+        .route("/conversations/{id}/title", axum::routing::post(set_title))
+        .route("/configs", axum::routing::get(list_configs))
+        .route("/status", axum::routing::get(status))
         .route("/assets/style.css", axum::routing::get(serve_css))
+        .route("/assets/icon.svg", axum::routing::get(serve_icon))
+        .route("/manifest.webmanifest", axum::routing::get(serve_manifest))
+        .layer(middleware::from_fn(same_origin_only))
         .with_state(state);
 
     let local_addr = listener.local_addr().ok();
@@ -56,6 +178,74 @@ pub(crate) async fn serve(
         .map_err(|e| format!("server error: {e}"))
 }
 
+/// Refuse a write that a page on some other origin asked for.
+///
+/// A form post needs no preflight, so any page a browser visits can submit one
+/// here and start a turn, which spends tokens and runs whatever tools the
+/// conversation allows.
+/// The same-origin policy stops that page reading the answer, not sending the
+/// request, and binding to loopback does not help: the request comes from the
+/// user's own browser, which is already inside.
+///
+/// Reads are left alone.
+/// They are as exposed as the port is, which the startup warning and the README
+/// already say, and a `GET` is where a supervisor and a `curl` live.
+async fn same_origin_only(request: Request, next: Next) -> Response {
+    let writing = !matches!(*request.method(), Method::GET | Method::HEAD);
+
+    if writing && !same_origin(request.headers()) {
+        warn!(
+            method = %request.method(),
+            path = %request.uri().path(),
+            "Refused a write from another origin",
+        );
+
+        return (
+            StatusCode::FORBIDDEN,
+            "This request came from another site.\n",
+        )
+            .into_response();
+    }
+
+    next.run(request).await
+}
+
+/// Whether a request came from one of this server's own pages.
+///
+/// `Sec-Fetch-Site` is the browser's own answer and is taken where it is given.
+/// `Origin` against `Host` is the fallback for a browser too old to send it: a
+/// cross-site form post carries the submitting page's origin, which is not this
+/// server's.
+///
+/// A request carrying neither is allowed.
+/// `curl`, a script, or another tool sends no such header, and no browser can
+/// be made to omit both — so refusing here would lock out every non-browser
+/// caller to stop nothing.
+fn same_origin(headers: &HeaderMap) -> bool {
+    if let Some(site) = headers
+        .get("sec-fetch-site")
+        .and_then(|value| value.to_str().ok())
+    {
+        return site == "same-origin" || site == "none";
+    }
+
+    let Some(origin) = headers.get(header::ORIGIN).and_then(|v| v.to_str().ok()) else {
+        return true;
+    };
+
+    // Whatever the browser was told to connect to, which is the authority half
+    // of the origin its own pages carry. Its absence with an `Origin` present
+    // leaves nothing to compare against, and guessing is not worth it.
+    headers
+        .get(header::HOST)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|host| {
+            origin
+                .split_once("://")
+                .is_some_and(|(_, authority)| authority == host)
+        })
+}
+
 async fn index() -> Redirect {
     debug!("GET / -> redirect to /conversations");
     Redirect::permanent("/conversations")
@@ -74,13 +264,982 @@ async fn conversation_list(State(state): State<AppState>) -> Result<Markup, AppE
     Ok(views::list::render(&conversations))
 }
 
+/// Whether this server is in the middle of anything.
+///
+/// Exists for whoever supervises the process: restarting to pick up a new build
+/// aborts a turn in flight, because a turn started from the browser runs inside
+/// the host process this plugin is attached to.
+/// A supervisor polls this and waits for `busy` to go false before stopping the
+/// server.
+///
+/// `busy` counts turns this server started and hasn't seen finish.
+/// A turn started from a terminal is somebody else's process and doesn't appear
+/// here — stopping this server wouldn't interrupt it.
+#[derive(Debug, Serialize)]
+struct StatusBody {
+    busy: bool,
+    turns: Vec<String>,
+}
+
+async fn status(State(state): State<AppState>) -> Json<StatusBody> {
+    let turns: Vec<String> = state
+        .turns
+        .lock()
+        .expect("turns lock poisoned")
+        .iter()
+        .filter(|(_, status)| matches!(status, TurnStatus::Running { .. }))
+        .map(|(id, _)| id.clone())
+        .collect();
+
+    Json(StatusBody {
+        busy: !turns.is_empty(),
+        turns,
+    })
+}
+
+/// The configuration choices a form carries.
+///
+/// One `cfg` field per row of the chooser, each holding a whole `--cfg`
+/// argument: a configuration to load by name, or a value to assign.
+/// Both are what `--cfg` takes, and posting them under one name is what
+/// preserves the order they were arranged in.
+#[derive(Debug, Default)]
+struct CfgFields {
+    args: Vec<String>,
+}
+
+impl CfgFields {
+    /// Take one decoded form pair, reporting whether it belonged here.
+    ///
+    /// An empty argument is a row nothing was chosen in, and is dropped.
+    ///
+    /// What is kept is trimmed: a soft keyboard puts a space after a word it
+    /// thinks is finished, and an argument carrying one reaches the config
+    /// parser as a different key or value than the one that was typed.
+    fn accept(&mut self, key: &str, value: &str) -> bool {
+        if key != "cfg" {
+            return false;
+        }
+
+        let argument = value.trim();
+        if !argument.is_empty() {
+            self.args.push(argument.to_owned());
+        }
+
+        true
+    }
+
+    /// The `--cfg` arguments this form asks for, in the order they apply.
+    fn args(&self) -> &[String] {
+        &self.args
+    }
+}
+
+/// A new turn, as posted by the composer form.
+///
+/// Read from decoded pairs rather than through `Form`, for the same reason the
+/// new-conversation form is: the chooser posts `cfg` once per row, and the
+/// urlencoded deserialiser cannot collect repeats.
+#[derive(Debug, Default)]
+struct TurnForm {
+    content: String,
+    cfg: CfgFields,
+    client: Option<String>,
+
+    /// How much of the transcript the submitting page held, which is what the
+    /// provisional copy of this message is retired against.
+    count: Option<usize>,
+}
+
+impl TurnForm {
+    fn parse(body: &str) -> Self {
+        let mut form = Self::default();
+
+        for (key, value) in form_urlencoded::parse(body.as_bytes()) {
+            if form.cfg.accept(&key, &value) {
+                continue;
+            }
+
+            match key.as_ref() {
+                "content" => form.content = value.into_owned(),
+                // Without this the turn is recorded unattributed, and the page
+                // that started it is told the turn is somebody else's.
+                "client" => form.client = Some(value.into_owned()),
+                "count" => form.count = value.parse().ok(),
+                _ => {}
+            }
+        }
+
+        form
+    }
+}
+
+/// Start a turn on this conversation and send the browser straight back to it.
+///
+/// The turn runs in the background rather than on this request.
+/// A turn can take many minutes, and holding the response open for it means the
+/// page renders nothing until the whole thing is over: no request appearing, no
+/// tool calls, no partial answer.
+/// Returning immediately lets the page poll instead, and the turn loop persists
+/// at every streaming boundary, so progress shows up as it happens.
+///
+/// Answers with `204` when the caller asks for JSON, and a redirect otherwise,
+/// so the page can post in the background while a plain form post still lands
+/// somewhere.
+async fn start_turn(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    headers: axum::http::HeaderMap,
+    body: String,
+) -> Response {
+    debug!(%id, "POST /conversations/{{id}}/turn");
+
+    let form = TurnForm::parse(&body);
+
+    // The page posts in the background and updates itself from the poll, so it
+    // wants nothing back. A plain form post has no such option and needs somewhere
+    // to land.
+    let wants_json = headers
+        .get(header::ACCEPT)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|accept| accept.contains("application/json"));
+
+    let content = form.content.trim().to_owned();
+
+    // Built before the turn is spawned, which takes ownership of `id`.
+    //
+    // The provisional message is rendered here rather than left to the next poll:
+    // that would cost a second round trip and a re-render of the whole transcript,
+    // and a second of nothing after pressing send reads as a failure. Rendered by
+    // the same function the poll would use, so it is the final markup, not an
+    // approximation of it.
+    let response = if wants_json {
+        Json(TurnStarted {
+            pending: views::detail::pending(&content).into_string(),
+        })
+        .into_response()
+    } else {
+        Redirect::to(&format!("/conversations/{id}")).into_response()
+    };
+
+    if content.is_empty() {
+        return response;
+    }
+
+    // Sending while a turn runs interrupts it and answers it, inside that turn.
+    //
+    // Not a stop followed by a second turn: the conversation is never unlocked in
+    // between, so there is no window for the send to be refused as already-locked
+    // and no need to guess when the first turn has finished unwinding.
+    // This is what Ctrl-C then `[r] Reply` does at a terminal.
+    let busy = matches!(
+        state.turns.lock().expect("turns lock poisoned").get(&id),
+        Some(TurnStatus::Running { .. })
+    );
+
+    if busy {
+        match state.client.reply(&id, &content).await {
+            Ok(()) => {
+                // The same turn, told something new. Whoever started it still
+                // owns it, so only the provisional copy of the message changes.
+                if let Some(TurnStatus::Running { pending, .. }) = state
+                    .turns
+                    .lock()
+                    .expect("turns lock poisoned")
+                    .get_mut(&id)
+                {
+                    *pending = Some(content);
+                }
+
+                return response;
+            }
+
+            // The turn ended between the check above and the reply reaching it.
+            // There is nothing left to interrupt, which makes this an ordinary
+            // message: falling through starts a turn with it.
+            Err(error) => {
+                debug!(%id, %error, "No turn left to reply to; starting one instead.");
+            }
+        }
+    }
+
+    state
+        .turns
+        .lock()
+        .expect("turns lock poisoned")
+        .insert(id.clone(), TurnStatus::Running {
+            pending: Some(content.clone()),
+            client: form.client.clone(),
+            sent_at: form.count,
+        });
+
+    let client = state.client.clone();
+    let turns = Arc::clone(&state.turns);
+    let cfg = form.cfg.args().to_vec();
+    tokio::spawn(async move {
+        let failure = match client.query(&id, &content, cfg).await {
+            Ok(()) => {
+                info!(%id, "Turn completed");
+                None
+            }
+            Err(error) => {
+                error!(%id, %error, "Turn failed");
+                Some(TurnStatus::Failed(error.to_string()))
+            }
+        };
+
+        let mut turns = turns.lock().expect("turns lock poisoned");
+        match failure {
+            Some(failed) => turns.insert(id, failed),
+            None => turns.remove(&id),
+        };
+    });
+
+    response
+}
+
+/// Stop the turn the host is running, then send the browser back.
+///
+/// The turn ends the way an interrupted terminal turn does: whatever the
+/// assistant produced so far is kept, and the conversation is left in a state
+/// another turn can continue from.
+/// Answers `204` for a background post and a redirect otherwise, so the page
+/// can stop a turn without navigating while the form still works on its own.
+async fn interrupt(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    headers: axum::http::HeaderMap,
+) -> Response {
+    debug!(%id, "POST /conversations/{{id}}/interrupt");
+
+    if let Err(error) = state.client.interrupt(&id) {
+        error!(%id, %error, "Interrupt failed");
+        state
+            .turns
+            .lock()
+            .expect("turns lock poisoned")
+            .insert(id.clone(), TurnStatus::Failed(error.to_string()));
+    }
+
+    if wants_json(&headers) {
+        StatusCode::NO_CONTENT.into_response()
+    } else {
+        Redirect::to(&format!("/conversations/{id}")).into_response()
+    }
+}
+
+/// What the new-conversation form submits.
+///
+/// Read from decoded pairs rather than through `Form`, because the chooser
+/// posts `cfg` once per row, and the urlencoded deserialiser behind `Form` has
+/// no way to express "collect the repeats" — it sees the second `cfg` and
+/// reports a string where a sequence was expected.
+#[derive(Debug, Default)]
+struct NewConversationForm {
+    content: String,
+    title: String,
+    cfg: CfgFields,
+
+    /// Which page is asking, so the turn it starts is attributed to it.
+    client: Option<String>,
+}
+
+impl NewConversationForm {
+    /// Read a form body, keeping every value of a repeated field.
+    ///
+    /// Unknown fields are ignored, which is the same latitude `Form` allows and
+    /// keeps a stray browser-added field from failing the whole submission.
+    fn parse(body: &str) -> Self {
+        let mut form = Self::default();
+
+        for (key, value) in form_urlencoded::parse(body.as_bytes()) {
+            if form.cfg.accept(&key, &value) {
+                continue;
+            }
+
+            match key.as_ref() {
+                "content" => form.content = value.into_owned(),
+                "title" => form.title = value.into_owned(),
+                "client" => form.client = Some(value.into_owned()),
+                _ => {}
+            }
+        }
+
+        form
+    }
+}
+
+async fn new_conversation_form(State(state): State<AppState>) -> Result<Markup, AppError> {
+    debug!("GET /conversations/new");
+
+    let configs = state
+        .client
+        .list_configs()
+        .await
+        .map_err(|e| AppError::Internal(e.to_string()))?;
+
+    Ok(views::new::render(&configs, "", "", &[], None))
+}
+
+/// Start a conversation, then send the browser to it.
+///
+/// Unlike a turn on an existing conversation, this waits for the host: the
+/// conversation has no id until the host has made one, and there is nowhere to
+/// redirect to until then.
+async fn start_conversation(
+    State(state): State<AppState>,
+    body: String,
+) -> Result<Response, AppError> {
+    debug!("POST /conversations/new");
+
+    let form = NewConversationForm::parse(&body);
+
+    let content = form.content.trim().to_owned();
+    let title = Some(form.title.trim().to_owned()).filter(|t| !t.is_empty());
+
+    let error = if content.is_empty() {
+        Some("A message is required.".to_owned())
+    } else {
+        match state
+            .client
+            .start_conversation(&content, title, form.cfg.args().to_vec())
+            .await
+        {
+            Ok((id, outcome)) => {
+                info!(%id, "Started a conversation.");
+
+                // Recorded before the redirect, so the page it lands on shows the
+                // working indicator and the stop button from its first paint. The
+                // request is already in the conversation, so no pending copy is
+                // needed.
+                // Attributed to whoever filled the form, so the page they land on
+                // can stop the first turn without being asked whose it is.
+                state.turns.lock().expect("turns lock poisoned").insert(
+                    id.clone(),
+                    TurnStatus::Running {
+                        pending: None,
+                        client: form.client.clone(),
+                        sent_at: None,
+                    },
+                );
+
+                // Cleared when the turn ends, which is the half that has to exist:
+                // an entry nothing ever removes leaves the conversation busy for the
+                // life of the process.
+                let turns = Arc::clone(&state.turns);
+                let finished_id = id.clone();
+                tokio::spawn(async move {
+                    let failure = match outcome.finished().await {
+                        Ok(()) => {
+                            info!(id = %finished_id, "First turn completed.");
+                            None
+                        }
+                        Err(error) => {
+                            error!(id = %finished_id, %error, "First turn failed.");
+                            Some(TurnStatus::Failed(error.to_string()))
+                        }
+                    };
+
+                    let mut turns = turns.lock().expect("turns lock poisoned");
+                    match failure {
+                        Some(failed) => turns.insert(finished_id, failed),
+                        None => turns.remove(&finished_id),
+                    };
+                });
+
+                return Ok(Redirect::to(&format!("/conversations/{id}")).into_response());
+            }
+            Err(error) => {
+                error!(%error, "Failed to start a conversation.");
+                Some(error.to_string())
+            }
+        }
+    };
+
+    // Re-listed rather than carried through the failure: the form has to be drawn
+    // again, and drawing it without its choices would lose them.
+    let configs = state.client.list_configs().await.unwrap_or_default();
+
+    Ok(views::new::render(
+        &configs,
+        &content,
+        &form.title,
+        form.cfg.args(),
+        error.as_deref(),
+    )
+    .into_response())
+}
+
+/// Move a conversation to the archive.
+///
+/// Answers `204` for a background post and a redirect otherwise, so the list
+/// page works with or without script.
+async fn archive_conversation(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    headers: axum::http::HeaderMap,
+) -> Response {
+    debug!(%id, "POST /conversations/{{id}}/archive");
+
+    match state.client.archive(&id).await {
+        Ok(()) => {
+            info!(%id, "Archived a conversation.");
+            if wants_json(&headers) {
+                StatusCode::NO_CONTENT.into_response()
+            } else {
+                Redirect::to("/conversations").into_response()
+            }
+        }
+        Err(error) => {
+            error!(%id, %error, "Failed to archive.");
+            AppError::Internal(error.to_string()).into_response()
+        }
+    }
+}
+
+/// What a rename posts.
+#[derive(Debug, Deserialize)]
+struct TitleForm {
+    title: String,
+}
+
+async fn set_title(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    headers: axum::http::HeaderMap,
+    Form(form): Form<TitleForm>,
+) -> Response {
+    debug!(%id, "POST /conversations/{{id}}/title");
+
+    match state.client.set_title(&id, &form.title).await {
+        Ok(()) => {
+            if wants_json(&headers) {
+                StatusCode::NO_CONTENT.into_response()
+            } else {
+                Redirect::to(&format!("/conversations/{id}")).into_response()
+            }
+        }
+        Err(error) => {
+            error!(%id, %error, "Failed to rename.");
+            AppError::Internal(error.to_string()).into_response()
+        }
+    }
+}
+
+/// Whether the caller posted in the background and wants no page back.
+fn wants_json(headers: &axum::http::HeaderMap) -> bool {
+    headers
+        .get(header::ACCEPT)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|accept| accept.contains("application/json"))
+}
+
+/// What the conversation list currently amounts to.
+#[derive(Debug, Serialize)]
+struct ConversationDigest {
+    digest: String,
+}
+
+/// A fingerprint of the conversation list.
+///
+/// Enough for a page to tell whether the list it is showing is still the list,
+/// without re-rendering one it already has.
+///
+/// A fingerprint rather than a count, because most of what a page would want to
+/// redraw for leaves the count alone: a rename, a conversation being used, an
+/// archive and a creation that happen to balance.
+/// It costs nothing extra — answering at all means reading every
+/// conversation's metadata, which is where a title comes from anyway.
+async fn conversation_digest(
+    State(state): State<AppState>,
+) -> Result<Json<ConversationDigest>, AppError> {
+    state
+        .client
+        .list_conversations()
+        .await
+        .map(|list| {
+            Json(ConversationDigest {
+                digest: views::list::digest(&list),
+            })
+        })
+        .map_err(|e| AppError::Internal(e.to_string()))
+}
+
+/// The chooser for the configurations a message can be run under.
+///
+/// Fetched by the page when its configuration dialog is first opened, rather
+/// than rendered into every conversation, since most visits never open it.
+///
+/// Markup rather than data: the new-conversation form offers the same choices,
+/// and building the same chooser twice is how the two come to group, label and
+/// post them differently.
+async fn list_configs(State(state): State<AppState>) -> Result<Markup, AppError> {
+    state
+        .client
+        .list_configs()
+        .await
+        .map(|entries| views::configs::chooser(&entries, &[]))
+        .map_err(|e| AppError::Internal(e.to_string()))
+}
+
+/// The reply to a turn the page started in the background.
+#[derive(Debug, Serialize)]
+struct TurnStarted {
+    /// The submitted message, rendered as it will appear in the transcript.
+    pending: String,
+}
+
+/// A query draft, as the page sees it.
+#[derive(Debug, Serialize)]
+struct DraftBody {
+    content: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    revision: Option<String>,
+    conflict: bool,
+}
+
+impl From<jp_plugin::message::DraftResponse> for DraftBody {
+    fn from(resp: jp_plugin::message::DraftResponse) -> Self {
+        Self {
+            content: resp.content,
+            revision: resp.revision,
+            conflict: resp.conflict,
+        }
+    }
+}
+
+/// What the page sends when saving a draft.
+#[derive(Debug, Deserialize)]
+struct DraftForm {
+    content: String,
+
+    /// The revision the page last saw, absent when it believes there is no
+    /// draft.
+    #[serde(default)]
+    revision: Option<String>,
+}
+
+async fn read_draft(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<DraftBody>, AppError> {
+    state
+        .client
+        .read_draft(&id)
+        .await
+        .map(|resp| Json(resp.into()))
+        .map_err(|e| AppError::Internal(e.to_string()))
+}
+
+/// Save the draft, refusing if it moved since the page last read it.
+///
+/// A refusal is a 200 with `conflict` set, not an error: the body carries what
+/// is on disk so the page can offer both rather than discard either.
+async fn write_draft(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(form): Json<DraftForm>,
+) -> Result<Json<DraftBody>, AppError> {
+    state
+        .client
+        .write_draft(&id, &form.content, form.revision)
+        .await
+        .map(|resp| Json(resp.into()))
+        .map_err(|e| AppError::Internal(e.to_string()))
+}
+
+/// The messages of a conversation, for the page's poller.
+///
+/// `count` lets the page skip the swap when nothing has changed, which is the
+/// common case: the host re-reads the conversation from disk on every request,
+/// so this reflects writes by any `jp` process, not just turns started here.
+///
+/// `running` says whether a turn started from this server is still going, which
+/// is how the page knows to keep the working indicator up.
+/// `error` is delivered once and then cleared, so a failure reaches whoever is
+/// watching without sticking around forever.
+#[derive(Debug, Serialize)]
+struct MessagesBody {
+    count: usize,
+
+    /// Rendered messages the caller does not have, or the whole transcript when
+    /// it cannot be told what it has.
+    ///
+    /// Absent when the caller is up to date.
+    /// Rendering means running markdown over every message included, so sending
+    /// the whole conversation once a second to produce something the page
+    /// already has is waste at both ends.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    html: Option<String>,
+
+    /// Where `html` starts.
+    ///
+    /// Zero means it is the whole transcript and replaces what the caller has;
+    /// anything else means it continues from there and is appended.
+    /// A conversation only grows, so continuing is the usual case — and
+    /// appending leaves the messages already on the page untouched, which is
+    /// what keeps their disclosure state, their measured heights and the scroll
+    /// position intact.
+    from: usize,
+
+    running: bool,
+
+    /// The first index that can still change.
+    ///
+    /// The caller holds every rendered entry below this one in its final form,
+    /// and sends it back on the next poll so an entry that changes after it was
+    /// delivered is sent again.
+    settled: usize,
+
+    /// What stopping the running turn would take, from the asker's side.
+    stop: StopMode,
+
+    /// This run of the server; a change means the page should reload.
+    boot: String,
+
+    /// A submitted message the transcript doesn't carry yet, rendered the same
+    /// way the real request will be so the swap is invisible.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pending: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    error: Option<String>,
+}
+
+/// How many rendered events a page holds at once.
+///
+/// Enough that scrolling back a little never waits, small enough that the first
+/// paint is cheap however long the conversation is.
+/// The cost of getting this wrong is a fetch, not a broken view.
+const WINDOW: usize = 200;
+
+/// Where a caller's copy of the transcript stops being usable.
+///
+/// Everything from here on is sent again: either the caller does not hold it,
+/// or it holds a rendering that has since changed.
+///
+/// `total` is how many rendered events there are, `held` how many the caller
+/// says it has, `floor` the index from which its copy was provisional when it
+/// was rendered, and `settled` the first index that can still change now.
+///
+/// The caller's own floor is what carries a tool call's result to it.
+/// A call is rendered when it is requested and gains its result later, and by
+/// the time that lands `settled` has moved past it — the next call in the
+/// batch is the one waiting.
+/// Only the caller knows how far back its copy went provisional.
+///
+/// A caller that cannot say either is given the tail, and a boundary that moved
+/// backwards — the transcript was compacted or edited — wins over a floor
+/// that predates it.
+///
+/// `tail_unsettled` takes one more off the top, for a newest entry that can
+/// change without the count moving — a tool call that gains its result, a
+/// block of assistant text that the next flush adds to.
+/// `settled` does not cover it: a growing block is the last entry and nothing
+/// after it is provisional, so the boundary sits at the end and the caller
+/// holds the first version forever.
+fn resend_from(
+    total: usize,
+    held: Option<usize>,
+    floor: Option<usize>,
+    settled: usize,
+    tail_unsettled: bool,
+) -> usize {
+    let settled = if tail_unsettled {
+        settled.min(total.saturating_sub(1))
+    } else {
+        settled
+    };
+
+    held.filter(|&count| count <= total)
+        .unwrap_or_else(|| total.saturating_sub(WINDOW))
+        .min(floor.unwrap_or(usize::MAX))
+        .min(settled)
+}
+
+/// What the poller already has, so the answer can leave it out.
+#[derive(Debug, Deserialize)]
+struct MessagesQuery {
+    /// Ask for the events *before* this index instead of the ones after
+    /// `count`.
+    ///
+    /// How the page walks backwards through a conversation it only holds the
+    /// tail of.
+    #[serde(default)]
+    before: Option<usize>,
+
+    /// With `before`, take everything preceding it rather than one window.
+    ///
+    /// For jumping to the top, and for the platforms that would rather hold the
+    /// whole conversation than fetch it a window at a time.
+    #[serde(default)]
+    all: Option<u8>,
+
+    /// The event count the caller last rendered.
+    #[serde(default)]
+    count: Option<usize>,
+
+    /// The index from which the caller's copy is provisional.
+    ///
+    /// What it was last told was still in flight, so an entry that has changed
+    /// since is sent again rather than left as the caller first drew it.
+    #[serde(default)]
+    settled: Option<usize>,
+
+    /// Which client is asking, so a turn it started can be told from one it
+    /// merely shares a server with.
+    #[serde(default)]
+    client: Option<String>,
+}
+
+async fn messages(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Query(query): Query<MessagesQuery>,
+) -> Result<Json<MessagesBody>, AppError> {
+    let resp = read_conversation(&state, &id).await?;
+    let rendered = render::render_events(&resp.data);
+    let settled = render::settled_upto(&rendered);
+
+    // Walking backwards: a window of what came before what the caller holds.
+    //
+    // Read without consuming. A history fetch happens while the same page is
+    // polling, and this answer carries no failure and no provisional message, so
+    // taking either here would deliver it to nobody.
+    if let Some(before) = query.before {
+        let view = peek_turn_status(&state, &id);
+        let before = before.min(rendered.len());
+        let from = if query.all.is_some_and(|all| all != 0) {
+            0
+        } else {
+            before.saturating_sub(WINDOW)
+        };
+
+        return Ok(Json(MessagesBody {
+            count: rendered.len(),
+            from,
+            html: (from < before)
+                .then(|| views::detail::messages(&rendered[from..before]).into_string()),
+            pending: None,
+            settled,
+            stop: stop_mode(&view, resp.lock, query.client.as_deref()),
+            boot: state.boot.clone(),
+            running: view.running || resp.lock.is_held(),
+            error: None,
+        }));
+    }
+
+    // The lock is the authority on whether a turn is running. Inferring it from a
+    // transcript ending in a request cannot tell a live turn from one that
+    // failed, and got that wrong in the direction that blocks the composer for a
+    // conversation nothing is working on.
+    //
+    // `view.running` still counts, for the moment between this server starting a
+    // turn and the host taking the lock.
+    let view = take_turn_status(&state, &id, &rendered);
+    let running = view.running || resp.lock.is_held();
+
+    let from = resend_from(
+        rendered.len(),
+        query.count,
+        query.settled,
+        settled,
+        running && render::tail_can_change(&rendered),
+    );
+    let stale = from != rendered.len();
+
+    Ok(Json(MessagesBody {
+        count: rendered.len(),
+        from,
+        html: stale.then(|| views::detail::messages(&rendered[from..]).into_string()),
+        pending: view
+            .pending
+            .as_deref()
+            .map(|content| views::detail::pending(content).into_string()),
+        stop: stop_mode(&view, resp.lock, query.client.as_deref()),
+        boot: state.boot.clone(),
+        running,
+        settled,
+        error: view.error,
+    }))
+}
+
+/// What stopping the running turn would take, for the client that is asking.
+///
+/// Three cases, because "this server can reach it" and "you started it" are not
+/// the same question once more than one browser is connected.
+fn stop_mode(view: &TurnView, lock: LockState, asker: Option<&str>) -> StopMode {
+    if !(view.running || lock.is_here()) {
+        return if lock.is_held() {
+            StopMode::Unreachable
+        } else {
+            StopMode::None
+        };
+    }
+
+    // Unattributed turns count as shared: a turn started before this page knew
+    // its own identity is not one it can claim.
+    match (view.client.as_deref(), asker) {
+        (Some(owner), Some(asker)) if owner == asker => StopMode::Own,
+        _ => StopMode::Shared,
+    }
+}
+
+/// Read a conversation's turn state, consuming what should only be seen once.
+///
+/// A failure is reported once: leaving it in place would have every later poll
+/// re-raise an error the reader has already seen.
+/// The provisional copy of a submitted message is dropped once `rendered`
+/// carries the request.
+fn take_turn_status(state: &AppState, id: &str, rendered: &[render::RenderedEvent]) -> TurnView {
+    let mut turns = state.turns.lock().expect("turns lock poisoned");
+
+    match turns.get_mut(id) {
+        Some(TurnStatus::Running {
+            pending,
+            client,
+            sent_at,
+        }) => {
+            // Counted rather than read off the end of the transcript. A fast
+            // first flush can persist the request and an answer to it between
+            // two polls, and a transcript ending in assistant output says
+            // nothing about whether the request below it is the one submitted
+            // here — which left the provisional copy up beside the real one for
+            // the rest of the turn.
+            //
+            // A submission that named no count — a plain form post, or a page
+            // from an older build — has only the end of the transcript to go
+            // on.
+            let landed = sent_at.map_or_else(
+                || render::awaiting_response(rendered),
+                |sent| rendered.len() > sent,
+            );
+
+            if landed {
+                pending.take();
+            }
+
+            TurnView {
+                running: true,
+                error: None,
+                pending: pending.clone(),
+                client: client.clone(),
+            }
+        }
+        Some(TurnStatus::Failed(_)) => {
+            let error = match turns.remove(id) {
+                Some(TurnStatus::Failed(message)) => Some(message),
+                _ => None,
+            };
+
+            TurnView {
+                running: false,
+                error,
+                pending: None,
+                client: None,
+            }
+        }
+        None => TurnView {
+            running: false,
+            error: None,
+            pending: None,
+            client: None,
+        },
+    }
+}
+
+/// A conversation's turn state, leaving everything where it is.
+///
+/// For a read that is not the live view.
+/// A failure is delivered once, so it has to be taken by the poll that drives
+/// the indicator and not by whatever else the page happens to be asking for at
+/// the time.
+fn peek_turn_status(state: &AppState, id: &str) -> TurnView {
+    let turns = state.turns.lock().expect("turns lock poisoned");
+
+    match turns.get(id) {
+        Some(TurnStatus::Running { client, .. }) => TurnView {
+            running: true,
+            error: None,
+            pending: None,
+            client: client.clone(),
+        },
+        Some(TurnStatus::Failed(_)) | None => TurnView {
+            running: false,
+            error: None,
+            pending: None,
+            client: None,
+        },
+    }
+}
+
+/// A page whose content changes while it is open, marked as never reusable.
+///
+/// Without this a browser is free to show the copy it already has — on a
+/// reload, on a back navigation, or when restoring a backgrounded tab — and a
+/// transcript from ten minutes ago looks like a transcript from now.
+/// The poll would correct it within a second or three, which is long enough to
+/// read as broken.
+fn uncached(markup: Markup) -> Response {
+    use axum::http::HeaderValue;
+
+    let mut response = markup.into_response();
+    response
+        .headers_mut()
+        .insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+
+    response
+}
+
 async fn conversation_detail(
     State(state): State<AppState>,
     Path(id): Path<String>,
-) -> Result<Markup, AppError> {
+) -> Result<Response, AppError> {
     debug!(%id, "GET /conversations/{{id}}");
 
-    let resp = state.client.read_events(&id).await.map_err(|e| match e {
+    let resp = read_conversation(&state, &id).await?;
+    let title = resp.title.clone().unwrap_or_else(|| "Untitled".into());
+
+    // Read without consuming: the poll that follows within a couple of seconds
+    // is what clears a failure, and it drives the same indicator.
+    let started_here = matches!(
+        state.turns.lock().expect("turns lock poisoned").get(&id),
+        Some(TurnStatus::Running { .. })
+    );
+
+    let rendered = render::render_events(&resp.data);
+    let running = started_here || resp.lock.is_held();
+
+    // Only the tail is rendered into the page. A long conversation is thousands of
+    // nodes, and painting them all is what made scrolling crawl; the page asks for
+    // the rest as it scrolls back.
+    let first = rendered.len().saturating_sub(WINDOW);
+
+    // Which client is asking is a browser-side fact, so the first paint can only
+    // say whether this server could stop it at all. The poll a second later knows
+    // the asker and refines `own` from `shared` — invisibly, since both render the
+    // same button.
+    let stoppable = started_here || resp.lock.is_here();
+
+    debug!(%id, events = rendered.len(), running, "Rendered conversation detail");
+    Ok(uncached(views::detail::render(
+        &id,
+        &title,
+        &rendered[first..],
+        first,
+        rendered.len(),
+        render::settled_upto(&rendered),
+        running,
+        stoppable,
+    )))
+}
+
+/// Read one conversation's events, mapping a missing one to a 404.
+async fn read_conversation(
+    state: &AppState,
+    id: &str,
+) -> Result<jp_plugin::message::EventsResponse, AppError> {
+    state.client.read_events(id).await.map_err(|e| match e {
         // The host reports a missing conversation as an error response; other
         // variants are server-side failures.
         ClientError::Host(msg) => {
@@ -88,22 +1247,32 @@ async fn conversation_detail(
             AppError::NotFound
         }
         e => AppError::Internal(e.to_string()),
-    })?;
-
-    // Find the title from the conversation list (protocol doesn't include it
-    // in the events response). Fall back to "Untitled".
-    let title = match state.client.list_conversations().await {
-        Ok(convos) => convos
-            .iter()
-            .find(|c| c.id == id)
-            .and_then(|c| c.title.clone())
-            .unwrap_or_else(|| "Untitled".into()),
-        Err(_) => "Untitled".into(),
-    };
+    })
+}
 
-    let rendered = render::render_events(&resp.data);
-    debug!(%id, events = rendered.len(), "Rendered conversation detail");
-    Ok(views::detail::render(&title, &rendered))
+async fn serve_icon() -> impl IntoResponse {
+    static_asset("image/svg+xml", style::ICON)
+}
+
+async fn serve_manifest() -> impl IntoResponse {
+    static_asset("application/manifest+json", style::MANIFEST)
+}
+
+/// A small embedded asset, cached for a day.
+///
+/// Shorter than the stylesheet's year: these URLs carry no content hash, so a
+/// changed icon has to be able to reach a browser that has seen the old one.
+fn static_asset(content_type: &'static str, body: &'static str) -> impl IntoResponse {
+    use axum::http::HeaderValue;
+
+    let mut headers = axum::http::HeaderMap::new();
+    headers.insert(header::CONTENT_TYPE, HeaderValue::from_static(content_type));
+    headers.insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static("public, max-age=86400"),
+    );
+
+    (StatusCode::OK, headers, body)
 }
 
 async fn serve_css() -> impl IntoResponse {
@@ -116,6 +1285,8 @@ async fn serve_css() -> impl IntoResponse {
         header::CONTENT_TYPE,
         HeaderValue::from_static("text/css; charset=utf-8"),
     );
+    // Safe to pin for a year: the URL carries `?v=<content hash>`, so a changed
+    // stylesheet is a changed URL.
     headers.insert(
         header::CACHE_CONTROL,
         HeaderValue::from_static("public, max-age=31536000, immutable"),
@@ -140,10 +1311,14 @@ impl IntoResponse for AppError {
                 (StatusCode::NOT_FOUND, body).into_response()
             }
             Self::Internal(msg) => {
-                tracing::error!(%msg, "internal server error");
+                error!(%msg, "internal server error");
                 let body = views::layout::error_page("Server Error", "Something went wrong.");
                 (StatusCode::INTERNAL_SERVER_ERROR, body).into_response()
             }
         }
     }
 }
+
+#[cfg(test)]
+#[path = "routes_tests.rs"]
+mod tests;
diff --git a/crates/plugins/command/serve-web/src/routes_tests.rs b/crates/plugins/command/serve-web/src/routes_tests.rs
new file mode 100644
index 000000000..65c9e1a49
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/routes_tests.rs
@@ -0,0 +1,296 @@
+use axum::http::{HeaderMap, HeaderName};
+use pretty_assertions::assert_eq;
+use serde_json::json;
+
+use super::*;
+
+/// A request carrying exactly these headers and nothing else.
+fn headers(pairs: &[(&str, &str)]) -> HeaderMap {
+    let mut headers = HeaderMap::new();
+
+    for (name, value) in pairs {
+        headers.insert(
+            HeaderName::from_bytes(name.as_bytes()).expect("a valid header name"),
+            value.parse().expect("a valid header value"),
+        );
+    }
+
+    headers
+}
+
+#[test]
+fn a_page_posting_to_its_own_server_is_allowed() {
+    assert!(same_origin(&headers(&[
+        ("sec-fetch-site", "same-origin"),
+        ("origin", "http://127.0.0.1:3000"),
+        ("host", "127.0.0.1:3000"),
+    ])));
+}
+
+/// The case the check exists for.
+///
+/// A form post needs no preflight, so a page on any site can submit one to this
+/// server.
+/// Refusing it is the only thing that stops a site the reader happens to visit
+/// from starting a turn on their machine.
+#[test]
+fn a_form_post_from_another_site_is_refused() {
+    assert!(!same_origin(&headers(&[
+        ("sec-fetch-site", "cross-site"),
+        ("origin", "https://example.test"),
+        ("host", "127.0.0.1:3000"),
+    ])));
+}
+
+/// Typing the address, or following a bookmark.
+/// There is no page behind it to be acting on anyone's behalf.
+#[test]
+fn a_navigation_with_no_origin_behind_it_is_allowed() {
+    assert!(same_origin(&headers(&[("sec-fetch-site", "none")])));
+}
+
+/// A browser too old to send `Sec-Fetch-Site` still sends `Origin`, and the
+/// authority it names is either this server or somebody else.
+#[test]
+fn an_origin_that_is_not_this_server_is_refused() {
+    assert!(!same_origin(&headers(&[
+        ("origin", "https://example.test"),
+        ("host", "127.0.0.1:3000"),
+    ])));
+}
+
+#[test]
+fn an_origin_matching_the_host_is_allowed() {
+    assert!(same_origin(&headers(&[
+        ("origin", "http://localhost:3000"),
+        ("host", "localhost:3000"),
+    ])));
+}
+
+/// `curl`, a script, another tool.
+/// No browser can be made to omit both headers, so refusing here would lock out
+/// every non-browser caller and stop nothing.
+#[test]
+fn a_caller_that_sends_neither_header_is_allowed() {
+    assert!(same_origin(&headers(&[("host", "127.0.0.1:3000")])));
+}
+
+/// A caller that says nothing about what it holds gets the tail.
+#[test]
+fn resend_from_gives_the_tail_to_a_caller_that_holds_nothing() {
+    assert_eq!(resend_from(500, None, None, 500, false), 300);
+}
+
+/// A short conversation fits in one window, so the tail is the whole thing.
+#[test]
+fn resend_from_gives_the_whole_transcript_when_it_fits() {
+    assert_eq!(resend_from(12, None, None, 12, false), 0);
+}
+
+/// Nothing to send when the caller is up to date and nothing is in flight.
+///
+/// `from == total` is what the handler reads as "nothing to say".
+#[test]
+fn resend_from_sends_nothing_to_an_up_to_date_caller() {
+    assert_eq!(resend_from(13, Some(13), Some(13), 13, false), 13);
+}
+
+/// A count past the end means the transcript was rewritten under the caller, so
+/// the tail is the only safe answer.
+#[test]
+fn resend_from_ignores_a_count_past_the_end() {
+    assert_eq!(resend_from(400, Some(900), None, 400, false), 200);
+}
+
+/// The tool call the caller is waiting on is sent again, so its result reaches
+/// the page.
+#[test]
+fn resend_from_reaches_back_to_the_call_the_caller_is_waiting_on() {
+    // Thirteen events, the caller holds all of them, and the call at 11 has no
+    // result yet.
+    assert_eq!(resend_from(13, Some(13), Some(11), 11, false), 11);
+}
+
+/// A tool call that gained its result between two polls is sent again.
+///
+/// By then the server's own boundary has moved past it — the next call in the
+/// batch is the one waiting — so the caller's floor is what reaches back for
+/// the entry that changed.
+#[test]
+fn resend_from_reaches_back_to_a_call_that_has_since_resolved() {
+    // The caller was last told that everything from 10 was provisional. Since
+    // then the call at 10 resolved and the one at 11 is the first still waiting.
+    assert_eq!(resend_from(13, Some(13), Some(10), 11, false), 10);
+}
+
+/// A floor above what the caller holds cannot reach past the end of its copy.
+#[test]
+fn resend_from_never_sends_past_what_the_caller_holds() {
+    assert_eq!(resend_from(20, Some(11), Some(30), 20, false), 11);
+}
+
+/// A boundary that moved backwards is honoured over a stale floor.
+///
+/// Compaction rewrites the transcript, which can leave an entry the caller
+/// believes final provisional again.
+#[test]
+fn resend_from_honours_a_boundary_below_the_callers_floor() {
+    assert_eq!(resend_from(30, Some(30), Some(20), 8, false), 8);
+}
+
+/// The regression the tail rule guards: an entry that changes in place while
+/// nothing after it is provisional.
+///
+/// Consecutive assistant text renders as one block that grows, and it is the
+/// last entry — so the settled boundary sits at the end and neither it nor the
+/// caller's floor reaches back for it.
+/// The count stays where it was too, so a caller that trusts either holds the
+/// first version forever.
+#[test]
+fn an_unsettled_tail_is_resent_to_a_caller_that_already_has_it() {
+    assert_eq!(resend_from(4, Some(4), Some(4), 4, true), 3);
+}
+
+#[test]
+fn a_settled_tail_leaves_an_up_to_date_caller_alone() {
+    assert_eq!(resend_from(4, Some(4), Some(4), 4, false), 4);
+}
+
+/// An unsettled entry wins over the newest one: a tool call still waiting on
+/// its result is where the answer has to start, however much came after it.
+#[test]
+fn an_unsettled_entry_is_resent_from_where_it_starts() {
+    assert_eq!(resend_from(9, Some(9), Some(9), 4, true), 4);
+}
+
+#[test]
+fn an_empty_transcript_has_nothing_to_resend() {
+    assert_eq!(resend_from(0, Some(0), Some(0), 0, true), 0);
+}
+
+/// Waiting for the first token is the longest stretch of a turn, and the
+/// transcript ends in the request for all of it.
+/// Re-sending a request that cannot change would rebuild that entry once a
+/// second for nothing.
+#[test]
+fn a_request_at_the_end_of_the_transcript_is_settled() {
+    let waiting = [json!({"type": "chat_request", "content": "go on then"})];
+
+    assert!(!render::tail_can_change(&render::render_events(&waiting)));
+}
+
+#[test]
+fn a_tool_call_and_a_block_of_text_are_both_unsettled() {
+    let called = [
+        json!({"type": "chat_request", "content": "run it"}),
+        json!({"type": "tool_call_request", "id": "t1", "name": "ls", "arguments": {}}),
+    ];
+
+    assert!(render::tail_can_change(&render::render_events(&called)));
+
+    let answering = [
+        json!({"type": "chat_request", "content": "run it"}),
+        json!({"type": "chat_response", "message": "here is"}),
+    ];
+
+    assert!(render::tail_can_change(&render::render_events(&answering)));
+}
+
+/// The same thing end to end, against what the renderer actually produces.
+///
+/// The count is identical before and after the result arrives, because
+/// `tool_call_response` renders into the call it answers rather than beside it.
+/// A caller that counted the unanswered call is therefore up to date by the
+/// only measure it has, and still holding a tool call with no result.
+#[test]
+fn a_tool_result_reaches_a_caller_that_already_counted_the_call() {
+    let asked = [
+        json!({"type": "chat_request", "content": "run it"}),
+        json!({"type": "tool_call_request", "id": "t1", "name": "ls", "arguments": {}}),
+    ];
+
+    let asked = render::render_events(&asked);
+    let held = asked.len();
+    assert_eq!(held, 2);
+
+    // What the caller was told on the poll that delivered the unanswered call.
+    let floor = render::settled_upto(&asked);
+    assert_eq!(floor, 1);
+
+    let answered = [
+        json!({"type": "chat_request", "content": "run it"}),
+        json!({"type": "tool_call_request", "id": "t1", "name": "ls", "arguments": {}}),
+        json!({"type": "tool_call_response", "id": "t1", "content": "a.txt"}),
+    ];
+
+    let rendered = render::render_events(&answered);
+    assert_eq!(
+        rendered.len(),
+        held,
+        "the result renders into the call, so the count cannot report it"
+    );
+
+    let from = resend_from(
+        rendered.len(),
+        Some(held),
+        Some(floor),
+        render::settled_upto(&rendered),
+        render::tail_can_change(&rendered),
+    );
+
+    assert_eq!(
+        from, 1,
+        "the answer starts at the tool call, so its result reaches the caller"
+    );
+
+    let html = views::detail::messages(&rendered[from..]).into_string();
+    assert!(
+        html.contains("a.txt"),
+        "what is sent carries the result: {html}"
+    );
+}
+
+/// Both shapes of choice reach the host in the order the chooser held them.
+///
+/// The host applies them in that order, so an assignment written above a
+/// configuration is overridden by it, and one written below wins.
+#[test]
+fn a_turn_form_keeps_the_order_the_rows_were_arranged_in() {
+    let form = TurnForm::parse(
+        "content=go&cfg=assistant.model.id%3Dopus&cfg=personas%2Fdev&cfg=skill%2Frfd",
+    );
+
+    assert_eq!(form.content, "go");
+    assert_eq!(form.cfg.args(), [
+        "assistant.model.id=opus",
+        "personas/dev",
+        "skill/rfd"
+    ]);
+}
+
+/// A picker left on its empty option is not an argument.
+#[test]
+fn a_turn_form_drops_a_row_that_chose_nothing() {
+    let form = TurnForm::parse("content=go&cfg=&cfg=+&cfg=personas%2Fdev");
+
+    assert_eq!(form.cfg.args(), ["personas/dev"]);
+}
+
+/// Space around an argument is the keyboard's, not the reader's.
+#[test]
+fn a_turn_form_trims_an_argument() {
+    let form = TurnForm::parse("content=go&cfg=+assistant.name%3DJP+");
+
+    assert_eq!(form.cfg.args(), ["assistant.name=JP"]);
+}
+
+/// The new-conversation form reads the same field as the composer.
+#[test]
+fn the_new_conversation_form_reads_the_same_configuration_field() {
+    let form = NewConversationForm::parse(
+        "title=Spike&content=go&cfg=personas%2Fdev&cfg=assistant.name%3DJP",
+    );
+
+    assert_eq!(form.title, "Spike");
+    assert_eq!(form.cfg.args(), ["personas/dev", "assistant.name=JP"]);
+}
diff --git a/crates/plugins/command/serve-web/src/style.css b/crates/plugins/command/serve-web/src/style.css
index a12cec86d..1934c6452 100644
--- a/crates/plugins/command/serve-web/src/style.css
+++ b/crates/plugins/command/serve-web/src/style.css
@@ -12,6 +12,10 @@
     --reasoning-bg: #fffbeb;
     --tool-bg: #f0fdf4;
     --code-bg: #f4f4f5;
+    /* The background a scrollable block sits on, so it can mask its own edge
+       shadows. Overridden by each surface that holds rendered markdown. */
+    --surface: #ffffff;
+    --edge-shadow: rgba(0, 0, 0, 0.3);
     --radius: 8px;
     --max-width: 800px;
 }
@@ -29,6 +33,10 @@
         --reasoning-bg: #2d2305;
         --tool-bg: #0d2818;
         --code-bg: #1e2228;
+        --surface: #0d1117;
+        /* Deeper than the light-mode value: the surfaces it falls on are already
+           dark, so it takes more black to read as a shadow. */
+        --edge-shadow: rgba(0, 0, 0, 0.55);
     }
 }
 
@@ -40,8 +48,17 @@
 
 html {
     -webkit-text-size-adjust: 100%;
+    height: 100%;
+    /* Nothing outside the transcript may scroll or bounce, including the rubber
+       band that would otherwise chain up from an inner scroller. */
+    overscroll-behavior: none;
 }
 
+/* A column that fits the visible area exactly, with one scrolling row inside it.
+
+   `--app-height` is set by the page from the visual viewport, which is the only
+   thing that knows how much room an on-screen keyboard has taken. `100dvh` is the
+   fallback for a page without script, and for desktop where the two agree. */
 body {
     margin: 0;
     font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
@@ -49,6 +66,176 @@ body {
     line-height: 1.6;
     color: var(--fg);
     background: var(--bg);
+
+    display: flex;
+    flex-direction: column;
+    overflow: hidden;
+
+    /* Deliberately *not* `position: fixed`.
+
+       A fixed element attaches to the fixed viewport, which on iOS is the ICB and
+       is not resized by the on-screen keyboard. Safari scrolls the page to reveal
+       a focused field and only repositions fixed elements once that scroll
+       settles, so a fixed header visibly leaves the screen and snaps back. No
+       amount of compensation fixes that: it cannot be painted until the scroll
+       ends.
+
+       In normal flow there is nothing anchored to a viewport that moves, so the
+       column simply fills the layout viewport and stays that size. The keyboard is
+       accounted for by moving the composer, not by resizing this. */
+    height: 100%;
+    overscroll-behavior: none;
+}
+
+/* Set by the page when iOS reports the keyboard's destination in one jump rather
+   than reporting each step of the slide, so there is nothing to follow and the
+   movement has to be invented.
+
+   The curve is the one the React Native community settled on for animating in sync
+   with the iOS keyboard; Apple publishes neither it nor the duration, which is
+   given only to native code. Both are therefore approximations, which is why the
+   page follows the real height wherever iOS gives it one. */
+html.eased .composer-dock {
+    transition: translate 250ms cubic-bezier(0.17, 0.59, 0.4, 0.77);
+}
+
+/* The same easing on the space the transcript reserves, so the conversation rises
+   with the composer rather than snapping to its final position while the composer
+   is still moving. The page holds the scroll against the bottom for the duration,
+   which turns this growing padding into a smooth scroll. */
+html.eased .stage {
+    transition: margin-bottom 250ms cubic-bezier(0.17, 0.59, 0.4, 0.77);
+}
+
+/* A page whose document scrolls, rather than one pinned to the window with a
+   scroller inside it.
+
+   Chosen per page: anywhere a virtual keyboard is involved needs the pinned
+   arrangement, and everywhere else is better off with the platform's own
+   scrolling — momentum, overscroll, and the status-bar tap that returns to the
+   top, none of which a page can reproduce. */
+body.scrolls {
+    display: block;
+    height: auto;
+    min-height: 100%;
+    overflow: visible;
+
+    /* Overscroll is allowed back in, which is what pull-to-refresh is: a drag
+       past the top of a document that is already at the top. The blanket `none`
+       further up exists to stop the transcript's rubber band chaining to the
+       document, and there is no transcript here. */
+    overscroll-behavior: auto;
+}
+
+/* The root has to allow it too — the gesture belongs to the document, and a
+   `none` on the root suppresses it whatever the body says. */
+html:has(> body.scrolls) {
+    overscroll-behavior: auto;
+}
+
+/* Above the list that passes under it. A sticky element with `z-index: auto`
+   does not create a stacking context, so the rows would otherwise paint over
+   the header's background and read as if it had none. */
+body.scrolls .page-header {
+    position: sticky;
+    top: 0;
+    z-index: 10;
+}
+
+body.scrolls .conversation-list {
+    flex: none;
+    min-height: 0;
+    overflow: visible;
+}
+
+/* Renaming, in place of the heading. */
+#rename {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 22px;
+    height: 22px;
+    padding: 0;
+    opacity: 0.55;
+    color: var(--fg-muted);
+    background: transparent;
+    border: none;
+    border-radius: 6px;
+    cursor: pointer;
+    flex-shrink: 0;
+}
+
+#rename:hover {
+    opacity: 1;
+    color: var(--fg);
+    background: var(--bg-alt);
+}
+
+/* `hidden` loses to a `display` rule, so say it again where it can win. */
+.rename-form[hidden],
+#rename[hidden],
+#title[hidden] {
+    display: none;
+}
+
+.rename-form {
+    display: flex;
+    align-items: center;
+    gap: 4px;
+    flex: 1;
+    min-width: 0;
+}
+
+.rename-form input {
+    /* Sized to its content rather than the row, so the buttons stay beside the
+       text and near the pointer that opened them. `field-sizing` does this
+       natively where supported; the width is the fallback elsewhere. */
+    field-sizing: content;
+    width: 24ch;
+    max-width: 100%;
+    min-width: 8ch;
+    padding: 4px 8px;
+    font: inherit;
+    font-size: 1rem;
+    font-weight: 600;
+    color: var(--fg);
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: 6px;
+}
+
+.rename-form button {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 26px;
+    height: 26px;
+    padding: 0;
+    color: var(--fg-muted);
+    background: transparent;
+    border: none;
+    border-radius: 6px;
+    cursor: pointer;
+    flex-shrink: 0;
+}
+
+.rename-form button:hover {
+    color: var(--fg);
+    background: var(--bg-alt);
+}
+
+/* The header is a way back to the top, since it is the thing at the top. */
+.page-header {
+    cursor: pointer;
+}
+
+.page-header a,
+.page-header h1 {
+    cursor: auto;
+}
+
+.page-header a {
+    cursor: pointer;
 }
 
 a {
@@ -60,32 +247,132 @@ a:hover {
     text-decoration: underline;
 }
 
-/* Page header */
+/* Page header
+
+   One row rather than two: a back link and a title don't need the height, and on
+   a phone every pixel here is transcript the reader doesn't see.
+
+   A flex row of the body rather than `sticky`, since the body doesn't scroll.
+
+   `touch-action: none` because iOS makes the document scrollable while the
+   keyboard is open: without it, dragging a finger across the header pans the
+   whole page. Taps are unaffected. */
 .page-header {
-    position: sticky;
-    top: 0;
-    z-index: 10;
+    flex: none;
+    touch-action: none;
+    display: flex;
+    align-items: baseline;
+    gap: 10px;
     background: var(--bg);
     border-bottom: 1px solid var(--border);
-    padding: 12px 16px;
+    /* The top inset keeps the title clear of the status bar when this runs
+       installed to a home screen, where there is no browser chrome above it.
+
+       The bar spans the window, but its contents line up with the conversation
+       below it — on a wide screen a back link pinned to the far left has nothing
+       to do with the column it belongs to. The horizontal padding grows to
+       whatever centres a `--max-width` column, and falls back to the plain inset
+       once the window is narrower than that. */
+    padding-top: max(8px, env(safe-area-inset-top));
+    padding-bottom: 8px;
+    padding-left: max(16px, env(safe-area-inset-left), calc((100% - var(--max-width)) / 2));
+    padding-right: max(16px, env(safe-area-inset-right), calc((100% - var(--max-width)) / 2));
 }
 
 .page-header h1 {
     margin: 0;
-    font-size: 1.25rem;
+    font-size: 1rem;
     font-weight: 600;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
 }
 
 .page-header .back {
-    display: inline-block;
-    margin-bottom: 4px;
-    font-size: 0.875rem;
+    font-size: 0.8125rem;
+    flex-shrink: 0;
+}
+
+/* The `New` action sits opposite the title, which is otherwise alone on the row. */
+.page-header .new-conversation-link {
+    margin-left: auto;
+    flex-shrink: 0;
+    font-size: 0.8125rem;
+}
+
+/* New conversation form */
+.new-conversation {
+    display: flex;
+    flex-direction: column;
+    gap: 20px;
+}
+
+.new-conversation .field-label {
+    display: block;
+    margin-bottom: 6px;
+    font-size: 0.8rem;
+    font-weight: 600;
+    color: var(--fg-muted);
+}
+
+.new-conversation input[type="text"],
+.new-conversation textarea {
+    width: 100%;
+    box-sizing: border-box;
+    padding: 10px 12px;
+    font: inherit;
+    color: var(--fg);
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+}
+
+.new-conversation button {
+    padding: 10px 20px;
+    font: inherit;
+    font-weight: 600;
+    color: var(--bg);
+    background: var(--fg);
+    border: none;
+    border-radius: 8px;
+    cursor: pointer;
+}
+
+/* Filter field above the conversation list. Shares the list's width and side
+   padding so the field lines up with the entries under it. */
+.list-search {
+    flex: none;
+    padding: 8px 16px;
+    max-width: var(--max-width);
+    width: 100%;
+    box-sizing: border-box;
+    margin: 0 auto;
+}
+
+.list-search input {
+    width: 100%;
+    box-sizing: border-box;
+    padding: 8px 12px;
+    /* Inherits the body's 16px, which is also the size below which iOS zooms
+       the page on focus. */
+    font: inherit;
+    color: var(--fg);
+    background: var(--bg-alt);
+    border: 1px solid var(--border);
+    border-radius: 8px;
 }
 
 /* Conversation list */
 .conversation-list {
+    flex: 1;
+    min-height: 0;
+    overflow-y: auto;
+    -webkit-overflow-scrolling: touch;
+
     padding: 0 16px 16px;
     max-width: var(--max-width);
+    width: 100%;
+    box-sizing: border-box;
     margin: 0 auto;
 }
 
@@ -99,6 +386,51 @@ a:hover {
     border-bottom: 1px solid var(--border);
 }
 
+/* A row that scrolls sideways to reveal its actions.
+
+   Scroll-snap rather than touch handlers: the browser's own scrolling gives
+   momentum, rubber banding and trackpad support for free, and a hand-rolled
+   version of those never quite matches. Dragging with a mouse works too, since
+   this is just a scroller.
+
+   The scrollbar is hidden because the affordance is the gesture, not a bar. */
+.row-track {
+    display: flex;
+    overflow-x: auto;
+    scroll-snap-type: x mandatory;
+    scrollbar-width: none;
+    overscroll-behavior-x: contain;
+}
+
+.row-track::-webkit-scrollbar {
+    display: none;
+}
+
+.row-entry {
+    flex: 0 0 100%;
+    scroll-snap-align: start;
+    scroll-snap-stop: always;
+}
+
+/* Sits past the row's right edge until scrolled to. */
+.row-actions {
+    flex: 0 0 auto;
+    display: flex;
+    align-items: stretch;
+    scroll-snap-align: end;
+}
+
+.row-actions .archive {
+    padding: 0 20px;
+    font: inherit;
+    font-weight: 600;
+    color: #ffffff;
+    background: #b3261e;
+    border: none;
+    cursor: pointer;
+    white-space: nowrap;
+}
+
 .conversation-list li a {
     display: flex;
     justify-content: space-between;
@@ -133,13 +465,874 @@ a:hover {
     color: var(--fg-muted);
 }
 
-/* Conversation detail */
+/* Conversation detail
+
+   The page's only scroller. `min-height: 0` is what lets a flex child actually
+   shrink and scroll rather than growing the column past the viewport.
+
+   `--kb-settled` is the keyboard height, but only once it has stopped moving: the
+   raised composer overlaps the bottom of this box, and the padding gives the last
+   message room to scroll clear of it. Deliberately not `--kb`, which changes every
+   frame — padding is a layout property, and paying for a relayout per frame is
+   exactly what the transform above avoids. */
 .conversation-detail {
+    flex: 1;
+    min-height: 0;
+    overflow-y: auto;
+    overscroll-behavior: contain;
+    -webkit-overflow-scrolling: touch;
+
     padding: 16px;
+    padding-left: max(16px, env(safe-area-inset-left));
+    padding-right: max(16px, env(safe-area-inset-right));
+    /* No bottom padding: the composer below carries its own top margin, padding
+       and rule, which is already the separation. Adding to it here reads as the
+       conversation stopping short. */
+    padding-bottom: 0;
     max-width: var(--max-width);
+    width: 100%;
+    box-sizing: border-box;
     margin: 0 auto;
 }
 
+/* Covers the conversation until it has been scrolled to the end.
+
+   A long transcript paints from the top over a second or more, so without this the
+   reader watches it stream past and then jump. Removed by the page adding `ready`
+   to the root, which it does after applying the scroll — or after a timeout, so a
+   page that never finishes loading is still usable. */
+.loading-veil {
+    position: absolute;
+    inset: 0;
+    z-index: 20;
+    background: var(--bg);
+    transition: opacity 150ms ease-out;
+}
+
+html.ready .loading-veil {
+    /* `display`, not just transparency: a full-size element over the scroller is
+       still painted when it is invisible, and on desktop that repaints the whole
+       transcript on every scroll frame. */
+    display: none;
+}
+
+/* Jumps within the conversation, floating over its bottom-right corner.
+
+   Inside the stage rather than the transcript, so it stays put while the
+   conversation scrolls under it. */
+.nav {
+    position: absolute;
+    bottom: 16px;
+    z-index: 15;
+
+    /* Wholly inside the column, against its right edge.
+
+       Measured from the column rather than the window: `16px` from the window is
+       only inside the column while the two share an edge, and once a gutter opens
+       up it puts the button astride that edge instead — which is the one placement
+       that looks broken from either side.
+
+       `max(0px, ...)` covers a window narrower than the column, where there is no
+       gutter to account for.
+
+       The media query further down moves it out into the gutter once there is
+       enough of one to hold it. Snapped rather than interpolated, so no window
+       width lands on the edge. */
+    right: calc(max(0px, (100% - var(--max-width)) / 2) + 16px);
+}
+
+.nav summary {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 36px;
+    height: 36px;
+    /* Faded until pointed at, matching the composer's tools. */
+    opacity: 0.55;
+    color: var(--fg-muted);
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: 50%;
+    cursor: pointer;
+    /* The disclosure triangle is replaced by the icon inside. */
+    list-style: none;
+}
+
+.nav summary::-webkit-details-marker {
+    display: none;
+}
+
+.nav summary:hover,
+.nav[open] summary {
+    opacity: 1;
+    color: var(--fg);
+    border-color: var(--fg-muted);
+}
+
+/* Opens upward: the toggle sits at the bottom of the view, so there is only room
+   above it. */
+.nav-menu {
+    position: absolute;
+    right: 0;
+    bottom: calc(100% + 8px);
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    padding: 4px;
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: 20px;
+}
+
+.nav-menu button {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 32px;
+    height: 32px;
+    padding: 0;
+    color: var(--fg-muted);
+    background: transparent;
+    border: none;
+    border-radius: 50%;
+    cursor: pointer;
+}
+
+.nav-menu button:hover {
+    color: var(--fg);
+    background: var(--bg-alt);
+}
+
+/* Marks a choice that will apply to the next message, so it is not made and then
+   forgotten behind a closed menu. */
+.nav-menu button.active {
+    color: var(--accent);
+}
+
+/* Which configurations the next message runs under. */
+.config-modal {
+    max-width: min(90vw, 520px);
+    padding: 0;
+    color: var(--fg);
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+}
+
+/* The dialog holds focus on open so the keyboard stays down, and a container
+   that can only be focused that way has no ring to draw. */
+.config-modal:focus {
+    outline: none;
+}
+
+.config-modal::backdrop {
+    background: rgb(0 0 0 / 0.4);
+}
+
+.config-form,
+.config-picker-body {
+    display: flex;
+    flex-direction: column;
+    gap: 16px;
+    padding: 20px;
+}
+
+.config-form h2,
+.config-picker-body h2 {
+    margin: 0;
+    font-size: 1rem;
+}
+
+.config-note {
+    margin: 0;
+    font-size: 0.8rem;
+    color: var(--fg-muted);
+}
+
+.config-groups {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+}
+
+.config-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+}
+
+.config-actions button {
+    padding: 8px 16px;
+    font: inherit;
+    color: var(--fg);
+    background: transparent;
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    cursor: pointer;
+}
+
+.config-actions .config-apply {
+    font-weight: 600;
+    color: #ffffff;
+    background: var(--accent);
+    border-color: var(--accent);
+}
+
+/* The arguments a message runs under, in the order they are applied. */
+.config-list {
+    display: flex;
+    flex-direction: column;
+    gap: 10px;
+}
+
+/* The rows scroll, the note and the buttons below them do not: a list long
+   enough to need the room is also one the next row is added to. */
+.config-items {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+    max-height: 40vh;
+    margin: 0;
+    padding: 0;
+    overflow-y: auto;
+    list-style: none;
+}
+
+.config-item {
+    display: flex;
+    gap: 6px;
+}
+
+/* Three classes deep on purpose. The new-conversation form styles every text
+   field it contains as its Title field, which would leave the picker and the
+   argument beside it padded differently. */
+.config-list .config-item .config-pick,
+.config-list .config-item .config-raw {
+    /* Without this a long option or placeholder sets the minimum width and the
+       row overflows the dialog rather than sharing what it has. */
+    min-width: 0;
+    flex: 1;
+    padding: 8px 10px;
+    /* Inherits the body's 16px, which is also the size below which iOS zooms
+       the page on focus. Denser would suit a dialog, and costs a zoom. */
+    font: inherit;
+    color: var(--fg);
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+}
+
+.config-new {
+    display: flex;
+    gap: 6px;
+}
+
+/* Two classes deep on purpose. The new-conversation form styles every button it
+   contains as its Start button, and these are not that. */
+.config-item .config-grip,
+.config-item .config-remove,
+.config-new .config-add {
+    flex: none;
+    font: inherit;
+    font-weight: 400;
+    color: var(--fg-muted);
+    background: transparent;
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    cursor: pointer;
+}
+
+/* Square and as tall as the field between them, so a row reads as one control
+   rather than three. */
+.config-item .config-grip,
+.config-item .config-remove {
+    width: 36px;
+    padding: 0;
+    font-size: 1rem;
+    line-height: 1;
+}
+
+/* The grip is the only part of a row that starts a drag, so it is also the only
+   part that gives up the browser's own touch gestures: without this, dragging
+   it on a phone scrolls the page instead. */
+.config-item .config-grip {
+    cursor: grab;
+    touch-action: none;
+    user-select: none;
+}
+
+/* Lifted off the list while it is dragged, and above the rows it passes over. */
+.config-item.is-dragging {
+    position: relative;
+    z-index: 1;
+    background: var(--bg-alt);
+    border-radius: var(--radius);
+    box-shadow: 0 6px 16px rgb(0 0 0 / 0.3);
+}
+
+.config-item.is-dragging .config-grip {
+    cursor: grabbing;
+}
+
+.config-new .config-add {
+    padding: 8px 14px;
+}
+
+.config-item .config-grip:hover,
+.config-item .config-remove:hover,
+.config-new .config-add:hover {
+    color: var(--fg);
+    background: var(--bg-alt);
+}
+
+.config-new .config-add:disabled {
+    cursor: default;
+    opacity: 0.5;
+}
+
+.config-new .config-add:disabled:hover {
+    color: var(--fg-muted);
+    background: transparent;
+}
+
+/* Ticking a set of configurations to add, rather than picking them one row at a
+   time. Opened from `+ Configuration`, and on the conversation page that means
+   a dialog over a dialog. */
+
+/* One class and one element deep on purpose: the new-conversation form styles
+   every text field it contains as its Title field, and this one is not that. */
+.config-picker input.config-filter {
+    box-sizing: border-box;
+    width: 100%;
+    padding: 8px 10px;
+    /* Inherits the body's 16px, which is also the size below which iOS zooms
+       the page on focus. Denser would suit a dialog, and costs a zoom. */
+    font: inherit;
+    color: var(--fg);
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+}
+
+.config-picker-groups {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    max-height: 50vh;
+    overflow-y: auto;
+}
+
+/* One block per load-path directory: the directory is the namespace, and its
+   files are the choices within it. */
+.config-picker fieldset {
+    margin: 0;
+    padding: 10px 12px;
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+}
+
+.config-picker legend {
+    padding: 0 6px;
+    font-size: 0.75rem;
+    font-weight: 600;
+    color: var(--fg-muted);
+}
+
+.config-picker .config-option {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 3px 0;
+}
+
+/* What the filter has hidden. Spelled out because the rules above set a
+   `display`, which is what the `hidden` attribute would otherwise have
+   removed. */
+.config-picker .config-option[hidden],
+.config-picker fieldset[hidden] {
+    display: none;
+}
+
+/* The place a ticked configuration will take in the list, which is the order it
+   was ticked in. */
+.config-picker .config-order {
+    margin-left: auto;
+    font-size: 0.75rem;
+    font-variant-numeric: tabular-nums;
+    color: var(--fg-muted);
+}
+
+/* Nothing here skips rendering.
+
+   `content-visibility` used to, and it worked: it was the only thing making a long
+   conversation scroll at a reasonable rate. It also meant every unvisited message
+   lied about its height, and every feature that asked where the end was had to be
+   taught to chase a moving answer. The page now holds a window of the conversation
+   instead, so there is less to paint rather than the same amount pretended away,
+   and heights are true again. */
+
+/* Holds the transcript and whatever floats over it.
+
+   Ends above the composer rather than behind it. The composer is out of flow, so
+   without this the transcript's box runs to the bottom of the window and the
+   composer sits on top of it — hiding the last lines of the conversation and the
+   bottom of its own scrollbar.
+
+   Reserved here rather than as padding on the transcript: padding moves the
+   content but not the box, which leaves the scrollbar running on underneath. */
+.stage {
+    position: relative;
+    flex: 1;
+    min-height: 0;
+    display: flex;
+    flex-direction: column;
+    margin-bottom: calc(var(--dock, 0px) + var(--kb, 0px));
+}
+
+/* Raised when the page outlives the server it loaded from.
+
+   Floats over the top of the transcript rather than taking a row of its own: it
+   is transient, and reflowing the whole conversation to announce it would be a
+   worse interruption than the thing it announces. Pinned under the header, which
+   is what carries the status-bar inset. */
+.reload-banner {
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  z-index: 5;
+  padding: 8px 16px;
+  font-size: 0.85rem;
+  text-align: center;
+  color: var(--fg);
+  background: var(--user-bg);
+  border-bottom: 1px solid var(--border);
+  box-shadow: 0 2px 8px rgb(0 0 0 / 0.15);
+}
+
+.reload-banner a {
+  color: inherit;
+  font-weight: 600;
+  text-decoration: underline;
+}
+
+/* Composer
+
+   Field and send button on one row, so an idle composer costs the conversation a
+   single line. The draft warning spans both columns beneath them, and is hidden
+   unless there is something to say. */
+.composer {
+  display: grid;
+  grid-template-columns: 1fr auto;
+  align-items: end;
+  gap: 8px;
+}
+
+.composer #draft-note {
+  grid-column: 1 / -1;
+  margin: 0;
+}
+
+.composer-dock {
+  /* Fixed, so it is out of flow: moving or growing it cannot lay out the
+     transcript, because the transcript no longer has it as a sibling taking
+     space. The transcript reserves room for it with padding instead, from the
+     `--dock` height the page measures. */
+  position: fixed;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  z-index: 5;
+
+  /* Raised clear of the keyboard by `--kb`, the height it covers, which the page
+     measures from the visual viewport.
+
+     A transform rather than `bottom`: transforms are composited, so this moves on
+     the GPU without laying anything out. Animating an inset property instead costs
+     a relayout per frame, which is what made this stutter. */
+  /* Only while the keyboard is up. A transform that is always present promotes
+     this to its own layer for the life of the page, and a composited element
+     overlapping the scroller makes every scroll frame a compositing job. */
+  translate: 0 calc(-1 * var(--kb, 0px));
+
+  /* As on the header: block dragging the page by its chrome. The textarea below
+     opts back in, so it can still scroll once it has grown. */
+  touch-action: none;
+
+  width: 100%;
+  max-width: var(--max-width);
+  box-sizing: border-box;
+  margin: 0 auto;
+  /* The full bottom inset is sized to keep controls clear of the home indicator,
+     which is more room than a composer needs — the indicator overlaps the gap
+     below the field, not the field itself. Most of it is given back. */
+  padding: 0 max(16px, env(safe-area-inset-left))
+           max(6px, calc(env(safe-area-inset-bottom) - 22px))
+           max(16px, env(safe-area-inset-right));
+  background: var(--bg);
+}
+
+.composer {
+  /* Tight against the rule: the gap above it was doing nothing the rule does not
+     already do, and every pixel here is conversation the reader cannot see. */
+  margin-top: 0;
+  padding-top: 8px;
+  border-top: 1px solid var(--border);
+}
+
+/* Acting on the field below them, so sized to sit quietly above it rather than
+   compete with the send button. */
+.composer-tools {
+  /* Placed explicitly, along with the field and the button below: leaving any of
+     the three to auto-placement puts them in whichever cell is free next, which
+     is how the row ends up beside the field instead of above it. */
+  grid-column: 1 / -1;
+  grid-row: 1;
+  display: flex;
+  gap: 2px;
+  margin-bottom: 2px;
+  position: relative;
+}
+
+.composer > textarea {
+  grid-column: 1;
+  grid-row: 2;
+}
+
+.composer > button[type="submit"] {
+  grid-column: 2;
+  grid-row: 2;
+}
+
+.composer > .composer-error {
+  grid-column: 1 / -1;
+  grid-row: 3;
+}
+
+/* What the pointed-at button does, said immediately.
+
+   The native tooltip takes a second to appear, which is long enough to give up
+   and click to find out. Right-aligned above the row so it never covers the
+   buttons themselves. */
+.composer-tools button::after {
+  content: attr(data-label);
+  position: absolute;
+  /* The row spans the send button's column too, so the label is inset by its
+     width and the gap to land against the field's right edge instead. */
+  right: calc(42px + 8px);
+  /* Centred on the icons rather than stacked above them, so the row keeps its
+     height and the label reads as a caption for what the pointer is on. */
+  top: 50%;
+  transform: translateY(-50%);
+  padding: 2px 6px;
+  font-size: 0.7rem;
+  white-space: nowrap;
+  color: var(--fg-muted);
+  background: var(--bg);
+  border-radius: 4px;
+  opacity: 0;
+  pointer-events: none;
+}
+
+.composer-tools button:hover::after,
+.composer-tools button:focus-visible::after {
+  opacity: 1;
+}
+
+.composer-tools button {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 22px;
+  height: 22px;
+  padding: 0;
+  /* Quiet until wanted: these sit above the field for the whole session and
+     should not compete with the conversation, but they still have to be findable
+     without hunting. */
+  color: var(--fg-muted);
+  opacity: 0.55;
+  background: transparent;
+  border: none;
+  border-radius: 6px;
+}
+
+.composer-tools button svg {
+  width: 13px;
+  height: 13px;
+}
+
+.composer-tools button:hover {
+  color: var(--fg);
+  opacity: 1;
+  background: var(--bg-alt);
+}
+
+/* Sized for a thumb where there is one.
+
+   Keyed on the pointer rather than the window width: a narrow desktop window is
+   still driven by a mouse, and 44px of chrome there is 44px of conversation
+   nobody asked to give up. */
+@media (pointer: coarse) {
+  .composer-tools {
+    gap: 4px;
+  }
+
+  .composer-tools button {
+    width: 44px;
+    height: 44px;
+    border-radius: 10px;
+  }
+
+  .composer-tools button svg {
+    width: 20px;
+    height: 20px;
+  }
+
+  /* The label is shown on hover, which a touch screen reports as the state a
+     tap leaves behind. It would sit over the row until something else was
+     tapped. */
+  .composer-tools button::after {
+    content: none;
+  }
+
+  .config-list .config-item .config-pick,
+  .config-list .config-item .config-raw,
+  .config-new .config-add {
+    min-height: 44px;
+  }
+
+  .config-item .config-grip,
+  .config-item .config-remove {
+    width: 44px;
+    min-height: 44px;
+  }
+}
+
+/* Marks a configuration choice waiting to be applied. */
+.composer-tools button.active {
+  color: var(--accent);
+}
+
+/* The composer again, with room to write in. */
+.expand-modal {
+  width: min(92vw, 720px);
+  padding: 0;
+  color: var(--fg);
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+
+.expand-modal::backdrop {
+  background: rgb(0 0 0 / 0.4);
+}
+
+.expand-form {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  padding: 16px;
+}
+
+.expand-form textarea {
+  width: 100%;
+  box-sizing: border-box;
+  height: min(60vh, 420px);
+  padding: 12px;
+  font: inherit;
+  color: var(--fg);
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  resize: none;
+}
+
+.composer textarea {
+  width: 100%;
+  box-sizing: border-box;
+  /* Drawn inside the field's own box, so gaining focus cannot nudge the row — and
+     with it everything above — by the ring's width. */
+  outline-offset: -2px;
+  padding: 10px 12px;
+  font: inherit;
+  color: var(--fg);
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  /* Height is managed by the page, which grows it with the content. */
+  resize: none;
+  overflow-y: auto;
+  /* Overrides the dock's `none` so the field scrolls at its maximum height. */
+  touch-action: pan-y;
+}
+
+/* The send button specifically, not every button in the composer: the tool row
+   above the field has its own, quieter treatment, and a bare `.composer button`
+   here would win on source order and make them all blue slabs. */
+.composer > button[type="submit"] {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  white-space: nowrap;
+  /* Square, so an icon sits centred rather than in a slab sized for a word. */
+  width: 42px;
+  height: 42px;
+  padding: 0;
+  font: inherit;
+  font-weight: 600;
+  /* The accent rather than a straight inversion of the foreground: inverted, it
+     is a white slab in dark mode, which pulls the eye away from the conversation
+     it sits under. */
+  color: #ffffff;
+  background: var(--accent);
+  border: none;
+  border-radius: 8px;
+  cursor: pointer;
+}
+
+.composer > button[type="submit"]:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+/* Sealed while a message is on its way to the transcript. The text is still in
+   there and still recoverable if the turn is refused, so it is dimmed rather than
+   emptied. */
+.composer textarea:read-only {
+  opacity: 0.6;
+}
+
+/* The last thing in the conversation while a reply is coming.
+
+   Given room below it, so it does not sit flush against the composer's rule.
+
+   In the transcript rather than docked to the composer, because it stands in for
+   the block being written: it belongs where that block will appear, and it scrolls
+   with the conversation like everything else. */
+.composer-status {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding-bottom: 12px;
+}
+
+/* The scroll anchor. A pixel of height, so it has a box to scroll to — a
+   zero-height element is not a target. */
+#end {
+  height: 1px;
+}
+
+/* The transcript's own tail, for when there is no indicator to provide it. */
+#pending:last-child,
+#messages:last-child {
+  padding-bottom: 12px;
+}
+
+.composer-status:empty {
+  display: none;
+}
+
+/* A bare icon beside the dots: the indicator says a reply is coming, and this is
+   the way to say stop. Sized to the dots rather than to a text button, so the pair
+   reads as one thing. */
+.composer-stop button {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 4px;
+  color: var(--fg-muted);
+  background: transparent;
+  border: none;
+  border-radius: 50%;
+  cursor: pointer;
+}
+
+.composer-stop button:hover {
+  color: var(--fg);
+  background: var(--bg-alt);
+}
+
+/* Three bouncing dots, the chat-app convention for "a reply is coming".
+   Keeps a long turn looking alive between event batches, which arrive one per
+   streaming cycle and can be a minute apart. */
+.composer-working {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 8px 12px;
+  border-radius: 12px;
+  background: var(--assistant-bg);
+}
+
+.composer-working i {
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: var(--fg-muted);
+  animation: composer-bounce 1.3s ease-in-out infinite;
+}
+
+.composer-working i:nth-child(2) {
+  animation-delay: 0.16s;
+}
+
+.composer-working i:nth-child(3) {
+  animation-delay: 0.32s;
+}
+
+@keyframes composer-bounce {
+  0%, 60%, 100% {
+    transform: translateY(0);
+    opacity: 0.45;
+  }
+  30% {
+    transform: translateY(-4px);
+    opacity: 1;
+  }
+}
+
+/* Still visible, just not moving. */
+@media (prefers-reduced-motion: reduce) {
+  .composer-working i {
+    animation: none;
+    opacity: 0.7;
+  }
+}
+
+.composer-hint,
+.composer-error {
+  font-size: 0.8rem;
+  color: var(--fg-muted);
+  margin: 0;
+}
+
+.composer-error {
+  padding: 8px 12px;
+  color: var(--fg);
+  background: var(--user-bg);
+  border-left: 3px solid currentcolor;
+  border-radius: 4px;
+  overflow-wrap: anywhere;
+}
+
+/* The two ways out of a refused draft save, beside the note that explains it.
+   Quiet: this is a question, not an alarm. */
+.draft-resolve {
+  margin-left: 6px;
+  padding: 2px 8px;
+  font: inherit;
+  font-size: 0.75rem;
+  color: var(--fg);
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  cursor: pointer;
+}
+
+.draft-resolve:hover {
+  background: var(--bg-alt);
+}
+
 /* Turn separator */
 .turn-separator {
     border: none;
@@ -165,10 +1358,18 @@ a:hover {
 
 .message.user {
     background: var(--user-bg);
+    --surface: var(--user-bg);
 }
 
 .message.assistant {
     background: var(--assistant-bg);
+    --surface: var(--assistant-bg);
+}
+
+/* Submitted, not yet in the transcript. Dimmed so it reads as provisional
+   rather than as something the conversation already records. */
+.message.pending {
+    opacity: 0.6;
 }
 
 .message .content {
@@ -187,6 +1388,7 @@ a:hover {
 .reasoning {
     margin-bottom: 16px;
     background: var(--reasoning-bg);
+    --surface: var(--reasoning-bg);
     border-radius: var(--radius);
     padding: 0;
 }
@@ -259,11 +1461,37 @@ code {
     border-radius: 3px;
 }
 
-/* Tables */
+/* Tables
+
+   The wrapper is the scroll container, so a table wider than the column scrolls
+   on its own. Left to overflow, it reaches `.conversation-detail`, whose
+   `overflow-y: auto` also makes the horizontal axis scrollable, and the whole
+   transcript slides sideways. */
+.table-scroll {
+    overflow-x: auto;
+    /* Swiping past either end of the table stops there, rather than chaining to
+       the transcript behind it or to the browser's back gesture. */
+    overscroll-behavior-x: contain;
+    margin: 16px 0;
+
+    /* A shadow on whichever side still has table beyond it, because iOS shows no
+       resting scrollbar and a cut that lands on a column border looks like the
+       end of the table.
+
+       Four layers: two covers painted in the surface colour that scroll with the
+       table, and two shadows that stay with the box. Reaching an end parks that
+       end's cover over its shadow and hides it, which is what makes the pair
+       mean "there is more this way" rather than "this box scrolls". */
+    background:
+        linear-gradient(to right, var(--surface) 30%, transparent) left / 24px 100% no-repeat local,
+        linear-gradient(to left, var(--surface) 30%, transparent) right / 24px 100% no-repeat local,
+        radial-gradient(farthest-side at left, var(--edge-shadow), transparent) left / 12px 100% no-repeat scroll,
+        radial-gradient(farthest-side at right, var(--edge-shadow), transparent) right / 12px 100% no-repeat scroll;
+}
+
 table {
     border-collapse: collapse;
     width: 100%;
-    margin: 16px 0;
     font-size: 0.875rem;
 }
 
@@ -297,17 +1525,40 @@ th {
 
 /* Responsive: wider viewports */
 @media (min-width: 768px) {
+    /* Vertical only: the horizontal padding is what centres the header's contents
+       over the column below, and a flat value here would pin them to the window
+       edges on exactly the screens where that looks worst. */
     .page-header {
+        padding-top: max(16px, env(safe-area-inset-top));
+        padding-bottom: 16px;
+    }
+
+    .conversation-list {
         padding: 16px 24px;
     }
 
-    .conversation-list,
     .conversation-detail {
         padding: 16px 24px;
+        padding-bottom: 0;
+    }
+
+    .composer-dock {
+        padding: 0 24px 12px;
     }
 
     .page-header h1 {
-        font-size: 1.5rem;
+        font-size: 1.125rem;
+    }
+}
+
+/* Wide enough for the navigation button to clear the conversation column.
+
+   `--max-width` plus a gutter big enough for a 36px button and its margins on
+   both sides. Below this it stays inside the column, where it overlaps a little
+   text but is at least beside the thing it navigates. */
+@media (min-width: 920px) {
+    .nav {
+        right: calc((100% - var(--max-width)) / 2 - 44px);
     }
 }
 
diff --git a/crates/plugins/command/serve-web/src/style.rs b/crates/plugins/command/serve-web/src/style.rs
index 5e7ac534b..3e4e2d7f9 100644
--- a/crates/plugins/command/serve-web/src/style.rs
+++ b/crates/plugins/command/serve-web/src/style.rs
@@ -7,6 +7,29 @@ use sha2::{Digest as _, Sha256};
 /// The CSS content, embedded at compile time.
 pub(crate) const CSS: &str = include_str!("style.css");
 
+/// The app icon, embedded at compile time.
+///
+/// SVG rather than PNG so it can live in the source tree as text.
+/// Browsers take it for the tab icon and recent iOS takes it from the web
+/// manifest for the home screen; older iOS wants a PNG `apple-touch-icon` and
+/// falls back to a page screenshot without one.
+pub(crate) const ICON: &str = include_str!("icon.svg");
+
+/// The web app manifest, so the page installs to a home screen with a name and
+/// an icon rather than as a bare bookmark.
+pub(crate) const MANIFEST: &str = r##"{
+  "name": "JP Conversations",
+  "short_name": "JP",
+  "start_url": "/conversations",
+  "display": "standalone",
+  "background_color": "#1a1a1a",
+  "theme_color": "#1a1a1a",
+  "icons": [
+    { "src": "/assets/icon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any" }
+  ]
+}
+"##;
+
 /// A short hex hash of the CSS content, used to cache-bust the stylesheet URL.
 pub(crate) fn css_version() -> &'static str {
     static VERSION: OnceLock<String> = OnceLock::new();
diff --git a/crates/plugins/command/serve-web/src/views/configs.js b/crates/plugins/command/serve-web/src/views/configs.js
new file mode 100644
index 000000000..a7826ba1d
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/configs.js
@@ -0,0 +1,377 @@
+// The ordered list of `--cfg` arguments a message runs under.
+//
+// Handlers are delegated from the document rather than bound to a row: the
+// composer's chooser is fetched after this script runs, and every row added
+// afterwards carries controls of its own.
+
+// A fresh row of the given kind, ready to append.
+function cloneRow(list, kind) {
+  const template = list.querySelector(`.config-template[data-kind="${kind}"]`);
+  return template ? template.content.firstElementChild.cloneNode(true) : null;
+}
+
+// Whether an argument names one of the configurations the picker offers.
+//
+// The picker carries an empty option for a row nothing has been chosen in, so
+// the empty string has to be excluded by hand.
+function isNamed(list, argument) {
+  if (argument === '') return false;
+
+  const template = list.querySelector('.config-template[data-kind="named"]');
+  return !!template?.content.querySelector(`option[value="${CSS.escape(argument)}"]`);
+}
+
+// Append a row of the given kind holding `argument`, and hand it back.
+function appendRow(list, kind, argument) {
+  const items = list.querySelector('.config-items');
+  const row = cloneRow(list, kind);
+  if (!items || !row) return null;
+
+  if (argument) row.querySelector('[name="cfg"]').value = argument;
+  items.append(row);
+
+  return row;
+}
+
+// `+ Value` writes its own row; `+ Configuration` opens the picker.
+//
+// A workspace carries dozens of configurations and a list usually wants several
+// of them, so they are ticked as a set rather than chosen one dropdown at a
+// time.
+document.addEventListener('click', (event) => {
+  const add = event.target.closest('.config-add');
+  if (!add) return;
+
+  const list = add.closest('.config-list');
+  if (!list) return;
+
+  if (add.dataset.kind === 'named') {
+    openPicker(list);
+    return;
+  }
+
+  appendRow(list, 'value', '')?.querySelector('[name="cfg"]').focus();
+});
+
+// What has been ticked in a picker, in the order it was ticked.
+//
+// Kept beside the boxes rather than read off them: a checkbox knows whether it
+// is ticked, not when, and the order the rows arrive in is the whole point.
+const pickerOrder = new WeakMap();
+
+// Open the picker with nothing ticked and nothing filtered out, whatever the
+// last visit left behind.
+function openPicker(list) {
+  const picker = list.querySelector('.config-picker');
+  if (!picker) return;
+
+  pickerOrder.set(picker, []);
+  for (const box of picker.querySelectorAll('input[type="checkbox"]')) box.checked = false;
+
+  const filter = picker.querySelector('.config-filter');
+  if (filter) filter.value = '';
+
+  markPickerOrder(picker);
+  filterPicker(picker, '');
+  picker.showModal();
+}
+
+// Show the entries whose segment contains `query`, and hide the rest.
+//
+// Matched against the whole segment rather than the name alone, so a directory
+// narrows to its own entries: `personas` leaves the personas, `dev` leaves every
+// `dev` under any of them.
+function filterPicker(picker, query) {
+  const needle = query.trim().toLowerCase();
+
+  for (const option of picker.querySelectorAll('.config-option')) {
+    const box = option.querySelector('input[type="checkbox"]');
+    option.hidden = needle !== '' && !box.dataset.segment.toLowerCase().includes(needle);
+  }
+
+  // A directory with nothing left under it has nothing left to head.
+  for (const group of picker.querySelectorAll('fieldset')) {
+    group.hidden = !group.querySelector('.config-option:not([hidden])');
+  }
+}
+
+// The box a bare Enter would tick: the first one the filter has left.
+function firstMatch(picker) {
+  return picker.querySelector('.config-option:not([hidden]) input[type="checkbox"]');
+}
+
+document.addEventListener('input', (event) => {
+  const filter = event.target.closest?.('.config-filter');
+  if (!filter) return;
+
+  filterPicker(filter.closest('.config-picker'), filter.value);
+});
+
+// Enter ticks the first match and clears the filter, so a set is gathered by
+// typing a word per configuration rather than by aiming at boxes.
+document.addEventListener('keydown', (event) => {
+  const filter = event.target.closest?.('.config-filter');
+  if (!filter || event.key !== 'Enter') return;
+
+  // Held down, Enter means the set is finished rather than one more of it.
+  if (event.metaKey || event.ctrlKey) return;
+
+  // Otherwise this submits the form the picker sits inside.
+  event.preventDefault();
+
+  const picker = filter.closest('.config-picker');
+  const box = firstMatch(picker);
+
+  // A synthetic event rather than the bookkeeping inline: assigning `checked`
+  // fires nothing, and the handler below owns what the order is.
+  if (box && !box.checked) {
+    box.checked = true;
+    box.dispatchEvent(new Event('change', { bubbles: true }));
+  }
+
+  filter.value = '';
+  filterPicker(picker, '');
+});
+
+// Cmd+Enter adds the ticked set, from anywhere in the picker.
+//
+// The picker is opened, filled and finished without the pointer ever arriving:
+// the Add button is what the same thing looks like to a mouse.
+document.addEventListener('keydown', (event) => {
+  if (event.key !== 'Enter' || !(event.metaKey || event.ctrlKey)) return;
+
+  const picker = event.target.closest?.('.config-picker');
+  if (!picker) return;
+
+  event.preventDefault();
+  applyPicker(picker);
+});
+
+// Number each ticked box with the place its row will take, and clear the rest.
+function markPickerOrder(picker) {
+  const order = pickerOrder.get(picker) ?? [];
+
+  for (const option of picker.querySelectorAll('.config-option')) {
+    const box = option.querySelector('input[type="checkbox"]');
+    const at = order.indexOf(box.dataset.segment);
+
+    option.querySelector('.config-order').textContent = at < 0 ? '' : String(at + 1);
+  }
+}
+
+document.addEventListener('change', (event) => {
+  const box = event.target.closest?.('.config-picker input[type="checkbox"]');
+  if (!box) return;
+
+  const picker = box.closest('.config-picker');
+  const order = pickerOrder.get(picker) ?? [];
+  const at = order.indexOf(box.dataset.segment);
+
+  if (box.checked && at < 0) {
+    order.push(box.dataset.segment);
+  } else if (!box.checked && at >= 0) {
+    order.splice(at, 1);
+  }
+
+  pickerOrder.set(picker, order);
+  markPickerOrder(picker);
+});
+
+// Add a row per ticked box, in the order they were ticked, and close.
+function applyPicker(picker) {
+  const list = picker.closest('.config-list');
+  if (!list) return;
+
+  for (const segment of pickerOrder.get(picker) ?? []) appendRow(list, 'named', segment);
+
+  picker.close();
+}
+
+document.addEventListener('click', (event) => {
+  const button = event.target.closest('.config-picker-add, .config-picker-cancel');
+  if (!button) return;
+
+  const picker = button.closest('.config-picker');
+  if (!picker) return;
+
+  if (button.classList.contains('config-picker-cancel')) {
+    picker.close();
+    return;
+  }
+
+  applyPicker(picker);
+});
+
+document.addEventListener('click', (event) => {
+  const remove = event.target.closest('.config-remove');
+  if (remove) remove.closest('.config-item')?.remove();
+});
+
+// Reordering is what the list is for: the host applies the arguments in the
+// order they arrive, so which row sits above which decides what wins.
+//
+// The row is dragged by its grip, and moved a place at a time by the arrow keys
+// while the grip has focus. A drag is the faster of the two and the keyboard is
+// the only one that works without a pointer, so both are here.
+
+// The state of the drag in progress, or null between drags.
+//
+// One at a time: a second finger on a second grip is ignored until the first
+// lets go.
+let configDrag = null;
+
+// Where an element sits halfway down, in viewport coordinates.
+function middleOf(element) {
+  const box = element.getBoundingClientRect();
+  return box.top + box.height / 2;
+}
+
+// Put `row` on the other side of the neighbour it now covers more than half of,
+// and keep going while that stays true: one move of a pointer can cross several
+// rows, and a fast drag would otherwise leave the row behind.
+//
+// Moving a row changes where the list lays it out, so the origin the drag
+// measures from is shifted by as much. Without that the row would jump by its
+// own height at every swap instead of staying under the pointer.
+function settle(drag, clientY) {
+  // Bounded rather than a bare loop: every swap is meant to reduce the distance
+  // left to cover, but rows of unequal height could argue about who is halfway
+  // over whom, and a page that hangs mid-drag is worse than one that stops
+  // reordering.
+  for (let step = 0; step < drag.items.children.length; step += 1) {
+    const box = drag.row.getBoundingClientRect();
+    const above = drag.row.previousElementSibling;
+    const below = drag.row.nextElementSibling;
+
+    let neighbour = null;
+    if (above && box.top < middleOf(above)) {
+      neighbour = above;
+    } else if (below && box.bottom > middleOf(below)) {
+      neighbour = below;
+    }
+
+    if (!neighbour) return;
+
+    if (neighbour === above) {
+      neighbour.before(drag.row);
+    } else {
+      neighbour.after(drag.row);
+    }
+
+    drag.origin += drag.row.getBoundingClientRect().top - box.top;
+    drag.row.style.transform = `translateY(${clientY - drag.origin}px)`;
+  }
+}
+
+// Pointer events rather than HTML5 drag-and-drop, which has no touch support at
+// all. The grip declares `touch-action: none`, so a drag that starts on it
+// drags rather than scrolling the page.
+document.addEventListener('pointerdown', (event) => {
+  const grip = event.target.closest?.('.config-grip');
+  if (!grip || configDrag || event.button !== 0) return;
+
+  const row = grip.closest('.config-item');
+  const items = row?.parentElement;
+  if (!row || !items) return;
+
+  // Keeps the press from selecting the text around it, and from starting the
+  // browser's own drag of the glyph.
+  event.preventDefault();
+  grip.setPointerCapture(event.pointerId);
+
+  configDrag = { grip, row, items, pointer: event.pointerId, origin: event.clientY };
+  row.classList.add('is-dragging');
+});
+
+document.addEventListener('pointermove', (event) => {
+  if (!configDrag || event.pointerId !== configDrag.pointer) return;
+
+  configDrag.row.style.transform = `translateY(${event.clientY - configDrag.origin}px)`;
+  settle(configDrag, event.clientY);
+});
+
+function endConfigDrag(event) {
+  if (!configDrag || event.pointerId !== configDrag.pointer) return;
+
+  configDrag.row.style.transform = '';
+  configDrag.row.classList.remove('is-dragging');
+
+  if (configDrag.grip.hasPointerCapture(event.pointerId)) {
+    configDrag.grip.releasePointerCapture(event.pointerId);
+  }
+
+  configDrag = null;
+}
+
+document.addEventListener('pointerup', endConfigDrag);
+document.addEventListener('pointercancel', endConfigDrag);
+
+// The arrow keys move the row the focused grip belongs to.
+document.addEventListener('keydown', (event) => {
+  const grip = event.target.closest?.('.config-grip');
+  if (!grip) return;
+
+  const up = event.key === 'ArrowUp';
+  if (!up && event.key !== 'ArrowDown') return;
+
+  const row = grip.closest('.config-item');
+  const neighbour = up ? row?.previousElementSibling : row?.nextElementSibling;
+  if (!neighbour) return;
+
+  // Otherwise the page scrolls under the row that just moved.
+  event.preventDefault();
+
+  if (up) {
+    neighbour.before(row);
+  } else {
+    neighbour.after(row);
+  }
+
+  // Moving a node drops the focus that was on it, and a row moved two places is
+  // two presses of a key that would otherwise land somewhere else.
+  grip.focus();
+});
+
+// Enter inside a row or the picker does nothing.
+//
+// Left alone it submits the form the chooser sits in, which is the composer's
+// dialog — whose first submit button is Cancel, so the work would be thrown
+// away — or the new-conversation form, which would start the conversation from
+// a half-written message.
+//
+// A button is left alone: Enter is how one is pressed, which is how the picker
+// is confirmed and how a row is dropped without a pointer.
+document.addEventListener('keydown', (event) => {
+  if (event.key !== 'Enter') return;
+  if (!event.target.closest?.('.config-item, .config-picker')) return;
+  if (event.target.closest('button')) return;
+
+  event.preventDefault();
+});
+
+// Read and rewrite the list, for the composer's dialog: it holds the applied
+// choice itself and puts it back when a later edit is cancelled.
+window.jpConfigList = {
+  // The arguments the list holds, in order.
+  //
+  // A row left on the picker's empty option contributes nothing, the same way
+  // the server drops it.
+  read(root) {
+    return Array.from(root.querySelectorAll('.config-item [name="cfg"]'))
+      .map((field) => field.value.trim())
+      .filter((argument) => argument !== '');
+  },
+
+  // Replace the rows with one per argument, in order.
+  write(root, args) {
+    const list = root.querySelector('.config-list');
+    const items = list?.querySelector('.config-items');
+    if (!items) return;
+
+    items.replaceChildren();
+
+    for (const argument of args) {
+      appendRow(list, isNamed(list, argument) ? 'named' : 'value', argument);
+    }
+  },
+};
diff --git a/crates/plugins/command/serve-web/src/views/configs.rs b/crates/plugins/command/serve-web/src/views/configs.rs
new file mode 100644
index 000000000..3c4606e4f
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/configs.rs
@@ -0,0 +1,251 @@
+//! The ordered list of configurations a message runs under.
+//!
+//! Rendered into the new-conversation form and fetched into the composer's
+//! configuration dialog, so both offer the same choices and post the same
+//! field.
+//!
+//! Every row posts one `cfg` field holding a whole `--cfg` argument, whether
+//! the row named a configuration or spelled out an assignment.
+//! A form submits its fields in document order, so the list the reader arranges
+//! is the argument order the host applies.
+
+use std::collections::BTreeMap;
+
+use jp_plugin::message::ConfigEntry;
+use maud::{Markup, html};
+
+/// Render the chooser: the chosen arguments in the order they apply, and the
+/// buttons that add another.
+///
+/// `chosen` is what a refused submission hands back, so nothing has to be
+/// entered twice.
+/// An argument naming one of `configs` comes back as a picker and anything else
+/// as text, which is the same split `--cfg` makes between a configuration to
+/// load and a value to assign.
+pub(crate) fn chooser(configs: &[ConfigEntry], chosen: &[String]) -> Markup {
+    html! {
+        div class="config-list" {
+            p class="config-note" {
+                "Applied top to bottom, as repeated "
+                code { "--cfg" }
+                " arguments are: a later row wins over an earlier one."
+            }
+
+            ol class="config-items" {
+                @for argument in chosen {
+                    @if names_a_config(configs, argument) {
+                        (item(&picker(configs, argument)))
+                    } @else {
+                        (item(&assignment(argument)))
+                    }
+                }
+            }
+
+            // Cloned by the buttons below. A template's contents are inert, so
+            // the fields in here post nothing until a row is made from them.
+            template class="config-template" data-kind="named" {
+                (item(&picker(configs, "")))
+            }
+            template class="config-template" data-kind="value" {
+                (item(&assignment("")))
+            }
+
+            div class="config-new" {
+                button
+                    type="button"
+                    class="config-add"
+                    data-kind="named"
+                    disabled[configs.is_empty()]
+                {
+                    "+ Configuration"
+                }
+                button type="button" class="config-add" data-kind="value" {
+                    "+ Value"
+                }
+            }
+
+            @if configs.is_empty() {
+                p class="config-note" { "No configurations found on the load paths." }
+            } @else {
+                (picker_dialog(configs))
+            }
+        }
+    }
+}
+
+/// The script the list needs: adding, reordering and removing rows.
+///
+/// Rendered by both pages that show the chooser.
+pub(crate) const SCRIPT: &str = include_str!("configs.js");
+
+/// One row of the list: the grip it is dragged by, the button that drops it,
+/// and what it contributes.
+///
+/// Both controls lead the row, so they stay in one column however wide the
+/// field beside them is.
+/// The grip is also the only part of a row that starts a drag: everything else
+/// is a field that needs the pointer for itself.
+fn item(body: &Markup) -> Markup {
+    html! {
+        li class="config-item" {
+            button
+                type="button"
+                class="config-grip"
+                title="Drag to reorder"
+                aria-label="Reorder this row; the arrow keys move it too"
+            {
+                "⠿"
+            }
+            button type="button" class="config-remove" title="Remove" aria-label="Remove" {
+                "×"
+            }
+            (body)
+        }
+    }
+}
+
+/// The modal `+ Configuration` opens: the configurations on the load paths,
+/// ticked as a set.
+///
+/// One row is added per ticked box, in the order the boxes were ticked, which
+/// the ordinal beside each one shows as it is chosen.
+/// Reordering afterwards is the list's job.
+///
+/// The filter takes the focus the dialog opens with, so a load path holding
+/// fifty configurations is a word away from the one that was wanted rather than
+/// a scroll.
+/// Enter ticks what the filter has left and Cmd+Enter finishes, so the whole
+/// dialog is a few words long and the pointer never arrives.
+///
+/// The boxes carry no `name`, so neither form the chooser sits in posts them: a
+/// message runs under the list, not under what was ticked to build it.
+fn picker_dialog(configs: &[ConfigEntry]) -> Markup {
+    html! {
+        dialog class="config-modal config-picker" {
+            div class="config-picker-body" {
+                h2 { "Add configurations" }
+                p class="config-note" {
+                    "Added in the order they are ticked. Enter ticks the first match, "
+                    "⌘ Enter adds them."
+                }
+
+                input
+                    type="text"
+                    class="config-filter"
+                    placeholder="Filter…"
+                    autocomplete="off"
+                    autocapitalize="off"
+                    spellcheck="false"
+                    aria-label="Filter configurations"
+                    autofocus;
+
+                div class="config-picker-groups" {
+                    @for (namespace, entries) in group_by_namespace(configs) {
+                        fieldset {
+                            legend { (label(namespace)) }
+                            @for entry in entries {
+                                label class="config-option" {
+                                    input type="checkbox" data-segment=(entry.segment);
+                                    span { (entry.name) }
+                                    span class="config-order" {}
+                                }
+                            }
+                        }
+                    }
+                }
+
+                div class="config-actions" {
+                    button type="button" class="config-picker-cancel" { "Cancel" }
+                    button type="button" class="config-picker-add config-apply" { "Add" }
+                }
+            }
+        }
+    }
+}
+
+/// A row that loads one of the configurations on the load paths.
+///
+/// The first option is the empty one a fresh row starts on, so adding a row
+/// does not quietly apply whichever configuration happens to sort first.
+/// It posts an empty argument, which the server drops.
+fn picker(configs: &[ConfigEntry], selected: &str) -> Markup {
+    html! {
+        select class="config-pick" name="cfg" aria-label="Configuration" {
+            option value="" { "Choose a configuration…" }
+
+            @for (namespace, entries) in group_by_namespace(configs) {
+                optgroup label=(label(namespace)) {
+                    @for entry in entries {
+                        option value=(entry.segment) selected[entry.segment == selected] {
+                            (entry.name)
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// A row holding a `--cfg` argument written out.
+///
+/// One field rather than a key and a value: `--cfg` takes more than an
+/// assignment — a JSON object, an `@path`, a reset keyword — and splitting
+/// the field at an `=` this end would put those out of reach.
+fn assignment(value: &str) -> Markup {
+    html! {
+        input
+            type="text"
+            class="config-raw"
+            name="cfg"
+            value=(value)
+            placeholder="assistant.model.id=opus"
+            autocomplete="off"
+            autocapitalize="off"
+            spellcheck="false"
+            aria-label="Configuration argument";
+    }
+}
+
+/// Whether an argument is the name of a configuration on the load paths.
+fn names_a_config(configs: &[ConfigEntry], argument: &str) -> bool {
+    configs.iter().any(|entry| entry.segment == argument)
+}
+
+/// Group the entries by the directory they live in.
+///
+/// A map rather than runs over the order they arrive in: the host sorts by full
+/// segment, which does not keep a directory's entries together.
+/// With `.jp/config` and `.jp/config/personas` both on the load path,
+/// `personas/dev` sorts between `default` and `po`, and a directory's entries
+/// end up split across as many groups as there are names sorting between them.
+///
+/// Namespaces come out alphabetically, which puts the load path's own root
+/// first.
+fn group_by_namespace(configs: &[ConfigEntry]) -> BTreeMap<&str, Vec<&ConfigEntry>> {
+    let mut groups: BTreeMap<&str, Vec<&ConfigEntry>> = BTreeMap::new();
+
+    for entry in configs {
+        groups
+            .entry(entry.namespace.as_str())
+            .or_default()
+            .push(entry);
+    }
+
+    groups
+}
+
+/// The heading for a group, naming the directory its entries live in.
+///
+/// Entries at a load path's root have no directory to name, so they are
+/// labelled generically rather than under an empty heading.
+fn label(namespace: &str) -> &str {
+    if namespace.is_empty() {
+        "General"
+    } else {
+        namespace
+    }
+}
+
+#[cfg(test)]
+#[path = "configs_tests.rs"]
+mod tests;
diff --git a/crates/plugins/command/serve-web/src/views/configs_tests.rs b/crates/plugins/command/serve-web/src/views/configs_tests.rs
new file mode 100644
index 000000000..73362658c
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/configs_tests.rs
@@ -0,0 +1,333 @@
+use pretty_assertions::assert_eq;
+
+use super::*;
+
+/// Build an entry the way the host does: the namespace is everything before the
+/// last separator, the name what follows it.
+fn entry(segment: &str) -> ConfigEntry {
+    let (namespace, name) = segment.rsplit_once('/').map_or_else(
+        || (String::new(), segment.to_owned()),
+        |(namespace, name)| (namespace.to_owned(), name.to_owned()),
+    );
+
+    ConfigEntry {
+        segment: segment.to_owned(),
+        namespace,
+        name,
+    }
+}
+
+/// The group labels the picker renders, in order.
+fn labels(configs: &[ConfigEntry]) -> Vec<String> {
+    group_by_namespace(configs)
+        .into_keys()
+        .map(|namespace| label(namespace).to_owned())
+        .collect()
+}
+
+/// The rows the chooser holds, without the templates it clones them from.
+fn rows(markup: &str) -> &str {
+    let opened = markup
+        .split_once(r#"<ol class="config-items">"#)
+        .expect("the chooser renders a list")
+        .1;
+
+    opened.split_once("</ol>").expect("the list is closed").0
+}
+
+/// The row a `+` button clones for the given kind.
+fn template(markup: &str, kind: &str) -> String {
+    let opened = markup
+        .split_once(&format!(
+            r#"<template class="config-template" data-kind="{kind}">"#
+        ))
+        .unwrap_or_else(|| panic!("the chooser renders a {kind} template, got: {markup}"))
+        .1;
+
+    opened
+        .split_once("</template>")
+        .expect("the template is closed")
+        .0
+        .to_owned()
+}
+
+/// The grip every row is dragged by.
+const GRIP: &str = concat!(
+    r#"<button type="button" class="config-grip" title="Drag to reorder" "#,
+    r#"aria-label="Reorder this row; the arrow keys move it too">⠿</button>"#,
+);
+
+/// The button every row is dropped by.
+const REMOVE: &str = concat!(
+    r#"<button type="button" class="config-remove" title="Remove" "#,
+    r#"aria-label="Remove">×</button>"#,
+);
+
+/// A workspace whose load paths nest, which is what `.jp/config` plus
+/// `.jp/config/personas` produces: every persona is selectable under both its
+/// bare name and its directory.
+fn nested_load_paths() -> Vec<ConfigEntry> {
+    // The order the host sends, which is a `BTreeSet` of the segments.
+    [
+        "architect",
+        "committer",
+        "default",
+        "dev",
+        "knowledge/testing",
+        "knowledge/voice",
+        "personas/architect",
+        "personas/dev",
+        "po",
+        "pr-reviewer",
+        "skill/rfd",
+        "stager",
+        "writer",
+    ]
+    .iter()
+    .map(|segment| entry(segment))
+    .collect()
+}
+
+/// One group per directory, however the segments sort against each other.
+///
+/// Sorting by full segment scatters a directory's entries: `personas/dev` sorts
+/// between `default` and `po`, and `skill/rfd` between `pr-reviewer` and
+/// `stager`.
+/// Grouping by adjacency opens a fresh group at each gap, so the root entries
+/// arrive under three separate `General` labels.
+#[test]
+fn each_directory_gets_one_group() {
+    assert_eq!(labels(&nested_load_paths()), [
+        "General",
+        "knowledge",
+        "personas",
+        "skill"
+    ]);
+}
+
+/// Root entries stay together under one label, in the order the host sent them.
+#[test]
+fn root_entries_are_one_group() {
+    let configs = nested_load_paths();
+    let groups = group_by_namespace(&configs);
+
+    let names: Vec<&str> = groups[""].iter().map(|entry| entry.name.as_str()).collect();
+
+    assert_eq!(names, [
+        "architect",
+        "committer",
+        "default",
+        "dev",
+        "po",
+        "pr-reviewer",
+        "stager",
+        "writer"
+    ]);
+}
+
+/// Entries at a load path's root have no directory to name.
+#[test]
+fn the_root_group_is_labelled_generically() {
+    assert_eq!(label(""), "General");
+    assert_eq!(label("personas"), "personas");
+}
+
+/// A load path with nothing in it says so, and offers no way to open a picker
+/// with nothing in it either.
+#[test]
+fn an_empty_list_says_there_is_nothing_to_choose() {
+    let markup = chooser(&[], &[]).into_string();
+
+    assert!(
+        markup.contains("No configurations found on the load paths."),
+        "expected the empty note, got: {markup}"
+    );
+    assert!(
+        markup.contains(r#"<button type="button" class="config-add" data-kind="named" disabled>"#),
+        "expected the configuration button to be disabled, got: {markup}"
+    );
+    assert!(
+        !markup.contains("config-picker"),
+        "expected no picker to open, got: {markup}"
+    );
+}
+
+/// The picker opens with the filter focused, so the set is gathered by typing.
+#[test]
+fn the_picker_opens_on_its_filter() {
+    let markup = chooser(&[entry("dev")], &[]).into_string();
+
+    let opened = markup
+        .split_once(r#"<dialog class="config-modal config-picker">"#)
+        .expect("the chooser renders a picker")
+        .1;
+
+    assert_eq!(
+        opened
+            .split_once(r#"<div class="config-picker-groups">"#)
+            .expect("the picker renders its groups")
+            .0,
+        concat!(
+            r#"<div class="config-picker-body">"#,
+            r#"<h2>Add configurations</h2>"#,
+            r#"<p class="config-note">Added in the order they are ticked. "#,
+            r#"Enter ticks the first match, ⌘ Enter adds them.</p>"#,
+            r#"<input type="text" class="config-filter" placeholder="Filter…" "#,
+            r#"autocomplete="off" autocapitalize="off" spellcheck="false" "#,
+            r#"aria-label="Filter configurations" autofocus>"#,
+        )
+    );
+}
+
+/// The picker offers every configuration as a box to tick, grouped by the
+/// directory it lives in.
+///
+/// The boxes carry no `name`: they build the list, and it is the list the form
+/// posts.
+#[test]
+fn the_picker_offers_every_configuration_as_a_box() {
+    let markup = chooser(&[entry("knowledge/voice"), entry("dev")], &[]).into_string();
+
+    let opened = markup
+        .split_once(r#"<div class="config-picker-groups">"#)
+        .expect("the chooser renders a picker")
+        .1;
+    let groups = opened
+        .split_once("</div>")
+        .expect("the groups are closed")
+        .0;
+
+    assert_eq!(
+        groups,
+        concat!(
+            r#"<fieldset><legend>General</legend>"#,
+            r#"<label class="config-option">"#,
+            r#"<input type="checkbox" data-segment="dev">"#,
+            r#"<span>dev</span>"#,
+            r#"<span class="config-order"></span>"#,
+            r#"</label>"#,
+            r#"</fieldset>"#,
+            r#"<fieldset><legend>knowledge</legend>"#,
+            r#"<label class="config-option">"#,
+            r#"<input type="checkbox" data-segment="knowledge/voice">"#,
+            r#"<span>voice</span>"#,
+            r#"<span class="config-order"></span>"#,
+            r#"</label>"#,
+            r#"</fieldset>"#,
+        )
+    );
+}
+
+/// Nothing is chosen until a row is added, so the list starts empty.
+#[test]
+fn nothing_is_chosen_to_begin_with() {
+    let markup = chooser(&[entry("personas/dev")], &[]).into_string();
+
+    assert_eq!(rows(&markup), "");
+}
+
+/// What a previous submission chose comes back in the order it was arranged, so
+/// a refused message does not cost the choices made with it.
+///
+/// An argument naming a configuration comes back as a picker with that option
+/// selected; anything else comes back as text.
+#[test]
+fn a_previous_choice_is_restored_in_order() {
+    let configs = [entry("personas/dev")];
+    let chosen = [
+        "assistant.model.id=opus".to_owned(),
+        "personas/dev".to_owned(),
+    ];
+
+    let markup = chooser(&configs, &chosen).into_string();
+
+    let expected = format!(
+        concat!(
+            r#"<li class="config-item">"#,
+            "{grip}",
+            "{remove}",
+            r#"<input type="text" class="config-raw" name="cfg" value="assistant.model.id=opus" "#,
+            r#"placeholder="assistant.model.id=opus" autocomplete="off" autocapitalize="off" "#,
+            r#"spellcheck="false" aria-label="Configuration argument">"#,
+            r#"</li>"#,
+            r#"<li class="config-item">"#,
+            "{grip}",
+            "{remove}",
+            r#"<select class="config-pick" name="cfg" aria-label="Configuration">"#,
+            r#"<option value="">Choose a configuration…</option>"#,
+            r#"<optgroup label="personas">"#,
+            r#"<option value="personas/dev" selected>dev</option>"#,
+            r#"</optgroup>"#,
+            r#"</select>"#,
+            r#"</li>"#,
+        ),
+        grip = GRIP,
+        remove = REMOVE
+    );
+
+    assert_eq!(rows(&markup), expected);
+}
+
+/// The `+` buttons clone the row they add from a template, taking its first
+/// element and filling the field inside.
+#[test]
+fn the_chooser_carries_a_template_for_each_kind_of_row() {
+    let markup = chooser(&[entry("personas/dev")], &[]).into_string();
+
+    assert_eq!(
+        template(&markup, "named"),
+        format!(
+            concat!(
+                r#"<li class="config-item">"#,
+                "{grip}",
+                "{remove}",
+                r#"<select class="config-pick" name="cfg" aria-label="Configuration">"#,
+                r#"<option value="">Choose a configuration…</option>"#,
+                r#"<optgroup label="personas">"#,
+                r#"<option value="personas/dev">dev</option>"#,
+                r#"</optgroup>"#,
+                r#"</select>"#,
+                r#"</li>"#,
+            ),
+            grip = GRIP,
+            remove = REMOVE
+        )
+    );
+
+    assert_eq!(
+        template(&markup, "value"),
+        format!(
+            concat!(
+                r#"<li class="config-item">"#,
+                "{grip}",
+                "{remove}",
+                r#"<input type="text" class="config-raw" name="cfg" value="" "#,
+                r#"placeholder="assistant.model.id=opus" autocomplete="off" "#,
+                r#"autocapitalize="off" spellcheck="false" "#,
+                r#"aria-label="Configuration argument">"#,
+                r#"</li>"#,
+            ),
+            grip = GRIP,
+            remove = REMOVE
+        )
+    );
+}
+
+/// The picker starts on an option that chooses nothing, so adding a row does
+/// not quietly apply whichever configuration sorts first.
+#[test]
+fn a_fresh_picker_selects_nothing() {
+    let markup = picker(&[entry("personas/dev")], "").into_string();
+
+    assert_eq!(
+        markup,
+        concat!(
+            r#"<select class="config-pick" name="cfg" aria-label="Configuration">"#,
+            r#"<option value="">Choose a configuration…</option>"#,
+            r#"<optgroup label="personas">"#,
+            r#"<option value="personas/dev">dev</option>"#,
+            r#"</optgroup>"#,
+            r#"</select>"#,
+        )
+    );
+}
diff --git a/crates/plugins/command/serve-web/src/views/detail.js b/crates/plugins/command/serve-web/src/views/detail.js
new file mode 100644
index 000000000..b15c6da71
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/detail.js
@@ -0,0 +1,1447 @@
+// The two faces of the send button, matching what the server renders.
+const SEND_SVG =
+  `<svg viewBox='0 0 24 24' width='20' height='20' fill='none'`
+  + ` stroke='currentColor' stroke-width='2.5' stroke-linecap='round'`
+  + ` stroke-linejoin='round' aria-hidden='true'><path d='M12 19V5'></path>`
+  + `<path d='M5 12l7-7 7 7'></path></svg>`;
+
+const CANCEL_SVG =
+  `<svg viewBox='0 0 24 24' width='20' height='20' fill='none'`
+  + ` stroke='currentColor' stroke-width='2.5' stroke-linecap='round'`
+  + ` aria-hidden='true'><path d='M18 6L6 18'></path>`
+  + `<path d='M6 6l12 12'></path></svg>`;
+
+const transcript = document.getElementById('transcript');
+const end = document.getElementById('end');
+const box = document.getElementById('messages');
+
+// The window this page holds: `first` is the index of its oldest event, and
+// `data-count` the total the conversation has. Older ones are fetched as the
+// reader scrolls back to them.
+const older = () => Number(box.dataset.first) > 0;
+let loadingOlder = false;
+
+// The index from which this page's copy of the transcript is provisional.
+//
+// A tool call is drawn when it is requested and gains its result later, so the
+// entry on the page is not final the moment it appears. The server's own
+// boundary has moved past it by the time the result lands — the next call in the
+// batch is the one waiting — so what reaches back for the entry that changed is
+// this page remembering how far back its own copy went provisional.
+//
+// Zero when the page cannot say, which asks for everything it holds.
+let settledFloor = Number(box.dataset.settled) || 0;
+const pending = document.getElementById('pending');
+const status = document.getElementById('status');
+const composer = document.getElementById('composer');
+const send = document.getElementById('send');
+const reload = document.getElementById('reload');
+const draftNote = document.getElementById('draft-note');
+let boot = null;
+
+// Set once the form is on its way, so the draft handlers below stop writing:
+// the message belongs to the conversation now, not to the draft.
+let submitted = false;
+
+// Whether the field is holding a message that has been sent but not yet recorded.
+//
+// The text stays where it is until the transcript carries it, because a turn can
+// still be refused after the request was accepted — so for that stretch the field
+// holds something that is neither a draft nor gone.
+//
+// Both halves are needed. `submitted` covers the post itself and is cleared as
+// soon as it returns, which is seconds before the message appears;
+// `clearWhenLanded` covers the wait for it to appear.
+//
+// `clearWhenLanded` is declared below and read only when this is called, which is
+// never during the script's own evaluation.
+const holdingSent = () => submitted || clearWhenLanded !== null;
+
+// Whether the send button is currently offering to pull the message back.
+let cancelling = false;
+
+function setCancelMode(on) {
+  if (on === cancelling) return;
+  cancelling = on;
+
+  send.classList.toggle('cancelling', on);
+  send.title = on ? 'Cancel' : 'Send';
+  send.setAttribute('aria-label', send.title);
+  send.innerHTML = on ? CANCEL_SVG : SEND_SVG;
+}
+
+// The event count as it was when a message was sent, or null when nothing is in
+// flight. The field is emptied once the count moves past it, which is the first
+// moment the message is known to have been recorded rather than merely accepted.
+let clearWhenLanded = null;
+
+// Sealed while a message is on its way.
+//
+// The field still holds the text at that point — it is not released until the
+// message is recorded — so leaving it editable invites typing into a value that is
+// about to be cleared, and leaving Send live invites sending it twice.
+function lockComposer(locked) {
+  input.readOnly = locked;
+  send.disabled = locked;
+}
+const base = location.pathname.replace(/\/$/, '');
+const url = base + '/messages';
+const draftUrl = base + '/draft';
+
+// This tab's identity, so the server can tell a turn this window started from one
+// another window did. `sessionStorage` is per-tab and survives a reload, which is
+// the same lifetime a terminal session has.
+//
+// Never leaves the server: it exists to answer whether a turn is this window's,
+// and no other process has any use for that answer.
+const clientId = (() => {
+  try {
+    let id = sessionStorage.getItem('jp-client');
+    if (!id) {
+      id = Math.random().toString(36).slice(2) + Date.now().toString(36);
+      sessionStorage.setItem('jp-client', id);
+    }
+    return id;
+  } catch (e) {
+    // Private browsing, or storage denied. Turns then read as shared, which errs
+    // toward asking rather than assuming.
+    return '';
+  }
+})();
+
+// Size the app to what is actually visible.
+//
+// iOS shrinks the visual viewport for the keyboard without touching the layout
+// viewport. Chasing that with a sticky offset always trails by a frame and drifts
+// while the page scrolls, because iOS pans the visual viewport during a gesture.
+// Sizing the whole app to the visible height instead means the composer is simply
+// the last row of a box that fits: nothing to chase, nothing to drift.
+const visible = () => (window.visualViewport ? visualViewport.height : innerHeight);
+
+// How long to keep following after a change, and the single-frame jump above which
+// iOS is reporting a destination rather than a slide.
+const SETTLE_MS = 600;
+const STEP_PX = 24;
+
+// How much of the layout viewport the keyboard covers.
+//
+// The layout viewport keeps its full height on iOS while the visual viewport
+// shrinks and pans, so the difference between them is the keyboard.
+function keyboardInset() {
+  const vv = window.visualViewport;
+  if (!vv) return 0;
+  return Math.max(0, innerHeight - vv.height - vv.offsetTop);
+}
+
+// Publish the keyboard height for the composer to lift itself by.
+//
+// Compares against what was last written rather than against the previous
+// measurement. A change that lands between two frames — or before any loop starts,
+// which is what happens when the keyboard closes — is still a change from what is
+// on screen, and measuring against the reading would call it settled and leave the
+// stale value in place.
+let applied = -1;
+
+function fitApp() {
+  const inset = keyboardInset();
+  if (inset === applied) return;
+
+  // A large jump is iOS reporting the destination rather than the slide. That one
+  // gets eased; the small ones are the slide itself and are followed exactly.
+  document.documentElement.classList.toggle(
+    'eased',
+    applied >= 0 && Math.abs(inset - applied) > STEP_PX,
+  );
+
+  applied = inset;
+  document.documentElement.style.setProperty('--kb', inset + 'px');
+}
+
+// The composer's height, so the transcript can reserve room for it.
+//
+// Measured rather than assumed, because it changes: the field grows on focus, and
+// the status row appears while a turn runs. A fixed element takes no space of its
+// own, so without this the last message sits underneath it.
+// Rounded, and only when it moves by more than a pixel.
+//
+// The field's reported height wobbles by a pixel as focus comes and goes, and
+// writing that through shrinks the space reserved for the dock — which moves the
+// whole conversation down by a pixel for no reason anyone asked for.
+const dock = document.querySelector('.composer-dock');
+let dockHeight = 0;
+
+function fitDock() {
+  const height = Math.round(dock.getBoundingClientRect().height);
+  if (Math.abs(height - dockHeight) <= 1) return;
+
+  const wasDown = atBottom();
+  dockHeight = height;
+  document.documentElement.style.setProperty('--dock', height + 'px');
+  if (wasDown) toBottom();
+}
+
+// Follow the keyboard by sampling it, rather than by modelling it.
+//
+// iOS animates the keyboard over a duration it reports to native code and not to
+// the web, using an easing curve Apple has never published. Any transition here is
+// therefore a guess at both, and a guess that is close is still visibly out of
+// step with the thing it is imitating.
+//
+// Reading `visualViewport.height` every frame sidesteps the question: whatever the
+// curve and duration are, the height is the truth about where the keyboard is now.
+// Where iOS reports the slide in steps, this follows the steps; the eased class
+// below smooths the case where it reports the end state in one jump instead.
+//
+// Runs only in bursts around a viewport change, not continuously.
+let tracking = 0;
+function trackKeyboard() {
+  const until = performance.now() + SETTLE_MS;
+
+  // Extends the window a running loop already covers rather than starting a second
+  // one: viewport events arrive in bursts.
+  if (tracking > 0) {
+    tracking = until;
+    return;
+  }
+
+  tracking = until;
+
+  // Captured once, at the start: whether to hold the newest message against the
+  // composer is a question about where the reader was before the keyboard moved.
+  const wasDown = atBottom();
+
+  const step = () => {
+    fitApp();
+
+    // Each frame, because the composer is still moving over the content.
+    if (wasDown) toBottom();
+
+    if (performance.now() < tracking) {
+      requestAnimationFrame(step);
+      return;
+    }
+
+    tracking = 0;
+    if (wasDown) toBottom();
+  };
+
+  requestAnimationFrame(step);
+}
+
+// Keep `--kb` true for as long as the keyboard could be up.
+//
+// The burst above runs only when iOS reports a viewport change, and iOS does not
+// always report one: focus moved by script in particular can raise the keyboard
+// without a single `resize` or `scroll`. `--kb` then stays at zero, the dock
+// stays at the bottom of the layout viewport, and the composer is behind the
+// keyboard with nothing scheduled to notice.
+//
+// Sampling for as long as the field holds focus removes the dependency: whatever
+// iOS announces or does not, the height is read every frame and written when it
+// moves. A frame in which nothing moved costs one subtraction and a comparison.
+//
+// Deliberately not scrolling: that is the burst's job, and doing it every frame
+// for the life of a focus would fight the reader scrolling by hand.
+let watching = false;
+
+function watchKeyboard() {
+  if (watching) return;
+  watching = true;
+
+  const step = () => {
+    // Kept going after blur until the keyboard has finished retracting, which is
+    // the half that puts the dock back down.
+    if (document.activeElement !== input && keyboardInset() === 0) {
+      watching = false;
+      fitApp();
+      return;
+    }
+
+    fitApp();
+    requestAnimationFrame(step);
+  };
+
+  requestAnimationFrame(step);
+}
+
+// `resize` on the visual viewport reports the keyboard taking space; `scroll`
+// reports it being panned. The window's own `resize` covers the keyboard closing,
+// which iOS does not always report on the visual viewport at all.
+if (window.visualViewport) {
+  visualViewport.addEventListener('resize', trackKeyboard);
+  visualViewport.addEventListener('scroll', trackKeyboard);
+}
+addEventListener('resize', trackKeyboard);
+addEventListener('orientationchange', trackKeyboard);
+fitApp();
+
+// Stop iOS panning the page away, rather than trying to put it back.
+//
+// Tapping a field makes iOS focus it and pan the viewport so it clears the
+// keyboard, which carries the header off the top of the screen. Focusing the
+// field ourselves first, in the capture phase before the native tap flow gets
+// there, means iOS finds it already focused and skips the pan entirely.
+//
+// This is the part that works. Undoing the pan afterwards cannot: scrolling back
+// does not stick while the field holds focus, because iOS re-applies it to keep
+// the field visible — which is what every earlier attempt here ran into.
+//
+// `preventScroll` also suppresses the browser's own scroll-into-view. That costs
+// nothing here: the composer is a row of a box sized to the visible area, so it
+// is never behind the keyboard to begin with.
+document.addEventListener('touchstart', (event) => {
+  const target = event.target;
+  if (target?.matches?.('textarea, input') && document.activeElement !== target) {
+    target.focus({ preventScroll: true });
+  }
+}, { capture: true, passive: true });
+
+// Backgrounding the app with the keyboard open leaves the layout wrong on return:
+// iOS snapshots the focused state and keeps the page scrolled to hold the field in
+// view. Dropping focus is what releases that, and only then does resetting the
+// scroll stick.
+function blurField() {
+  const active = document.activeElement;
+  if (active?.matches?.('textarea, input')) active.blur();
+}
+
+function restore() {
+  blurField();
+
+  if (scrollY !== 0 || scrollX !== 0) scrollTo(0, 0);
+  const root = document.scrollingElement || document.documentElement;
+  if (root.scrollTop !== 0) root.scrollTop = 0;
+
+  fitApp();
+
+  // Coming back to the page is the moment its content is most likely to be
+  // stale, and a restored page runs no script on the way in: the timer is
+  // wherever it was left, up to three seconds away. Ask now instead of waiting
+  // for it.
+  poll();
+}
+
+addEventListener('pageshow', restore);
+document.addEventListener('visibilitychange', () => {
+  if (document.visibilityState === 'hidden') blurField();
+  else restore();
+});
+
+// One line when idle, grown to its content while focused.
+//
+// An unfocused composer is dead space in a conversation, so it collapses back to a
+// single row and gives the height to the transcript. Clearing the inline height
+// returns it to the one-row default from the markup, rather than guessing a pixel
+// value here.
+const input = composer.querySelector('textarea');
+
+// One row, measured once: what the field collapses back to when it is not being
+// typed in.
+const restHeight = (() => {
+  input.style.height = 'auto';
+  const height = input.scrollHeight;
+  input.style.height = height + 'px';
+  return height;
+})();
+function fitInput() {
+
+  // `auto` first so the field can shrink as well as grow, then the final height,
+  // both in one synchronous block: the browser paints once, at the end. Reading
+  // and restoring in between is what made this flicker.
+  //
+  // Always an explicit height, never cleared. The field's natural height differs
+  // from its measured one-row height by a fraction of a pixel, so letting it fall
+  // back on blur resizes the dock — which reserves space for itself, so the whole
+  // conversation shifts by a pixel every time focus comes and goes.
+  const current = input.style.height;
+
+  let wanted;
+  if (document.activeElement === input) {
+    input.style.height = 'auto';
+    wanted = Math.min(input.scrollHeight, visible() / 3) + 'px';
+  } else {
+    wanted = restHeight + 'px';
+  }
+
+  // Nothing to do, and nothing to scroll. Most keystrokes land here: a line only
+  // wraps occasionally, and re-scrolling on every character is what made typing
+  // shove the conversation up and down.
+  if (wanted === current) {
+    input.style.height = current;
+    return;
+  }
+
+  const wasDown = atBottom();
+  input.style.height = wanted;
+  if (wasDown) toBottom();
+}
+input.addEventListener('input', fitInput);
+
+// Cmd+Enter sends, as in every other composer.
+//
+// `requestSubmit` rather than `submit`: it raises the submit event, which is what
+// posts in the background and keeps the text until the message lands. `submit`
+// would bypass all of that and navigate.
+input.addEventListener('keydown', (event) => {
+  if (event.key !== 'Enter' || !(event.metaKey || event.ctrlKey)) return;
+
+  event.preventDefault();
+  composer.requestSubmit();
+});
+
+// Escape gives the keyboard back to the page, so the shortcuts below are reachable
+// again without reaching for the mouse.
+input.addEventListener('keydown', (event) => {
+  if (event.key === 'Escape') input.blur();
+});
+
+// What the next message runs under: the `--cfg` arguments the chooser holds, in
+// the order they apply.
+//
+// Kept here rather than on the server: nothing is applied until a message is
+// sent, so this is a choice in progress, not state the conversation has.
+const configModal = document.getElementById('config-modal');
+const configGroups = document.getElementById('config-groups');
+let chosenCfg = [];
+let configsLoaded = false;
+
+document.getElementById('open-config').addEventListener('click', async () => {
+  nav.open = false;
+  configModal.showModal();
+  await loadConfigs();
+
+  // The rows outlive the choice: the list is fetched once, and what is chosen
+  // is spent when a message is sent. Rewriting it on every open keeps the rows
+  // saying what the next message will actually run under.
+  window.jpConfigList.write(configGroups, chosenCfg);
+});
+
+// The chooser is rendered by the server, which is what keeps it identical to the
+// one on the new-conversation page: same grouping, same headings, same fields.
+async function loadConfigs() {
+  if (configsLoaded) return;
+
+  try {
+    const r = await fetch('/configs');
+    if (!r.ok) throw new Error(r.status);
+
+    configGroups.innerHTML = await r.text();
+    configsLoaded = true;
+  } catch (e) {
+    configGroups.textContent = '';
+    const failed = document.createElement('p');
+    failed.className = 'composer-error';
+    failed.textContent = 'Could not read the available configurations.';
+    configGroups.append(failed);
+  }
+}
+
+// Cancel puts the previous choice back; apply takes what is in the form.
+//
+// A cancelled dialog must not leave its edits on screen: reopening it would show
+// rows no message is going to run under.
+configModal.addEventListener('close', () => {
+  if (configModal.returnValue === 'apply') {
+    chosenCfg = window.jpConfigList.read(configGroups);
+  } else {
+    window.jpConfigList.write(configGroups, chosenCfg);
+  }
+
+  document.getElementById('open-config').classList.toggle('active', chosenCfg.length > 0);
+});
+
+// A larger field for a longer reply.
+//
+// The same value, not a second draft: the small field is the one that gets sent,
+// so this copies in on open and back out on close.
+const expanded = document.getElementById('expanded');
+const expandModal = document.getElementById('expand-modal');
+
+document.getElementById('expand').addEventListener('click', () => {
+  expanded.value = input.value;
+  expandModal.showModal();
+  expanded.focus();
+  expanded.setSelectionRange(expanded.value.length, expanded.value.length);
+});
+
+expandModal.addEventListener('close', () => {
+  input.value = expanded.value;
+  fitInput();
+  saveDraft();
+});
+
+// Quote what is selected.
+//
+// Back to markdown rather than plain text: the transcript is rendered markdown, so
+// a quote of it should read as what was written, not as its rendering flattened.
+// A subset — the block and inline elements the renderer emits — and anything else
+// falls through to its text.
+function toMarkdown(node) {
+  if (node.nodeType === Node.TEXT_NODE) return node.textContent;
+  if (node.nodeType !== Node.ELEMENT_NODE) return '';
+
+  const inner = () => Array.from(node.childNodes).map(toMarkdown).join('');
+
+  switch (node.tagName) {
+    case 'BR': return '\n';
+    case 'P': return inner() + '\n\n';
+    case 'PRE': return '```\n' + node.textContent.replace(/\n$/, '') + '\n```\n\n';
+    case 'CODE': return node.closest('pre') ? node.textContent : '`' + inner() + '`';
+    case 'STRONG': case 'B': return '**' + inner() + '**';
+    case 'EM': case 'I': return '*' + inner() + '*';
+    case 'DEL': return '~~' + inner() + '~~';
+    case 'A': return '[' + inner() + '](' + (node.getAttribute('href') ?? '') + ')';
+    case 'LI': return '- ' + inner().trim() + '\n';
+    case 'UL': case 'OL': return inner() + '\n';
+    case 'BLOCKQUOTE':
+      return inner().trim().split('\n').map(line => '> ' + line).join('\n') + '\n\n';
+    case 'H1': case 'H2': case 'H3': case 'H4': case 'H5': case 'H6':
+      return '#'.repeat(Number(node.tagName[1])) + ' ' + inner() + '\n\n';
+    case 'HR': return '---\n\n';
+    default: return inner();
+  }
+}
+
+// The tap that reaches the button is the same tap that dismisses the selection,
+// so on a touch screen the handler below runs with nothing selected. The last
+// selection made in the transcript is kept for it to fall back on.
+let lastRange = null;
+
+document.addEventListener('selectionchange', () => {
+  const selection = getSelection();
+  if (!selection || selection.isCollapsed || !selection.rangeCount) return;
+
+  // Only the transcript: quoting the draft back into the draft is never the ask.
+  const range = selection.getRangeAt(0);
+  if (!transcript.contains(range.commonAncestorContainer)) return;
+
+  lastRange = range.cloneRange();
+});
+
+document.getElementById('quote').addEventListener('click', () => {
+  const selection = getSelection();
+  const range = selection && !selection.isCollapsed && selection.rangeCount
+    ? selection.getRangeAt(0)
+    : lastRange;
+  if (!range) return;
+
+  // The selection as its own tree, so partial elements come back whole rather
+  // than as the text between two points.
+  //
+  // A remembered range can outlive what it points at, because the poller
+  // replaces blocks as a turn lands.
+  let fragment;
+  try {
+    fragment = range.cloneContents();
+  } catch (error) {
+    lastRange = null;
+    return;
+  }
+
+  const markdown = Array.from(fragment.childNodes).map(toMarkdown).join('').trim();
+  if (!markdown) return;
+
+  const quoted = markdown.split('\n').map(line => ('> ' + line).trimEnd()).join('\n');
+
+  // Appended, so quoting twice builds up rather than replacing.
+  input.value = input.value ? input.value.replace(/\s*$/, '\n\n') + quoted + '\n\n' : quoted + '\n\n';
+  fitInput();
+  input.focus();
+  input.setSelectionRange(input.value.length, input.value.length);
+  saveDraft();
+
+  // Spent: tapping again with nothing selected should do nothing, rather than
+  // quote the same passage twice.
+  lastRange = null;
+});
+
+// Renaming, in place.
+//
+// The heading and the field swap rather than the heading becoming editable: a
+// form gets Enter-to-submit and a real input for free, and the title is short
+// enough that losing the heading's styling for a moment costs nothing.
+const heading = document.getElementById('title');
+const renameForm = document.getElementById('rename-form');
+const titleField = document.getElementById('title-field');
+const renameButton = document.getElementById('rename');
+
+function showRename(editing) {
+  heading.hidden = editing;
+  renameButton.hidden = editing;
+  renameForm.hidden = !editing;
+
+  if (editing) {
+    titleField.value = heading.textContent.trim();
+    titleField.focus();
+    titleField.select();
+  }
+}
+
+renameButton.addEventListener('click', () => showRename(true));
+document.getElementById('rename-cancel').addEventListener('click', () => showRename(false));
+
+// Escape backs out; Enter commits. Both are handled here rather than left to the
+// form, because a form inside a header is not reliably submitted by Enter and
+// Escape would otherwise reach the dialog machinery instead.
+titleField.addEventListener('keydown', (event) => {
+  if (event.key === 'Escape') {
+    event.preventDefault();
+    event.stopPropagation();
+    showRename(false);
+    return;
+  }
+
+  if (event.key === 'Enter') {
+    event.preventDefault();
+    renameForm.requestSubmit();
+  }
+});
+
+renameForm.addEventListener('submit', async (event) => {
+  event.preventDefault();
+
+  const title = titleField.value.trim();
+
+  try {
+    const r = await fetch(renameForm.action, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded',
+        accept: 'application/json',
+      },
+      body: new URLSearchParams({ title }),
+    });
+    if (!r.ok) throw new Error(r.status);
+
+    // Applied here rather than reloading, so the transcript and the scroll stay
+    // where they are.
+    heading.textContent = title || 'Untitled';
+    document.title = (title || 'Untitled') + ' - JP';
+    showRename(false);
+  } catch (e) {
+    titleField.setCustomValidity('Could not rename this conversation.');
+    titleField.reportValidity();
+    titleField.setCustomValidity('');
+  }
+});
+
+// Stopping posts in the background, like everything else here.
+//
+// The control is a real form so it works without script, but letting it navigate
+// means a full reload — and the page that comes back still shows the turn as
+// running, because the lock is held until it has finished unwinding. That reads
+// as the button having done nothing.
+//
+// Delegated, so it covers both the form the server renders and the one the poller
+// builds. A handler on the form itself may already have asked for confirmation
+// and been declined; that shows up as the event being cancelled, and is left
+// alone.
+status.addEventListener('submit', async (event) => {
+  const form = event.target.closest('.composer-stop');
+  if (!form || event.defaultPrevented) return;
+
+  event.preventDefault();
+
+  try {
+    await fetch(form.action, {
+      method: 'POST',
+      headers: { accept: 'application/json' },
+    });
+  } catch (e) {
+    // The poll reports what actually happened either way.
+  }
+
+  poll();
+});
+
+// The header is a way back to the top, matching the platform gesture this page
+// cannot receive: with the document pinned to the window, there is no window
+// scroll position for iOS to reset when the status bar is tapped.
+//
+// Ignores clicks on the links inside it, which have somewhere else to go.
+document.querySelector('.page-header').addEventListener('click', (event) => {
+  // The links and the rename controls inside it have their own jobs.
+  if (event.target.closest('a, button, form')) return;
+
+  transcript.scrollTop = 0;
+});
+
+// Older events, fetched as the reader scrolls back to them.
+//
+// The page holds a window rather than the whole conversation: a long one is
+// thousands of nodes, and painting them all is what made scrolling crawl.
+//
+// Prepending moves everything down by the height of what was added, so the scroll
+// position is corrected by that much — otherwise the reader is thrown backwards
+// by exactly the amount they just gained.
+async function loadOlder(all) {
+  if (loadingOlder || !older()) return false;
+  loadingOlder = true;
+
+  try {
+    const r = await fetch(
+      url + '?before=' + box.dataset.first + (all ? '&all=1' : ''),
+    );
+    if (!r.ok) return false;
+
+    const d = await r.json();
+    if (d.html === undefined) return false;
+
+    const before = transcript.scrollHeight;
+    box.insertAdjacentHTML('afterbegin', d.html);
+    box.dataset.first = d.from;
+    transcript.scrollTop += transcript.scrollHeight - before;
+
+    return true;
+  } catch (e) {
+    return false;
+  } finally {
+    loadingOlder = false;
+  }
+}
+
+// Everything older, in one request rather than a window at a time: a conversation
+// of several thousand events is dozens of round trips that way, and the reader is
+// left watching the scrollbar twitch.
+const loadAllOlder = () => loadOlder(true);
+
+// Fetched well before the reader arrives, so scrolling back at a normal pace
+// never meets the top of what is loaded. A window is large enough that this
+// rarely fires twice in a row.
+transcript.addEventListener('scroll', () => {
+  if (transcript.scrollTop < 3000) loadOlder(false);
+}, { passive: true });
+
+// Touch platforms take the whole conversation up front.
+//
+// Windowing exists because painting a long transcript is slow on a desktop
+// browser; on touch it never was, and there the fetching is the only thing the
+// reader would notice. So they get what they had: everything, once, and no pauses
+// while scrolling back.
+if (!matchMedia('(hover: hover) and (pointer: fine)').matches) {
+  addEventListener('load', () => loadAllOlder());
+}
+
+// Jumps between turns.
+//
+// A turn starts at its separator, so those are the anchors. `prev` and `next` are
+// relative to what is at the top of the view rather than to a remembered position,
+// which keeps the buttons honest after scrolling by hand.
+const nav = document.getElementById('nav');
+
+function turnStarts() {
+  return Array.from(transcript.querySelectorAll('.turn-separator'));
+}
+
+function jump(where) {
+  if (where === 'top') {
+    // The whole conversation, then the top of it. Anything less would land at the
+    // top of the window rather than the top of the conversation, which is not what
+    // the button says.
+    loadAllOlder().then(() => { transcript.scrollTop = 0; });
+    return;
+  }
+
+  if (where === 'bottom') {
+    toBottom();
+    return;
+  }
+
+  const starts = turnStarts();
+  if (starts.length === 0) return;
+
+  // Offsets within the scroller, which is what `scrollTop` is measured against.
+  const tops = starts.map(el => el.offsetTop - transcript.offsetTop);
+
+  // A few pixels of slack, so a jump that lands a hair past a separator does not
+  // count as already being below it.
+  const here = transcript.scrollTop + 2;
+
+  const target = where === 'next'
+    ? tops.find(top => top > here)
+    : tops.filter(top => top < here - 4).pop();
+
+  if (target !== undefined) transcript.scrollTop = target;
+}
+
+nav.addEventListener('click', (event) => {
+  const button = event.target.closest('[data-nav]');
+  if (!button) return;
+
+  jump(button.dataset.nav);
+});
+
+// Deliberately no close-on-outside-click: the menu is for jumping around a
+// conversation, and every jump is a click on the thing being navigated. Closing
+// on those would mean reopening it between each one.
+
+// Single-key shortcuts for the controls around the transcript.
+//
+// The buttons are clicked rather than their handlers called, so a shortcut can
+// never drift from what the control it stands for does — `r` is a no-op without a
+// selection for the same reason the Quote button is.
+//
+// Held back while a field has focus or a dialog is up: those own the keyboard, and
+// a `c` typed into a reply must stay a `c`.
+const typing = () => document.activeElement?.matches?.('textarea, input');
+
+document.addEventListener('keydown', (event) => {
+  if (event.metaKey || event.ctrlKey || event.altKey || event.isComposing) return;
+  if (typing() || document.querySelector('dialog[open]')) return;
+
+  const press = (id) => document.getElementById(id).click();
+
+  switch (event.key) {
+    case 'r': press('quote'); break;
+    case 'c': press('open-config'); break;
+    case 'e': press('expand'); break;
+    case '/': input.focus(); break;
+    case '[': jump('prev'); break;
+    case ']': jump('next'); break;
+    case 'Home': jump('top'); break;
+    case 'End': jump('bottom'); break;
+    default: return;
+  }
+
+  // Only for a key that was handled: `/` would otherwise be typed into the field
+  // it just focused, and Home and End would scroll the document behind the app.
+  event.preventDefault();
+});
+
+// The transcript is the scroller, not the window.
+const atBottom = () =>
+  transcript.scrollTop + transcript.clientHeight >= transcript.scrollHeight - 80;
+// Scroll to the end.
+//
+// An element is scrolled into view rather than `scrollTop` set to `scrollHeight`,
+// because that height is a lie while messages further up are still skipped: it is
+// built from their estimates, so setting it lands short and the view stops an
+// event or two above the newest.
+const toBottom = () => {
+  // The anchor, not the last child: the last child is the status row, which is
+  // `display: none` whenever there is nothing to say, and scrolling a box-less
+  // element into view does nothing at all.
+  //
+  // The anchor always has a box, and is not a message — so it is never one of the
+  // elements whose height is being estimated. Aiming at it is the one way to reach
+  // the true end while the extent is still a guess.
+  end.scrollIntoView({ block: 'end' });
+};
+
+// Stay at the end until it stops moving.
+//
+// One scroll is not enough after the transcript is replaced. Every message is
+// recreated, so every one of them is unseen again and reports the placeholder
+// height instead of its own; the extent collapses, the scroll lands on that false
+// end, and then the messages near the viewport are laid out for real and the true
+// end moves away below. From the reader's seat the view drifts upward, which is
+// the opposite of what was asked for.
+//
+// So: scroll, look at whether the extent changed, and go again until it holds
+// still. It converges quickly, because each pass realises the messages it just
+// scrolled past.
+//
+// Bounded in time rather than in passes, because a slow frame should not end the
+// chase early, and an extent that never settles must not spin forever.
+let settling = 0;
+
+function stayAtBottom() {
+  const until = performance.now() + 600;
+
+  // A pass already running just gets more time, rather than a second pass
+  // racing it.
+  if (settling > 0) {
+    settling = until;
+    return;
+  }
+
+  settling = until;
+  let previous = -1;
+
+  const step = () => {
+    toBottom();
+
+    const height = transcript.scrollHeight;
+    const held = height === previous;
+    previous = height;
+
+    if (!held && performance.now() < settling) {
+      requestAnimationFrame(step);
+      return;
+    }
+
+    settling = 0;
+  };
+
+  requestAnimationFrame(step);
+}
+
+// Registered here rather than at the declaration: `fitDock` reads the scroll
+// helpers above, which are not initialised until this point.
+if (window.ResizeObserver) new ResizeObserver(fitDock).observe(dock);
+
+fitInput();
+fitDock();
+toBottom();
+
+// Reveal once the conversation is in place.
+//
+// A long transcript paints top-down over seconds, so without this the reader
+// watches it stream past from the beginning and then jump to the end. The overlay
+// covers that, and comes off after a frame in which the scroll has been applied.
+// Settled, not applied: messages out of view are skipped until scrolled near and
+// report an estimated height until then, so scrolling to the end lands short, the
+// messages there are laid out for real, and the end moves. Repeating until the
+// height stops changing converges on the actual bottom, and the veil covers it.
+function reveal() {
+  // The same chase the poller uses after a swap: on first paint no message has
+  // been measured either, so the end moves for the same reason.
+  stayAtBottom();
+
+  // Uncovered once that has had its window, so the settling happens behind the
+  // veil rather than in front of the reader.
+  setTimeout(() => document.documentElement.classList.add('ready'), 650);
+}
+
+if (document.readyState === 'complete') reveal();
+else addEventListener('load', reveal);
+
+// A cap, so a page that never fires `load` — a stalled image, a slow font — is
+// still usable. Better to reveal a conversation mid-scroll than to hold a blank
+// screen over a working page.
+setTimeout(() => document.documentElement.classList.add('ready'), 3000);
+
+// Both edges, and before the first viewport event: the keyboard starts moving on
+// focus and on blur, and iOS may report nothing until it has finished. Without the
+// blur half, the column stays at its keyboard-open height after the keyboard has
+// gone.
+input.addEventListener('focus', () => { fitInput(); trackKeyboard(); watchKeyboard(); });
+input.addEventListener('blur', () => { fitInput(); trackKeyboard(); watchKeyboard(); });
+
+// Pre-emptively, before iOS snapshots the page with the field still focused.
+addEventListener('pagehide', blurField);
+
+// Draft sync.
+//
+// The same file `jp query` uses, so a message can be started in a terminal and
+// finished here, or the reverse, and a reload never loses what was typed.
+//
+// Writes are conditional on the revision last read: if the terminal changed the
+// draft in the meantime the host refuses, hands back what is on disk, and this
+// says so rather than overwriting it. Losing typing is the thing being avoided,
+// so a refusal is the correct outcome, not a failure.
+let revision = null;
+let saving = false;
+
+// The newest content waiting for an in-flight save to finish. A boolean would
+// lose it: the retry would re-read the field, which is wrong for a save that was
+// asked to store something specific.
+let queued = null;
+
+// Bounds the automatic re-save below, so a draft that keeps being cleared under
+// us cannot turn into a request loop.
+let retried = false;
+
+async function loadDraft() {
+  try {
+    const r = await fetch(draftUrl);
+    if (!r.ok) return;
+    const d = await r.json();
+    revision = d.revision ?? null;
+
+    // Never clobber something already being typed — a slow read must not win
+    // against the person at the keyboard.
+    if (d.content && !input.value) {
+      input.value = d.content;
+      fitInput();
+    }
+  } catch (e) {
+    // No draft is a normal state; a failed read is not worth a message.
+  }
+}
+
+// `content` defaults to what is in the field. Passing it explicitly is how the
+// submit path clears the stored draft without touching the field — emptying the
+// textarea during submit makes the form post an empty message, because the
+// browser serialises it after the handler runs.
+async function saveDraft(content) {
+  // A message that has been sent but not yet recorded is not a draft, however
+  // much it looks like one sitting there in the field. Storing it would write
+  // back the draft the host deleted when it turned the message into a request,
+  // and the next visit to this conversation would offer to send it again.
+  //
+  // Here rather than at each caller: blur, `pagehide`, the expanded editor
+  // closing and a quote being inserted all save what is in the field, and the
+  // window this guards against is open for as long as the host takes to record
+  // the request.
+  // `saveDraft('')` is how the draft is cleared once the message does land, and
+  // that is named content, so it still goes through.
+  if (content === undefined && holdingSent()) return;
+
+  const text = content ?? input.value;
+
+  // Nothing here and nothing recorded means nothing to say. Writing anyway would
+  // assert there is no draft, against one another device just wrote, and come back
+  // as a conflict about text this one never had.
+  if (!text && revision === null) return;
+
+  if (saving) { queued = text; return; }
+  saving = true;
+
+  try {
+    const r = await fetch(draftUrl, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      // Survives the navigation a submit triggers.
+      keepalive: true,
+      body: JSON.stringify({ content: text, revision }),
+    });
+    if (!r.ok) return;
+    const d = await r.json();
+
+    // A draft that has gone *empty* underneath us is not somebody else's edit:
+    // the host clears it when it turns a message into a request, which leaves
+    // this page holding a revision for a file that no longer exists. Adopt the
+    // new revision and put the text back, rather than reporting a conflict that
+    // has no other party.
+    //
+    // Not while a sent message is still in the field, though — that is the same
+    // deletion, and writing the text back there is what would offer it again on
+    // the next visit.
+    if (d.conflict && !d.content) {
+      revision = d.revision ?? null;
+      draftNote.hidden = true;
+
+      if (input.value && !retried && !holdingSent()) {
+        retried = true;
+        queued = input.value;
+      }
+    } else if (d.conflict) {
+      // The revision deliberately stays where it was, which keeps every later
+      // save refused too.
+      //
+      // Adopting the one that came back would make the next keystroke's save
+      // match, succeed, and quietly overwrite the text this refusal exists to
+      // protect — while the note on screen still said it was safe on disk.
+      // Which version wins is a thing to be asked for, not something a debounce
+      // decides.
+      showConflict(d.content, d.revision ?? null);
+    } else {
+      revision = d.revision ?? null;
+      draftNote.hidden = true;
+      retried = false;
+    }
+  } catch (e) {
+    // Offline or mid-restart. The next keystroke tries again.
+  } finally {
+    saving = false;
+    if (queued !== null) {
+      const next = queued;
+      queued = null;
+      saveDraft(next);
+    }
+  }
+}
+
+// Say the save was refused, and offer the two ways out of it.
+//
+// Both versions survive until one is chosen: theirs is on disk, ours is in the
+// field, and nothing overwrites either in the meantime.
+// `theirRevision` is what either choice has to write against, since it names
+// what is actually there now.
+function showConflict(theirs, theirRevision) {
+  draftNote.textContent = 'This draft was changed elsewhere. Nothing was saved. ';
+  draftNote.hidden = false;
+
+  const take = document.createElement('button');
+  take.type = 'button';
+  take.className = 'draft-resolve';
+  take.textContent = 'Take theirs';
+  take.addEventListener('click', () => {
+    // No write: the field now holds exactly what is on disk, so there is
+    // nothing to store, only a revision to catch up with.
+    input.value = theirs;
+    fitInput();
+    resolveConflict(theirRevision);
+  });
+
+  const keep = document.createElement('button');
+  keep.type = 'button';
+  keep.className = 'draft-resolve';
+  keep.textContent = 'Keep mine';
+  keep.addEventListener('click', () => {
+    resolveConflict(theirRevision);
+    saveDraft();
+  });
+
+  draftNote.append(take, keep);
+}
+
+// Accept what is on disk as the version being edited from.
+//
+// The one place the revision moves after a refusal, and it takes somebody
+// pressing a button. A save that follows this is an answer to the question the
+// refusal asked; a save that beat it to the revision would just be an accident.
+function resolveConflict(theirRevision) {
+  revision = theirRevision;
+  retried = false;
+  draftNote.textContent = '';
+  draftNote.hidden = true;
+}
+
+let saveTimer = null;
+input.addEventListener('input', () => {
+  clearTimeout(saveTimer);
+  saveTimer = setTimeout(() => saveDraft(), 600);
+});
+
+// Leaving the field, or the page, is the last chance to keep what is there.
+input.addEventListener('blur', () => saveDraft());
+addEventListener('pagehide', () => saveDraft());
+
+// Send without navigating.
+//
+// A form post would reload the page: the transcript is rebuilt, the scroll jumps,
+// the draft is re-read, and the composer loses focus and its height — all to show
+// a message the poller was about to bring in anyway. Posting in the background
+// leaves the page exactly as it was.
+//
+// The form still works without JavaScript; the handler is what suppresses the
+// navigation, and the endpoint answers both shapes.
+composer.addEventListener('submit', async (event) => {
+  event.preventDefault();
+
+  // In cancel mode the button pulls the message back rather than sending one.
+  //
+  // No confirmation: this page started the turn moments ago, which is what `own`
+  // means. Stopping a turn someone else started asks first, from the indicator's
+  // stop button.
+  if (cancelling) {
+    try {
+      await fetch(location.pathname.replace(/\/$/, '') + '/interrupt', {
+        method: 'POST',
+        headers: { accept: 'application/json' },
+      });
+    } catch (e) {
+      // The poll reports what actually happened either way.
+    }
+    poll();
+    return;
+  }
+
+  const content = input.value.trim();
+  if (!content) return;
+
+  submitted = true;
+  clearTimeout(saveTimer);
+  lockComposer(true);
+
+  // Left in the field on purpose, and cleared only once the message is in the
+  // transcript. A turn can be refused after the request has been accepted — the
+  // conversation may be locked by another process — and clearing on send would
+  // destroy the message on the way to finding that out.
+  const landedAbove = Number(box.dataset.count);
+
+  try {
+    const response = await fetch(composer.action, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded',
+        accept: 'application/json',
+      },
+      body: (() => {
+        // `count` is what the provisional copy of this message is retired
+        // against: the request is recorded as soon as the transcript grows past
+        // it, which the server cannot work out from the transcript alone.
+        const params = new URLSearchParams({
+          content,
+          client: clientId,
+          count: String(landedAbove),
+        });
+        // One entry per row, in the order the rows sit in: the same shape
+        // `--cfg` takes, repeated.
+        for (const argument of chosenCfg) params.append('cfg', argument);
+        return params;
+      })(),
+    });
+
+    const body = await response.json();
+
+    // Refused, not failed: the text stays where it is and the reason is shown.
+    if (!response.ok) {
+      draftNote.textContent = body.error ?? 'The message was not sent.';
+      draftNote.hidden = false;
+      lockComposer(false);
+      submitted = false;
+      return;
+    }
+
+    // Rendered by the server from the message just sent, so it is the same markup
+    // the transcript will carry and the swap moves nothing.
+    draftNote.hidden = true;
+    showPending(body.pending);
+
+    // The chase, not one scroll: the ghost is a message like any other, and is no
+    // more measured than the rest.
+    stayAtBottom();
+  } catch (e) {
+    lockComposer(false);
+    submitted = false;
+    return;
+  }
+
+  // Free for the next message, including one meant to interrupt this turn.
+  submitted = false;
+  clearWhenLanded = landedAbove;
+
+  // The choice is spent, because `--cfg` is a change from this message onward
+  // rather than a setting for one message. The host merges what was named into
+  // the conversation's own configuration and records the difference, so naming
+  // it again next turn layers it over a configuration that already has it — and
+  // for an appending field, such as a system prompt a configuration adds to,
+  // that appends a second copy and the conversation keeps it for every turn
+  // after.
+  chosenCfg = [];
+  document.getElementById('open-config').classList.remove('active');
+
+  poll();
+});
+
+loadDraft();
+
+// The server renders this, so it matches the real request exactly rather than
+// approximating it in the DOM.
+function showPending(html) {
+  if (pending.dataset.html === (html ?? '')) return;
+  pending.dataset.html = html ?? '';
+  pending.innerHTML = html ?? '';
+}
+
+// Which disclosure blocks are open, so a swap doesn't collapse what is being
+// read. The transcript only ever grows, so position is a stable key: blocks
+// appended by the swap start closed, and everything before them keeps its state.
+function openBlocks() {
+  return Array.from(box.querySelectorAll('details')).map(d => d.open);
+}
+
+function restoreBlocks(open) {
+  box.querySelectorAll('details').forEach((d, i) => {
+    if (open[i]) d.open = true;
+  });
+}
+
+function showStatus(running, error, stopMode) {
+  const stoppable = stopMode === 'own' || stopMode === 'shared';
+  if (error) {
+    status.dataset.running = 'false';
+    status.textContent = '';
+    const p = document.createElement('p');
+    p.className = 'composer-error';
+    p.textContent = error;
+    status.append(p);
+    return;
+  }
+
+  const state = String(running) + ':' + String(stopMode);
+  if (state === status.dataset.running) return;
+  status.dataset.running = state;
+  status.textContent = '';
+  if (running) {
+    const s = document.createElement('span');
+    s.className = 'composer-working';
+    s.role = 'status';
+    s.ariaLabel = 'Working';
+    s.append(...[0, 1, 2].map(() => document.createElement('i')));
+    status.append(s);
+
+    // Offered only for a turn this server is running: an interrupt reaches its
+    // own host, and a turn started elsewhere is another process's to stop.
+    if (stopMode === 'unreachable') {
+      const why = document.createElement('span');
+      why.className = 'composer-hint';
+      why.textContent =
+        'Another process is running this turn; it can only be stopped there.';
+      status.append(why);
+    }
+
+    if (stoppable) {
+      const stop = document.createElement('form');
+      stop.className = 'composer-stop';
+      stop.method = 'post';
+      stop.action = base + '/interrupt';
+
+      // Somebody else's work: stoppable, since this server is running it, but
+      // not without asking. Their window has no say in it and no warning that
+      // it happened.
+      if (stopMode === 'shared') {
+        stop.addEventListener('submit', (event) => {
+          const ok = confirm(
+            'This turn was started in another window. Stop it anyway?',
+          );
+          if (!ok) event.preventDefault();
+        });
+      }
+
+      const button = document.createElement('button');
+      button.type = 'submit';
+      button.title = 'Stop';
+      button.setAttribute('aria-label', 'Stop');
+      // The same barred circle the server renders, so the swap is invisible.
+      button.innerHTML =
+        `<svg viewBox='0 0 24 24' width='18' height='18' fill='none'`
+        + ` stroke='currentColor' stroke-width='2' stroke-linecap='round'`
+        + ` aria-hidden='true'><circle cx='12' cy='12' r='9'></circle>`
+        + `<path d='M8 12h8'></path></svg>`;
+
+      stop.append(button);
+      status.append(stop);
+    }
+  }
+
+  // The indicator sits at the end of the conversation, so appearing or going
+  // away changes its height.
+  if (atBottom()) toBottom();
+}
+
+// Polls overlap: the timer's and the one fired right after a submit. A slow
+// earlier response arriving after a newer one would put the older state back,
+// blanking a working indicator that had just appeared. Only the newest applies.
+let pollSeq = 0;
+
+async function poll() {
+  const seq = ++pollSeq;
+
+  try {
+    // The count we already have, so the answer can leave the transcript out when
+    // it has not changed. Rendering it is the whole conversation's markdown, and
+    // most polls change nothing.
+    const r = await fetch(
+      url + '?count=' + box.dataset.count
+        + '&settled=' + settledFloor
+        + '&client=' + encodeURIComponent(clientId),
+    );
+    if (!r.ok || seq !== pollSeq) return;
+    const d = await r.json();
+    if (seq !== pollSeq) return;
+
+    // A different server means this page's markup and styles are stale. Data
+    // recovers by itself; the page cannot.
+    if (boot === null) {
+      boot = d.boot;
+    } else if (d.boot !== boot) {
+      reload.hidden = false;
+    }
+
+    // Taken before anything is inserted. Asking afterwards always says no: the
+    // content has grown by then, so the scroll position is no longer near the
+    // end even though it was a moment ago.
+    const wasDown = atBottom();
+
+    // Present only when the server had something the page does not.
+    //
+    // `from` says whether it continues the transcript or replaces it. Continuing
+    // is the normal case, and it leaves every message already on the page alone:
+    // their open blocks stay open, their measured heights stay measured, and the
+    // scroll position means the same thing before and after.
+    if (d.html !== undefined) {
+      box.dataset.count = d.count;
+
+      const first = Number(box.dataset.first);
+
+      if (d.from < first) {
+        // Older than anything held, which means the transcript was rewritten
+        // under us — compacted, or edited on disk. Nothing can be carried across,
+        // so the open blocks are restored by position.
+        const open = openBlocks();
+        box.innerHTML = d.html;
+        box.dataset.first = d.from;
+        restoreBlocks(open);
+      } else {
+        // Everything from `from` onward is replaced, not appended.
+        //
+        // Usually that is nothing but new events on the end. It is more when the
+        // tail is still moving: a tool call shows its request first and its result
+        // later, and the entry that has to change is one the page already holds.
+        // `from` reaches back to the earliest entry this page drew provisionally,
+        // so a call that has resolved since is rewritten along with everything
+        // after it.
+        //
+        // Open blocks are captured across the whole transcript, not just the part
+        // being kept: the replaced events come back in the same order, so their
+        // positions still line up — and a disclosure the reader opened inside a
+        // finished tool call must not snap shut once a second because an earlier
+        // call is still running.
+        const keep = d.from - first;
+        const open = openBlocks();
+
+        while (box.children.length > keep) box.lastElementChild.remove();
+        box.insertAdjacentHTML('beforeend', d.html);
+        restoreBlocks(open);
+      }
+    }
+
+    // Where this page's copy goes provisional from here on. Everything from
+    // `from` upward has just been redrawn, so the server's boundary is also this
+    // page's.
+    settledFloor = d.settled;
+
+    // The message reached the transcript, so the field can let go of it.
+    if (clearWhenLanded !== null && d.count > clearWhenLanded) {
+      clearWhenLanded = null;
+      input.value = '';
+      fitInput();
+      saveDraft('');
+    }
+
+    // A refused turn leaves the text where it is, to be sent again or edited.
+    if (d.error) clearWhenLanded = null;
+
+    showPending(d.pending);
+
+    // The ghost and the indicator mean different things and must not both be up:
+    // the ghost says the request has not been taken yet, the dots say a reply is
+    // being written. Together they read as an answer to a message that has not
+    // arrived.
+    // `stop` is a mode, not a flag: `own`, `shared`, `none` or `unreachable`.
+    // `showStatus` wants the mode, because it renders differently for each; the
+    // rest here only needs to know whether stopping is possible at all.
+    const stoppable = d.stop === 'own' || d.stop === 'shared';
+
+    const awaitingSend = Boolean(d.pending);
+    showStatus(!awaitingSend && d.running, d.error, d.stop);
+
+    // While the ghost is up, Send offers to pull the message back instead — the
+    // window in which a typo is still worth catching. Once it lands, the button
+    // returns to Send and the indicator takes over the stopping.
+    setCancelMode(awaitingSend && stoppable);
+
+    // The field is held while the message is in flight, but the button is not: it
+    // is the way out of that state.
+    input.readOnly = clearWhenLanded !== null;
+    send.disabled = cancelling ? false : d.running && !stoppable;
+
+    // Anything newly arrived needs the chase, appended or not: a message that has
+    // not been measured reports a placeholder height, and for a tall one that is a
+    // large undershoot — scroll to that end and the real height then pushes the
+    // end below the fold. A short one overshoots instead, which is why single-line
+    // tool calls always looked fine.
+    //
+    // Everything else has not moved the extent, so one scroll is enough.
+    if (wasDown) {
+      if (d.html !== undefined) stayAtBottom();
+      else toBottom();
+    }
+  } catch (e) {
+    // A failed poll is not worth reporting: the next one is a second away.
+  }
+}
+
+// Attentive while a turn is live, lazy when idle.
+status.dataset.running = String(!!status.querySelector('.composer-working'))
+  + ':' + String(!!status.querySelector('.composer-stop'));
+// The flag is `running:stoppable`, so match the prefix rather than the whole.
+(function tick() {
+  const live = () => status.dataset.running.startsWith('true');
+  poll().finally(() => setTimeout(tick, live() ? 1000 : 3000));
+})();
+addEventListener('focus', poll);
diff --git a/crates/plugins/command/serve-web/src/views/detail.rs b/crates/plugins/command/serve-web/src/views/detail.rs
index 032f4d30d..3a212ded3 100644
--- a/crates/plugins/command/serve-web/src/views/detail.rs
+++ b/crates/plugins/command/serve-web/src/views/detail.rs
@@ -2,17 +2,18 @@
 
 use maud::{Markup, PreEscaped, html};
 
-use crate::{render::RenderedEvent, views::layout};
+use crate::{
+    render::{self, RenderedEvent},
+    views::{configs, layout},
+};
 
-/// Render the conversation detail page.
-pub(crate) fn render(title: &str, events: &[RenderedEvent]) -> Markup {
-    layout::page(title, html! {
-        header class="page-header" {
-            a href="/conversations" class="back" { "← Conversations" }
-            h1 { (title) }
-        }
-        main class="conversation-detail" {
-            @for event in events {
+/// Render the conversation's messages.
+///
+/// Separate from the page so the poll endpoint can re-render just this list
+/// into a live page.
+pub(crate) fn messages(events: &[RenderedEvent]) -> Markup {
+    html! {
+        @for event in events {
                 @match event {
                     RenderedEvent::TurnSeparator => {
                         hr class="turn-separator";
@@ -59,7 +60,489 @@ pub(crate) fn render(title: &str, events: &[RenderedEvent]) -> Markup {
                         }
                     }
                 }
+        }
+    }
+}
+
+/// An upward arrow, the chat convention for sending.
+///
+/// Inline rather than a font glyph or an image: it inherits `currentColor`,
+/// needs no request, and cannot arrive after the button it belongs to.
+fn send_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24"
+            width="20"
+            height="20"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2.5"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            aria-hidden="true"
+        {
+            path d="M12 19V5" {}
+            path d="M5 12l7-7 7 7" {}
+        }
+    }
+}
+
+/// A chevron, pointing where the button goes.
+///
+/// `doubled` stacks a second one for the ends of the conversation, the usual
+/// way to distinguish "as far as this goes" from "one step".
+fn chevron(down: bool, doubled: bool) -> Markup {
+    // Two chevrons drawn at the same offsets, flipped as a whole for direction, so
+    // the pair stays symmetric rather than being two hand-placed paths.
+    let rotate = if down { "rotate(180 12 12)" } else { "" };
+
+    html! {
+        svg
+            viewBox="0 0 24 24"
+            width="18"
+            height="18"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            aria-hidden="true"
+        {
+            g transform=(rotate) {
+                @if doubled {
+                    path d="M6 16l6-6 6 6" {}
+                    path d="M6 9l6-6 6 6" {}
+                } @else {
+                    path d="M6 15l6-6 6 6" {}
+                }
+            }
+        }
+    }
+}
+
+/// The toggle for the navigation menu: stacked lines, as for any list of jumps.
+fn navigate_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24"
+            width="18"
+            height="18"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            aria-hidden="true"
+        {
+            path d="M5 7h14" {}
+            path d="M5 12h14" {}
+            path d="M5 17h14" {}
+        }
+    }
+}
+
+/// Which configurations the next message runs under.
+///
+/// A native dialog: the backdrop, focus trapping and Escape are the element's
+/// job, and doing them by hand is how they end up subtly wrong.
+///
+/// The dialog takes focus itself on open.
+/// Left to the element, focus goes to the first field inside it, which on a
+/// touch device raises the keyboard over the dialog before the reader has asked
+/// for it.
+/// `tabindex` is what makes the dialog a focus target of its own.
+fn config_modal() -> Markup {
+    html! {
+        dialog id="config-modal" class="config-modal" tabindex="-1" autofocus {
+            form method="dialog" class="config-form" {
+                h2 { "Configuration" }
+                p class="config-note" { "Applies from the next message onward." }
+
+                // Filled when the dialog is first opened, so the page does not pay
+                // for a list most visits never look at.
+                div id="config-groups" class="config-groups" {
+                    p class="config-note" { "Loading…" }
+                }
+
+                div class="config-actions" {
+                    button type="submit" value="cancel" { "Cancel" }
+                    button type="submit" value="apply" class="config-apply" { "Apply" }
+                }
+            }
+        }
+    }
+}
+
+/// Arrows to opposite corners: the usual sign for a larger view of this.
+fn expand_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24" width="16" height="16" fill="none"
+            stroke="currentColor" stroke-width="2" stroke-linecap="round"
+            stroke-linejoin="round" aria-hidden="true"
+        {
+            path d="M9 3H3v6" {}
+            path d="M3 3l7 7" {}
+            path d="M15 21h6v-6" {}
+            path d="M21 21l-7-7" {}
+        }
+    }
+}
+
+/// A quotation mark, for pulling a passage into a reply.
+fn quote_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24" width="16" height="16" fill="none"
+            stroke="currentColor" stroke-width="2" stroke-linecap="round"
+            stroke-linejoin="round" aria-hidden="true"
+        {
+            path d="M4 6h16" {}
+            path d="M4 18h10" {}
+            path d="M4 12h13" {}
+            path d="M20 10v8" {}
+        }
+    }
+}
+
+/// The composer again, with room to write in.
+fn expand_modal() -> Markup {
+    html! {
+        dialog id="expand-modal" class="expand-modal" {
+            form method="dialog" class="expand-form" {
+                textarea id="expanded" placeholder="Reply to this conversation…" {}
+                div class="config-actions" {
+                    button type="submit" class="config-apply" { "Done" }
+                }
+            }
+        }
+    }
+}
+
+/// The conversation's name, and the means to change it.
+///
+/// The heading and the form swap rather than the heading becoming editable: a
+/// form brings Enter-to-submit and a real input with it, and a title is short
+/// enough that losing the heading's styling for a moment costs nothing.
+fn title_bar(id: &str, title: &str) -> Markup {
+    html! {
+        h1 id="title" { (title) }
+
+        button type="button" id="rename" title="Rename" aria-label="Rename" {
+            (pencil_icon())
+        }
+
+        form
+            id="rename-form"
+            class="rename-form"
+            method="post"
+            action={ "/conversations/" (id) "/title" }
+            hidden
+        {
+            input id="title-field" name="title" type="text" value=(title)
+                autocomplete="off" aria-label="Conversation title";
+            button type="submit" title="Save" aria-label="Save" { (tick_icon()) }
+            button type="button" id="rename-cancel" title="Cancel" aria-label="Cancel" {
+                (cross_icon())
             }
         }
+    }
+}
+
+/// A pencil, for editing what is beside it.
+fn pencil_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24" width="14" height="14" fill="none"
+            stroke="currentColor" stroke-width="2" stroke-linecap="round"
+            stroke-linejoin="round" aria-hidden="true"
+        {
+            path d="M12 20h9" {}
+            path d="M16.5 3.5a2.1 2.1 0 0 1 3 3L7 19l-4 1 1-4z" {}
+        }
+    }
+}
+
+/// A tick: accept.
+fn tick_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24" width="14" height="14" fill="none"
+            stroke="currentColor" stroke-width="2.5" stroke-linecap="round"
+            stroke-linejoin="round" aria-hidden="true"
+        { path d="M20 6L9 17l-5-5" {} }
+    }
+}
+
+/// A cross: back out.
+fn cross_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24" width="14" height="14" fill="none"
+            stroke="currentColor" stroke-width="2.5" stroke-linecap="round"
+            aria-hidden="true"
+        {
+            path d="M18 6L6 18" {}
+            path d="M6 6l12 12" {}
+        }
+    }
+}
+
+/// A cog: settings for what comes next.
+fn cog_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24"
+            width="18"
+            height="18"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            aria-hidden="true"
+        {
+            circle cx="12" cy="12" r="3" {}
+            path d="M19.4 15a1.7 1.7 0 0 0 .3 1.9l.1.1a2 2 0 1 1-2.8 2.8l-.1-.1a1.7 1.7 0 0 0-2.9 1.2v.2a2 2 0 1 1-4 0v-.1A1.7 1.7 0 0 0 7 19.4a1.7 1.7 0 0 0-1.9.3l-.1.1a2 2 0 1 1-2.8-2.8l.1-.1a1.7 1.7 0 0 0-1.2-2.9H1a2 2 0 1 1 0-4h.1A1.7 1.7 0 0 0 2.6 7a1.7 1.7 0 0 0-.3-1.9l-.1-.1a2 2 0 1 1 2.8-2.8l.1.1a1.7 1.7 0 0 0 1.9.3H7a1.7 1.7 0 0 0 1-1.5V1a2 2 0 1 1 4 0v.1a1.7 1.7 0 0 0 2.9 1.2l.1-.1a2 2 0 1 1 2.8 2.8l-.1.1a1.7 1.7 0 0 0-.3 1.9V7a1.7 1.7 0 0 0 1.5 1H23a2 2 0 1 1 0 4h-.1a1.7 1.7 0 0 0-1.5 1z" {}
+        }
+    }
+}
+
+/// A barred circle: the sign for "stop that".
+fn stop_icon() -> Markup {
+    html! {
+        svg
+            viewBox="0 0 24 24"
+            width="18"
+            height="18"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            aria-hidden="true"
+        {
+            circle cx="12" cy="12" r="9" {}
+            path d="M8 12h8" {}
+        }
+    }
+}
+
+/// Render a submitted message that hasn't reached the transcript yet.
+///
+/// Built from the same parts as a real request — the turn divider, the `You`
+/// header, and markdown run through the same renderer — so that when the poll
+/// swaps in the persisted event, nothing moves or reflows.
+/// Only the dimming distinguishes them.
+pub(crate) fn pending(content: &str) -> Markup {
+    html! {
+        hr class="turn-separator";
+        div class="message user pending" {
+            div class="role" { "You" }
+            div class="content" { (PreEscaped(render::markdown_to_html(content))) }
+        }
+    }
+}
+
+/// Where the reply will appear, which is where its progress belongs.
+///
+/// Filled by the poller while a turn runs, and again when one fails; rendered
+/// here too, so a reload during a turn doesn't look idle for a second.
+/// `stoppable` says whether the turn is this server's to interrupt: an
+/// interrupt reaches its own host, and a turn started in a terminal belongs to
+/// a process this cannot signal.
+fn status_row(id: &str, running: bool, stoppable: bool) -> Markup {
+    html! {
+        div id="status" class="composer-status" {
+            @if running {
+                span class="composer-working" role="status" aria-label="Working" {
+                    i {} i {} i {}
+                }
+
+                @if stoppable {
+                    form
+                        class="composer-stop"
+                        method="post"
+                        action={ "/conversations/" (id) "/interrupt" }
+                    {
+                        button type="submit" title="Stop" aria-label="Stop" {
+                            (stop_icon())
+                        }
+                    }
+                } @else {
+                    span class="composer-hint" {
+                        "Another process is running this turn."
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Render the conversation detail page.
+///
+/// `running` shows the working indicator from the first paint, so a reload
+/// during a turn doesn't look idle.
+/// `stoppable` says whether the turn is this server's to interrupt.
+/// `first` is the index `events` starts at and `total` how many there are, so
+/// the page knows whether older ones exist and where to ask for them.
+/// `settled` is the first index that can still change, which the page sends
+/// back with each poll so an entry that changes after it was drawn is redrawn.
+pub(crate) fn render(
+    id: &str,
+    title: &str,
+    events: &[RenderedEvent],
+    first: usize,
+    total: usize,
+    settled: usize,
+    running: bool,
+    stoppable: bool,
+) -> Markup {
+    layout::page(title, html! {
+        header class="page-header" {
+            a href="/conversations" class="back" { "← Conversations" }
+            (title_bar(id, title))
+        }
+
+        // Holds the transcript and anything that floats over it. The transcript
+        // is the only scrolling region on the page; everything else is a fixed
+        // row, which is what keeps the composer put while iOS moves its keyboard
+        // around — there is no page scroll for the dock to drift against.
+        div class="stage" {
+            // Raised by the poller when the server it is talking to is not the
+            // one this page came from. Floats just under the header rather than
+            // taking a row, so it never reflows the conversation.
+            div id="reload" class="reload-banner" hidden {
+                "The server restarted with a new build. "
+                a href="" { "Reload" }
+                " to pick it up."
+            }
+
+            // Hidden until the page has scrolled to the end, so a long transcript
+            // is not watched painting from the top.
+            div id="loading" class="loading-veil" { }
+
+            // Jumps within the conversation, over the transcript's bottom-right.
+            //
+            // A `details` rather than a scripted toggle: opening and closing is
+            // what the element is for, and it keeps working if the script does
+            // not. The jumps themselves need the script.
+            details id="nav" class="nav" {
+                summary title="Navigate" aria-label="Navigate" { (navigate_icon()) }
+
+                div class="nav-menu" {
+                    button type="button" data-nav="top" title="To the top" aria-label="To the top" {
+                        (chevron(false, true))
+                    }
+                    button type="button" data-nav="prev" title="Previous turn" aria-label="Previous turn" {
+                        (chevron(false, false))
+                    }
+                    button type="button" data-nav="next" title="Next turn" aria-label="Next turn" {
+                        (chevron(true, false))
+                    }
+                    button type="button" data-nav="bottom" title="To the bottom" aria-label="To the bottom" {
+                        (chevron(true, true))
+                    }
+                }
+            }
+
+            (config_modal())
+            (expand_modal())
+
+            main id="transcript" class="conversation-detail" {
+                // Replaced wholesale by the poller when the count changes.
+                // `first` is where this window starts and `count` where it ends;
+                // older events are fetched when the reader scrolls back to them.
+                div id="messages" data-first=(first) data-count=(total) data-settled=(settled) {
+                    (messages(events))
+                }
+
+                // A message that has been submitted but hasn't reached the
+                // transcript yet. The poller fills and clears it.
+                div id="pending" {}
+
+                (status_row(id, running, stoppable))
+
+                // What "the end" means, for scrolling to it.
+                //
+                // Everything above it down here comes and goes — the pending copy,
+                // the status row — and an element with no box cannot be scrolled
+                // to. This one is always here and always has a height.
+                div id="end" {}
+            }
+        }
+
+        // A row of its own below the transcript, so the input stays reachable in
+        // a long conversation and the status never scrolls away from the control
+        // it explains.
+        div class="composer-dock" {
+
+            // A plain form post: sending a message needs no JavaScript. The
+            // response is a redirect back here, issued as soon as the turn is
+            // handed to the host rather than when it finishes.
+            form id="composer" class="composer" method="post" action={ "/conversations/" (id) "/turn" } {
+                // Acting on the field below them, so above it and inside the same
+                // frame rather than off in a corner.
+                div class="composer-tools" {
+                    button type="button" id="expand" data-label="Expand" aria-label="Expand" {
+                        (expand_icon())
+                    }
+                    button type="button" id="quote" data-label="Quote selection" aria-label="Quote selection" {
+                        (quote_icon())
+                    }
+                    button
+                        type="button"
+                        id="open-config"
+                        data-label="Configuration"
+                        aria-label="Configuration for the next message"
+                    {
+                        (cog_icon())
+                    }
+                }
+
+                // One row by default, grown by the page while focused. An idle
+                // composer should cost the conversation as little height as it can.
+                textarea
+                    name="content"
+                    rows="1"
+                    placeholder="Reply to this conversation…"
+                    required {}
+
+                // Enabled during a turn this server owns — sending then is how you
+                // interrupt and respond. Disabled for a turn another process holds,
+                // where the lock would refuse it for as long as that turn runs; the
+                // status above says so.
+                button
+                    id="send"
+                    type="submit"
+                    title="Send"
+                    aria-label="Send"
+                    disabled[running && !stoppable]
+                {
+                    (send_icon())
+                }
+
+                // Raised when a save was refused because the draft moved on.
+                p id="draft-note" class="composer-error" hidden {}
+            }
+
+        }
+
+        script { (PreEscaped(configs::SCRIPT)) }
+        script { (PreEscaped(LIVE_SCRIPT)) }
     })
 }
+
+/// The page's own behaviour: stick to the bottom, and poll for new events and
+/// turn status.
+///
+/// All of it is enhancement.
+/// The composer is a plain form post and the transcript is server-rendered, so
+/// with JavaScript off the page still works — it just needs a manual refresh
+/// to show what arrived since it loaded.
+///
+/// The poll URL is derived from the page's own path, which keeps this a static
+/// string: no per-page formatting, and nothing interpolated into a script tag.
+const LIVE_SCRIPT: &str = include_str!("detail.js");
+
+#[cfg(test)]
+#[path = "detail_tests.rs"]
+mod tests;
diff --git a/crates/plugins/command/serve-web/src/views/detail_tests.rs b/crates/plugins/command/serve-web/src/views/detail_tests.rs
new file mode 100644
index 000000000..3398c5baf
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/detail_tests.rs
@@ -0,0 +1,23 @@
+use pretty_assertions::assert_eq;
+
+use super::*;
+
+/// The dialog claims focus itself when it opens.
+///
+/// Left to the browser, focus goes to the dialog's first field.
+/// Once the chooser has been fetched and a row written into it, that is the
+/// row's own field, so on a touch device opening the dialog raises the keyboard
+/// over it and iOS zooms the page to meet the field.
+#[test]
+fn the_configuration_dialog_takes_focus_itself() {
+    let markup = config_modal().into_string();
+    let opening = markup
+        .split_once('>')
+        .map(|(tag, _)| tag)
+        .unwrap_or_default();
+
+    assert_eq!(
+        opening,
+        r#"<dialog id="config-modal" class="config-modal" tabindex="-1" autofocus"#
+    );
+}
diff --git a/crates/plugins/command/serve-web/src/views/filter.js b/crates/plugins/command/serve-web/src/views/filter.js
new file mode 100644
index 000000000..7efbb8f3b
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/filter.js
@@ -0,0 +1,23 @@
+const field = document.getElementById('filter');
+const entries = [...document.querySelectorAll('.conversation-list li')];
+const noMatches = document.getElementById('no-matches');
+
+const apply = () => {
+  const needle = field.value.trim().toLowerCase();
+  let shown = 0;
+
+  for (const entry of entries) {
+    const title = entry.querySelector('.title').textContent.toLowerCase();
+    const match = title.includes(needle);
+    entry.hidden = !match;
+    if (match) shown++;
+  }
+
+  noMatches.hidden = shown > 0;
+};
+
+field.addEventListener('input', apply);
+
+// Browsers restore a field's value on a back navigation without firing `input`,
+// which would otherwise leave the text sitting above an unfiltered list.
+apply();
diff --git a/crates/plugins/command/serve-web/src/views/layout.rs b/crates/plugins/command/serve-web/src/views/layout.rs
index e3ca37cc4..e847bb472 100644
--- a/crates/plugins/command/serve-web/src/views/layout.rs
+++ b/crates/plugins/command/serve-web/src/views/layout.rs
@@ -4,23 +4,79 @@ use maud::{DOCTYPE, Markup, html};
 
 use crate::style;
 
+/// How a page handles being taller than the window.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Scroll {
+    /// The document scrolls, as a plain web page does.
+    ///
+    /// Gets the platform's scrolling behaviour for free — on iOS that includes
+    /// tapping the status bar to return to the top, which is not an event a
+    /// page can subscribe to.
+    /// It only works when there is a window scroll position for the system to
+    /// reset.
+    Document,
+
+    /// The document is fixed to the window and something inside it scrolls.
+    ///
+    /// Required wherever a virtual keyboard is involved: with no page scroll
+    /// there is nothing for iOS to pan when a field is focused, which is what
+    /// keeps the header from sliding off the top.
+    /// The cost is the platform gestures above.
+    Inner,
+}
+
 /// Wrap page content in the common HTML shell.
+pub(crate) fn page(title: &str, body: Markup) -> Markup {
+    shell(title, Scroll::Inner, body)
+}
+
+/// [`page`], for a page that lets the document scroll.
+pub(crate) fn scrolling_page(title: &str, body: Markup) -> Markup {
+    shell(title, Scroll::Document, body)
+}
+
 #[expect(
     clippy::needless_pass_by_value,
     reason = "maud templates consume Markup"
 )]
-pub(crate) fn page(title: &str, body: Markup) -> Markup {
+fn shell(title: &str, scroll: Scroll, body: Markup) -> Markup {
     html! {
         (DOCTYPE)
         html lang="en" {
             head {
                 meta charset="utf-8";
-                meta name="viewport" content="width=device-width, initial-scale=1";
+                // `viewport-fit=cover` so the safe-area insets below have
+                // something to report on a notched screen.
+                //
+                // `interactive-widget=resizes-content` asks the browser to take
+                // the on-screen keyboard out of the layout viewport rather than
+                // leaving it the full height and panning what is visible over
+                // it. Where that is honoured the column simply fits the room
+                // left and the composer needs no lifting at all; where it is
+                // not, the page measures the difference itself.
+                meta name="viewport"
+                    content="width=device-width, initial-scale=1, viewport-fit=cover, \
+                             interactive-widget=resizes-content";
                 title { (title) " - JP" }
+
+                // Installed to a home screen, this runs without browser chrome
+                // and keeps its own history, which is what makes it usable as an
+                // app rather than a bookmark.
+                meta name="apple-mobile-web-app-capable" content="yes";
+                meta name="apple-mobile-web-app-title" content="JP";
+                meta name="apple-mobile-web-app-status-bar-style"
+                    content="black-translucent";
+                meta name="mobile-web-app-capable" content="yes";
+                meta name="theme-color" content="#1a1a1a";
+
+                link rel="icon" type="image/svg+xml" href="/assets/icon.svg";
+                link rel="apple-touch-icon" href="/assets/icon.svg";
+                link rel="manifest" href="/manifest.webmanifest";
+
                 link rel="stylesheet"
                     href=(format!("/assets/style.css?v={}", style::css_version()));
             }
-            body {
+            body class=[(scroll == Scroll::Document).then_some("scrolls")] {
                 (body)
             }
         }
diff --git a/crates/plugins/command/serve-web/src/views/list.js b/crates/plugins/command/serve-web/src/views/list.js
new file mode 100644
index 000000000..e3aa508dc
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/list.js
@@ -0,0 +1,85 @@
+const header = document.querySelector('.page-header');
+
+// What the server says the list amounts to.
+//
+// A fingerprint rather than a count: renaming a conversation, or using one,
+// leaves the count exactly where it was, and so would an archive and a creation
+// between the same two visits.
+async function listDigest() {
+  const r = await fetch('/conversations/digest');
+  if (!r.ok) throw new Error(r.status);
+
+  const { digest } = await r.json();
+  return digest;
+}
+
+async function reloadIfStale() {
+  try {
+    if (await listDigest() !== header.dataset.digest) location.reload();
+  } catch (e) {
+    // Offline, or the server is restarting. The next return tries again.
+  }
+}
+
+document.addEventListener('visibilitychange', () => {
+  if (document.visibilityState === 'visible') reloadIfStale();
+});
+
+// The header is a way back to the top on platforms that do not do it themselves.
+// Ignores the links inside it, which have somewhere else to go.
+header.addEventListener('click', (event) => {
+  if (!event.target.closest('a')) scrollTo(0, 0);
+});
+
+// Archiving asks first: a swipe is easy to make by accident, and a conversation
+// is not something to lose to a stray gesture.
+//
+// Handled here rather than on the form so the confirmation is one dialog for the
+// whole list rather than one per row.
+document.addEventListener('submit', async (event) => {
+  const form = event.target.closest('.row-actions');
+  if (!form) return;
+
+  event.preventDefault();
+
+  const row = form.closest('li');
+  const title = row.querySelector('.title').textContent.trim();
+  if (!confirm('Archive ' + title + '?')) return;
+
+  try {
+    const r = await fetch(form.action, {
+      method: 'POST',
+      headers: { accept: 'application/json' },
+    });
+    if (!r.ok) throw new Error(r.status);
+
+    // Removed rather than reloaded: the rest of the list is unchanged, and a
+    // reload would lose the filter and the scroll position.
+    row.remove();
+
+    // The page now matches a list it has not seen, so its fingerprint has to
+    // catch up — otherwise the next return here reloads to show the removal it
+    // is already showing. Asked for rather than computed, since the page holds
+    // no list to compute one from.
+    try {
+      header.dataset.digest = await listDigest();
+    } catch (e) {
+      // Left stale, which costs one reload on the next return and nothing else.
+    }
+  } catch (e) {
+    alert('Could not archive that conversation.');
+  }
+});
+
+// A tap on a row that is swiped open should close it rather than follow the
+// link, which is what every list with this gesture does.
+document.addEventListener('click', (event) => {
+  const entry = event.target.closest('.row-entry');
+  if (!entry) return;
+
+  const track = entry.closest('.row-track');
+  if (track.scrollLeft > 4) {
+    event.preventDefault();
+    track.scrollTo({ left: 0, behavior: 'smooth' });
+  }
+});
diff --git a/crates/plugins/command/serve-web/src/views/list.rs b/crates/plugins/command/serve-web/src/views/list.rs
index af2a6be78..412aee08d 100644
--- a/crates/plugins/command/serve-web/src/views/list.rs
+++ b/crates/plugins/command/serve-web/src/views/list.rs
@@ -2,10 +2,46 @@
 
 use chrono::{DateTime, Utc};
 use jp_plugin::message::ConversationSummary;
-use maud::{Markup, html};
+use maud::{Markup, PreEscaped, html};
+use sha2::{Digest as _, Sha256};
 
 use crate::views::layout;
 
+/// A fingerprint of the list as it is shown.
+///
+/// Covers what a page would redraw for: which conversations there are, what
+/// they are called, and when each was last used — which is also what orders
+/// them.
+///
+/// Sorted before hashing, so this says nothing about the order the host happens
+/// to list them in.
+/// A conversation moving to the top still changes it, through the timestamp
+/// that moved it.
+pub(crate) fn digest(conversations: &[ConversationSummary]) -> String {
+    let mut entries: Vec<String> = conversations
+        .iter()
+        .map(|entry| {
+            format!(
+                "{}\u{1f}{}\u{1f}{}",
+                entry.id,
+                entry.title.as_deref().unwrap_or_default(),
+                entry.last_activated_at.to_rfc3339(),
+            )
+        })
+        .collect();
+
+    entries.sort();
+
+    let mut hasher = Sha256::new();
+    for entry in entries {
+        hasher.update(entry.as_bytes());
+        hasher.update([0x1e]);
+    }
+
+    let hash = format!("{:x}", hasher.finalize());
+    hash[..16].to_owned()
+}
+
 /// Render the conversation list page.
 ///
 /// Takes the summaries directly from the protocol response.
@@ -15,34 +51,98 @@ pub(crate) fn render(conversations: &[ConversationSummary]) -> Markup {
     let mut sorted: Vec<&ConversationSummary> = conversations.iter().collect();
     sorted.sort_by_key(|c| std::cmp::Reverse(c.last_activated_at));
 
-    layout::page("Conversations", html! {
-        header class="page-header" {
+    // The document scrolls here, unlike the conversation view: there is no
+    // composer and no keyboard, so nothing needs the page pinned — and letting it
+    // scroll normally is what makes the platform's own gestures work, including
+    // tapping the status bar to return to the top.
+    layout::scrolling_page("Conversations", html! {
+        // The fingerprint travels with the page so it can ask later whether the
+        // list has moved on, without re-reading the list to find out.
+        header class="page-header" data-digest=(digest(conversations)) {
             h1 { "Conversations" }
+            a href="/conversations/new" class="new-conversation-link" { "New" }
         }
-        main class="conversation-list" {
-            @if sorted.is_empty() {
+
+        script { (PreEscaped(LIST_SCRIPT)) }
+        @if sorted.is_empty() {
+            main class="conversation-list" {
                 p class="empty" { "No conversations yet." }
-            } @else {
+            }
+        } @else {
+            // A row of its own above the list, so it stays put while the list
+            // scrolls under it.
+            div class="list-search" {
+                input
+                    id="filter"
+                    type="search"
+                    placeholder="Filter by title…"
+                    autocomplete="off"
+                    aria-label="Filter conversations by title";
+            }
+            main class="conversation-list" {
                 ul {
                     @for entry in &sorted {
-                        li {
-                            a href=(format!("/conversations/{}", entry.id)) {
-                                span class="title" {
-                                    (entry.title.as_deref().unwrap_or("Untitled"))
+                        // The row is a horizontal scroller with two snap points:
+                        // the entry, and the action behind its right edge. Swiping
+                        // is then the browser's own scrolling — momentum, rubber
+                        // band and all — rather than touch handlers imitating it.
+                        li data-id=(entry.id) {
+                            div class="row-track" {
+                                a class="row-entry" href=(format!("/conversations/{}", entry.id)) {
+                                    span class="title" {
+                                        (entry.title.as_deref().unwrap_or("Untitled"))
+                                    }
+                                    time class="timestamp"
+                                        datetime=(entry.last_activated_at.to_rfc3339()) {
+                                        (format_relative_time(entry.last_activated_at))
+                                    }
                                 }
-                                time class="timestamp"
-                                    datetime=(entry.last_activated_at.to_rfc3339()) {
-                                    (format_relative_time(entry.last_activated_at))
+
+                                // A plain form, so this works with no script at
+                                // all once the row is scrolled aside.
+                                form
+                                    class="row-actions"
+                                    method="post"
+                                    action=(format!("/conversations/{}/archive", entry.id))
+                                {
+                                    button type="submit" class="archive" { "Archive" }
                                 }
                             }
                         }
                     }
                 }
+
+                // Shown by the filter when it hides every entry.
+                p id="no-matches" class="empty" hidden { "No matching conversations." }
             }
+            script { (PreEscaped(FILTER_SCRIPT)) }
         }
     })
 }
 
+/// Keeps the list current, and the header useful.
+///
+/// Refreshed on returning to the app rather than on a pull, which is the
+/// gesture this would otherwise want: installed to a home screen there is no
+/// browser chrome to host a pull-to-refresh, and the version a page can build
+/// has no access to the haptic that makes the real one feel like anything.
+/// Coming back to a list that is already current is better than a gesture that
+/// asks for it.
+///
+/// Only when the list has actually moved on, so a page already showing it keeps
+/// its scroll position and its filter rather than being thrown away to arrive
+/// at the same list.
+const LIST_SCRIPT: &str = include_str!("list.js");
+
+/// Hide the entries whose title doesn't contain what was typed.
+///
+/// Enhancement, and only ever subtractive: with JavaScript off the field is
+/// inert and the full list is still there.
+///
+/// Matching reads the rendered title rather than a copy of it, so an untitled
+/// conversation matches on the "Untitled" the reader can actually see.
+const FILTER_SCRIPT: &str = include_str!("filter.js");
+
 /// Format a timestamp as a human-readable relative string.
 fn format_relative_time(dt: DateTime<Utc>) -> String {
     let now = Utc::now();
@@ -70,3 +170,7 @@ fn format_relative_time(dt: DateTime<Utc>) -> String {
 
     dt.format("%Y-%m-%d").to_string()
 }
+
+#[cfg(test)]
+#[path = "list_tests.rs"]
+mod tests;
diff --git a/crates/plugins/command/serve-web/src/views/list_tests.rs b/crates/plugins/command/serve-web/src/views/list_tests.rs
new file mode 100644
index 000000000..9ce705ac7
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/list_tests.rs
@@ -0,0 +1,104 @@
+use chrono::{DateTime, Utc};
+use jp_plugin::message::ConversationSummary;
+
+use super::*;
+
+fn summary(id: &str, title: Option<&str>) -> ConversationSummary {
+    ConversationSummary {
+        id: id.to_owned(),
+        title: title.map(ToOwned::to_owned),
+        last_activated_at: "2025-01-01T00:00:00Z"
+            .parse::<DateTime<Utc>>()
+            .expect("fixed timestamp parses"),
+        pinned_at: None,
+        events_count: 0,
+    }
+}
+
+/// The case a count misses: the list is the same length and reads differently.
+#[test]
+fn renaming_a_conversation_changes_the_digest() {
+    let before = [
+        summary("0001", Some("Add a search bar")),
+        summary("0002", None),
+    ];
+    let after = [
+        summary("0001", Some("Add a filter field")),
+        summary("0002", None),
+    ];
+
+    assert_ne!(digest(&before), digest(&after));
+}
+
+/// The other case a count misses: one conversation archived and another started
+/// between two visits leaves the list exactly as long as it was.
+#[test]
+fn swapping_one_conversation_for_another_changes_the_digest() {
+    let before = [summary("0001", Some("Add a search bar"))];
+    let after = [summary("0002", Some("Add a search bar"))];
+
+    assert_ne!(digest(&before), digest(&after));
+}
+
+/// The protocol promises no order, and the page sorts for itself, so the order
+/// the host happens to answer in must not read as a change.
+#[test]
+fn the_digest_ignores_the_order_the_host_lists_them_in() {
+    let one = summary("0001", Some("Add a search bar"));
+    let two = summary("0002", Some("Fix the poller"));
+
+    assert_eq!(
+        digest(&[one.clone(), two.clone()]),
+        digest(&[two, one]),
+        "the same list in a different order is the same list"
+    );
+}
+
+#[test]
+fn an_unchanged_list_keeps_its_digest() {
+    let conversations = [
+        summary("0001", Some("Add a search bar")),
+        summary("0002", None),
+    ];
+
+    assert_eq!(digest(&conversations), digest(&conversations));
+}
+
+#[test]
+fn renders_filter_field_and_entries() {
+    let conversations = vec![
+        summary("0001", Some("Add a search bar")),
+        summary("0002", None),
+    ];
+
+    let html = render(&conversations).into_string();
+
+    assert!(html.contains(r#"id="filter""#), "no filter field: {html}");
+    assert!(
+        html.contains(r#"id="no-matches""#),
+        "no empty state: {html}"
+    );
+    assert!(html.contains("Add a search bar"), "entry missing: {html}");
+    assert!(html.contains("Untitled"), "untitled entry missing: {html}");
+}
+
+/// The field filters the list that is already on the page, so an empty list has
+/// nothing to filter and would leave the script reaching for elements that were
+/// never rendered.
+#[test]
+fn omits_filter_field_when_there_are_no_conversations() {
+    let html = render(&[]).into_string();
+
+    assert!(html.contains("No conversations yet."), "{html}");
+    assert!(
+        !html.contains(r#"id="filter""#),
+        "filter field shown: {html}"
+    );
+    // The filter's script specifically. The page carries others regardless of how
+    // many conversations there are, so "no script at all" would assert something
+    // this test is not about.
+    assert!(
+        !html.contains("getElementById('filter')"),
+        "filter script emitted: {html}"
+    );
+}
diff --git a/crates/plugins/command/serve-web/src/views/mod.rs b/crates/plugins/command/serve-web/src/views/mod.rs
index cb4ddf594..792551085 100644
--- a/crates/plugins/command/serve-web/src/views/mod.rs
+++ b/crates/plugins/command/serve-web/src/views/mod.rs
@@ -1,5 +1,7 @@
 //! View modules for rendering HTML pages.
 
+pub(crate) mod configs;
 pub(crate) mod detail;
 pub(crate) mod layout;
 pub(crate) mod list;
+pub(crate) mod new;
diff --git a/crates/plugins/command/serve-web/src/views/new.js b/crates/plugins/command/serve-web/src/views/new.js
new file mode 100644
index 000000000..1089883df
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/new.js
@@ -0,0 +1,19 @@
+// Cmd+Enter starts the conversation, as it sends a message on the conversation
+// page.
+//
+// `requestSubmit` rather than `submit`: it runs the form's own validation, so a
+// blank message is reported where it was typed instead of posted and refused.
+document.addEventListener('keydown', (event) => {
+  if (event.key !== 'Enter' || !(event.metaKey || event.ctrlKey)) return;
+
+  // A dialog takes the same chord for finishing its own work. Read off the
+  // keystroke rather than off which dialogs are open, which by now may include
+  // the one that just closed itself on this very key.
+  if (event.target.closest?.('dialog')) return;
+
+  const form = document.querySelector('.new-conversation');
+  if (!form) return;
+
+  event.preventDefault();
+  form.requestSubmit();
+});
diff --git a/crates/plugins/command/serve-web/src/views/new.rs b/crates/plugins/command/serve-web/src/views/new.rs
new file mode 100644
index 000000000..45bfd4e12
--- /dev/null
+++ b/crates/plugins/command/serve-web/src/views/new.rs
@@ -0,0 +1,100 @@
+//! The form for starting a conversation.
+
+use jp_plugin::message::ConfigEntry;
+use maud::{Markup, PreEscaped, html};
+
+use super::{configs, layout};
+
+/// Render the new-conversation form.
+///
+/// `chosen` are the configuration arguments to restore, in the order they
+/// apply, and `error` is shown above the form when a previous attempt was
+/// refused; the fields keep what was typed so nothing has to be entered twice.
+pub(crate) fn render(
+    entries: &[ConfigEntry],
+    content: &str,
+    title: &str,
+    chosen: &[String],
+    error: Option<&str>,
+) -> Markup {
+    layout::page("New conversation", html! {
+        header class="page-header" {
+            a href="/conversations" class="back" { "← Conversations" }
+            h1 { "New conversation" }
+        }
+
+        main class="conversation-detail" {
+            @if let Some(error) = error {
+                p class="composer-error" { (error) }
+            }
+
+            form class="new-conversation" method="post" action="/conversations/new" {
+                // Filled by the script below with this tab's identity, so the
+                // turn this starts is recorded as belonging to the page that is
+                // about to be redirected to it.
+                input type="hidden" id="client" name="client";
+
+                label {
+                    span class="field-label" { "Title" }
+                    input
+                        type="text"
+                        name="title"
+                        value=(title)
+                        placeholder="Optional; named from the first turn if left blank";
+                }
+
+                (configs::chooser(entries, chosen))
+
+                label {
+                    span class="field-label" { "Message" }
+                    textarea
+                        name="content"
+                        rows="5"
+                        placeholder="What do you want to ask?"
+                        required { (content) }
+                }
+
+                div {
+                    button type="submit" { "Start" }
+                }
+            }
+
+            script { (PreEscaped(CLIENT_SCRIPT)) }
+        }
+
+        script { (PreEscaped(configs::SCRIPT)) }
+        script { (PreEscaped(SCRIPT)) }
+    })
+}
+
+/// Carry this tab's identity into the form.
+///
+/// The conversation this starts is answered with a redirect, and the page that
+/// lands there asks the server whether the running turn is its own.
+/// A turn recorded without a client belongs to nobody, so that page is told the
+/// turn is somebody else's and asks before stopping the turn it just started
+/// itself.
+///
+/// Enhancement, and correct either way: with no script the field stays empty,
+/// the turn is unattributed, and that is the truth — a page that cannot store
+/// an identity has none to claim a turn with.
+const CLIENT_SCRIPT: &str = r"
+// The same per-tab key the conversation page reads, because the page that has to
+// recognise this turn is the one this redirects to, in this same tab.
+try {
+  let id = sessionStorage.getItem('jp-client');
+  if (!id) {
+    id = Math.random().toString(36).slice(2) + Date.now().toString(36);
+    sessionStorage.setItem('jp-client', id);
+  }
+  document.getElementById('client').value = id;
+} catch (e) {
+  // Private browsing, or storage denied. The turn stays unattributed, which
+  // reads as shared and errs toward asking.
+}
+";
+
+/// The keyboard shortcut for starting the conversation.
+///
+/// The form works without it; this only saves the trip to the button.
+const SCRIPT: &str = include_str!("new.js");
diff --git a/crates/plugins/command/serve-web/tsconfig.json b/crates/plugins/command/serve-web/tsconfig.json
new file mode 100644
index 000000000..327a7e3ac
--- /dev/null
+++ b/crates/plugins/command/serve-web/tsconfig.json
@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "allowJs": true,
+    "checkJs": true,
+    "noEmit": true,
+    "strict": false,
+    "skipLibCheck": true,
+    "types": []
+  },
+  "include": ["src/views/*.js"]
+}
diff --git a/crates/plugins/command/ticket/src/main_tests.rs b/crates/plugins/command/ticket/src/main_tests.rs
index ff2ea03b4..f6754e147 100644
--- a/crates/plugins/command/ticket/src/main_tests.rs
+++ b/crates/plugins/command/ticket/src/main_tests.rs
@@ -1,6 +1,6 @@
 use camino_tempfile::Utf8TempDir;
 use clap::CommandFactory;
-use jp_plugin::message::WorkspaceInfo;
+use jp_plugin::message::{OutputFormat, WorkspaceInfo};
 
 use super::*;
 
@@ -188,6 +188,7 @@ fn init_at(version: u32, root: &Utf8Path, args: &[&str]) -> HostToPlugin {
         options: serde_json::Map::new(),
         args: args.iter().map(|arg| (*arg).to_owned()).collect(),
         log_level: 0,
+        output_format: OutputFormat::default(),
     })
 }
 
diff --git a/justfile b/justfile
index 0a1a6369b..251cd7ab7 100644
--- a/justfile
+++ b/justfile
@@ -73,6 +73,321 @@ run *ARGS:
 
     cargo run {{quiet_flag}} --package jp_cli -- "$@"
 
+# Serve the web UI from this checkout, rebuilding the plugin first.
+#
+# Takes the plugin's own flags: `--bind <ADDR>`, `--port <PORT>`.
+[group('main')]
+[positional-arguments]
+serve-web *ARGS: _install-serve-web
+    #!/usr/bin/env sh
+    set -eu
+
+    cargo run {{quiet_flag}} --package jp_cli -- serve-web "$@"
+
+# Serve the web UI, picking up source changes without killing a running turn.
+#
+# Starts on a broken tree: it waits for a change that compiles rather than
+# refusing, so this can be left running across an edit that does not build.
+#
+# Watching sources and restarting directly — `cargo watch -w crates -s 'just
+# serve-web'` — cannot work here: a turn started from the browser runs inside the
+# host process this plugin is attached to, so restarting on a file change aborts
+# whatever the assistant was in the middle of. Which includes the assistant
+# editing these very files.
+#
+# So the restart waits for the server to say it's idle. Two loops: a watcher
+# rebuilds on every change to `crates/` and then stops the server once `/status`
+# reports no turn in flight, and the supervisor loop starts it again on the new
+# build.
+#
+# Takes the plugin's own flags: `--bind <ADDR>`, `--port <PORT>`.
+#
+# `JP_SERVE_WEB_WORKSPACE=<dir>` serves that workspace instead of this checkout,
+# so the UI being developed here drives conversations in another worktree. The
+# build always comes from here.
+#
+# Ctrl-C stops both.
+[group('main')]
+[positional-arguments]
+serve-web-watch *ARGS:
+    #!/usr/bin/env sh
+    set -eu
+
+    # `/status` is polled over loopback regardless of what the server binds, so
+    # only the port matters here. Read it back out of the arguments rather than
+    # taking it as a recipe parameter, so the flags are passed exactly as written.
+    port=3001
+    prev=""
+    for arg in "$@"; do
+        case "$prev" in --port) port="$arg" ;; esac
+        case "$arg" in --port=*) port="${arg#--port=}" ;; esac
+        prev="$arg"
+    done
+
+    # The restart finds the server by its command line, so the port has to be on
+    # it. Added only when it is absent, so what was passed is left as written.
+    case " $* " in
+        *" --port"*) ;;
+        *) set -- "$@" --port "$port" ;;
+    esac
+
+    # Which workspace the server serves, and therefore which one every
+    # conversation started from the browser belongs to. Defaults to this
+    # checkout, which is also the only tree that gets built.
+    #
+    # A stop-gap until the web UI can pick a worktree itself: run the UI you are
+    # developing here against a project you are working on elsewhere.
+    workspace="${JP_SERVE_WEB_WORKSPACE:-}"
+    if [ -n "$workspace" ] && [ ! -d "$workspace/.jp" ]; then
+        echo "$workspace is not a JP workspace; run 'jp init' there first." >&2
+        exit 1
+    fi
+
+    jp="$(cargo metadata --format-version 1 | jq -r .build_directory)/debug/jp"
+
+    # A tree that does not compile is not a reason to refuse to start. The loop
+    # below waits for the watcher to report a build that does, which is the state
+    # you are in whenever you start this in the middle of an edit.
+    if just _install-serve-web && cargo build {{quiet_flag}} --package jp_cli; then
+        ready=1
+    else
+        ready=0
+    fi
+
+    # Where the watcher says "I stopped the server on purpose". Keyed by port so
+    # two of these can run side by side.
+    restart_stamp="${TMPDIR:-/tmp}/jp-serve-web-restart.$port"
+    rm -f "$restart_stamp"
+    export JP_SERVE_WEB_RESTART_STAMP="$restart_stamp"
+
+    # How the watcher wakes this loop when there is finally something to run.
+    # A pipe rather than a stamp file, so waiting costs nothing and needs no
+    # polling interval: a read blocks until the watcher writes.
+    ready_fifo="${TMPDIR:-/tmp}/jp-serve-web-ready.$port"
+    rm -f "$ready_fifo"
+    mkfifo "$ready_fifo"
+    export JP_SERVE_WEB_READY="$ready_fifo"
+
+    # Mirrors `jp_workspace::user_data_dir`; the watcher reads conversation locks
+    # from under it to decide whether stopping the server would interrupt a turn.
+    if [ -n "${JP_USER_DATA_DIR:-}" ]; then
+        export JP_SERVE_WEB_DATA="$JP_USER_DATA_DIR"
+    elif [ -n "${XDG_DATA_HOME:-}" ]; then
+        export JP_SERVE_WEB_DATA="$XDG_DATA_HOME/jp"
+    elif [ "$(uname -s)" = "Darwin" ]; then
+        export JP_SERVE_WEB_DATA="$HOME/Library/Application Support/jp"
+    else
+        export JP_SERVE_WEB_DATA="$HOME/.local/share/jp"
+    fi
+
+    # `--postpone` matters: without it the watcher runs once on startup and stops
+    # the server it is about to supervise.
+    #
+    # Deliberately not `--quiet`: its "[Running ...]" line is the only evidence
+    # from the terminal that a source change was noticed at all.
+    echo "Watching crates/ for changes; restarts wait for /status on :$port." >&2
+    cargo watch --postpone --watch crates --delay 2 \
+        --shell "just _restart-serve-web $port" &
+    watcher=$!
+
+    # Not INT. Ctrl-C reaches every process in the foreground group, including
+    # this one, and trapping it here used to kill the watcher while the loop below
+    # carried on — so restarts worked exactly once, until the first Ctrl-C.
+    #
+    # Ignoring it instead leaves Ctrl-C to `jp`, which owns the interrupt menu.
+    # Whether to come back up is decided by the stamp, not by the signal.
+    trap 'kill $watcher 2>/dev/null || true; rm -f "$ready_fifo"' EXIT TERM
+    trap '' INT
+
+    # Run the built binary rather than `cargo run`, so the process the watcher
+    # stops is the server itself and not a cargo wrapper around it.
+    #
+    # In the foreground, deliberately. Backgrounding it to capture `$!` makes it a
+    # background process, and a background process reading the terminal gets EOF —
+    # so the interrupt menu appeared, read nothing, and exited. The watcher finds
+    # the pid with `pgrep` instead.
+    waiting=""
+    while true; do
+        # Nothing to run: the tree was broken when this started, or when it last
+        # rebuilt. Block until the watcher reports a build — a read on an empty
+        # pipe sleeps until someone writes, so this costs nothing while it waits.
+        #
+        # The wakeup is a hint, not a promise: confirm with a build of our own,
+        # which is a cached no-op when the watcher has just done the work.
+        if [ "$ready" -eq 0 ]; then
+            if [ -z "$waiting" ]; then
+                echo "The tree does not compile; waiting for a change that fixes it." >&2
+                waiting=yes
+            fi
+
+            read -r _ < "$ready_fifo" || true
+
+            if just _install-serve-web && cargo build {{quiet_flag}} --package jp_cli; then
+                ready=1
+                waiting=""
+            fi
+            continue
+        fi
+
+        # `--workspace` goes before the subcommand on purpose: `serve-web` is an
+        # external subcommand, so clap hands everything after it to the plugin
+        # verbatim, global flags included.
+        if [ -n "$workspace" ]; then
+            "$jp" --workspace "$workspace" -vv serve-web "$@" | cat || true
+        else
+            "$jp" -vv serve-web "$@" | cat || true
+        fi
+
+        if [ ! -f "$restart_stamp" ]; then
+            echo "jp-serve-web exited on its own; stopping." >&2
+            exit 0
+        fi
+
+        rm -f "$restart_stamp"
+        echo "jp-serve-web stopped for a rebuild; starting the current build." >&2
+        sleep 1
+    done
+
+# Rebuild the web UI and stop the running server once it falls idle.
+#
+# The supervisor loop in `serve-web-watch` starts it again, so stopping is all
+# this has to do. Waits indefinitely while a turn is in flight: a rebuild is never
+# worth cutting off an assistant mid-answer.
+#
+# "In flight" means a conversation lock naming this server's pid. A lock held by
+# any other process is somebody else's turn, and stopping this server cannot
+# interrupt it, so it is no reason to wait. The plugin's own `/status` is consulted
+# too, which covers the moment between a browser submitting and the host taking
+# the lock.
+[private]
+_restart-serve-web PORT:
+    #!/usr/bin/env sh
+    set -eu
+
+    echo "Source changed; rebuilding." >&2
+
+    # A broken tree must leave the running server alone. Without this the next
+    # save after a compile error stops a working server and the supervisor brings
+    # up nothing, because there is nothing new to bring up.
+    #
+    # Tests run before the install, so a plugin that builds but misbehaves is
+    # never copied over a working one. They are the only gate on anything the
+    # compiler cannot see for itself.
+    if ! cargo test {{quiet_flag}} --package jp-serve-web \
+        || ! just _install-serve-web \
+        || ! cargo build {{quiet_flag}} --package jp_cli; then
+        echo "Build or tests failed; leaving the running server alone." >&2
+        exit 0
+    fi
+
+    # Wake a supervisor that has nothing to run.
+    #
+    # Opened read-write, which is what keeps this from blocking: a plain write to
+    # a pipe waits for a reader, and there usually isn't one — the supervisor only
+    # listens while it has no build to run. With no reader the message is dropped,
+    # which is the right outcome, because nobody was waiting for it.
+    if [ -p "${JP_SERVE_WEB_READY:-}" ]; then
+        echo ready 1<>"$JP_SERVE_WEB_READY" || true
+    fi
+
+    data="${JP_SERVE_WEB_DATA:-}"
+
+    # The running server, found by its own command line rather than a pidfile:
+    # writing one would mean backgrounding it, and a backgrounded server cannot
+    # read the terminal, which is where the interrupt menu takes its keys.
+    #
+    # Scoped to the port so a second supervisor is not caught by it.
+    #
+    # The subcommand does not follow the binary name directly: the supervisor runs
+    # `jp -vv serve-web`, and a pattern that assumes otherwise matches nothing and
+    # turns the kill below into a silent no-op.
+    server_pid() {
+        pgrep -f "/jp .*serve-web.*--port[= ]{{PORT}}" 2>/dev/null | head -1 || true
+    }
+
+    # Does a conversation lock name the server we are about to stop?
+    #
+    # A pid recorded by a process that has since died counts as free: SIGKILL
+    # leaves the lock's metadata behind, and waiting on a dead holder would hold
+    # the restart forever.
+    holds_a_lock() {
+        [ -n "$1" ] || return 1
+        kill -0 "$1" 2>/dev/null || return 1
+        [ -n "$data" ] || return 1
+
+        for lock in "$data"/workspace/*/locks/*.lock; do
+            [ -f "$lock" ] || continue
+            if [ "$(jq -r '.pid // empty' "$lock" 2>/dev/null || true)" = "$1" ]; then
+                return 0
+            fi
+        done
+
+        return 1
+    }
+
+    # Which conversations the server is holding, as a space-separated list.
+    #
+    # The lock file is named for its conversation, so the names come from the
+    # paths rather than from reading each file twice.
+    held_conversations() {
+        [ -n "$1" ] || return 0
+        [ -n "$data" ] || return 0
+
+        for lock in "$data"/workspace/*/locks/*.lock; do
+            [ -f "$lock" ] || continue
+            if [ "$(jq -r '.pid // empty' "$lock" 2>/dev/null || true)" = "$1" ]; then
+                name="${lock##*/}"
+                printf '%s ' "${name%.lock}"
+            fi
+        done
+    }
+
+    # An unreachable server counts as idle: there is nothing to interrupt, and
+    # the supervisor loop will pick up the new build on its own.
+    #
+    # The wait is unbounded on purpose — a rebuild is never worth cutting off an
+    # assistant mid-answer — so it has to stay legible, or "waiting correctly" and
+    # "wedged" look identical. It says what it is waiting on, and keeps saying so.
+    waited=0
+    announced=""
+    while true; do
+        server=$(server_pid)
+        reported=$(curl -sf "http://127.0.0.1:{{PORT}}/status" | jq -r '.busy' 2>/dev/null || true)
+
+        if holds_a_lock "$server" || [ "$reported" = "true" ]; then
+            # An empty list with the loop still holding means the plugin reported
+            # busy while no lock is held — a turn between acquiring the
+            # conversation and starting, or a status the plugin has not cleared.
+            held=$(held_conversations "$server")
+            [ -n "$held" ] || held="no lock held; the plugin reports busy"
+
+            # Once on arrival, then every 30s: often enough to show it is still
+            # alive, rarely enough not to bury the build output.
+            if [ -z "$announced" ]; then
+                echo "Holding the restart for: ${held}" >&2
+                echo "Interrupt the turn, or wait — the rebuild is already done." >&2
+                announced=yes
+            elif [ $((waited % 30)) -eq 0 ]; then
+                echo "Still holding after ${waited}s for: ${held}" >&2
+            fi
+
+            sleep 2
+            waited=$((waited + 2))
+            continue
+        fi
+
+        break
+    done
+
+    echo "Idle; stopping the server so the supervisor starts the new build." >&2
+    : > "${JP_SERVE_WEB_RESTART_STAMP:-${TMPDIR:-/tmp}/jp-serve-web-restart.{{PORT}}}"
+
+    # Port-scoped, so a second supervisor on another port is left alone.
+    server=$(server_pid)
+    if [ -n "$server" ]; then
+        kill "$server" 2>/dev/null || true
+    fi
+
 # Install the `jp` binary from your local checkout.
 [group('build')]
 [group('main')]
@@ -3088,12 +3403,15 @@ ticket-close NNN: _install-ticket
 
 # List tickets, ordered by id.
 #
+# `jp -F json` switches the whole invocation to the machine-readable form; the
+# command has no format flag of its own.
+#
 #   just ticket-list                        # every ticket
 #   just ticket-list --status "In Progress" # one column of the board
 #   just ticket-list --kind bug
 #   just ticket-list --label package=jp_cli # one area of the system
 #   just ticket-list --label package        # any value of one key
-#   just ticket-list --json                 # for `jq`
+#   jp -F json ticket list                  # for `jq`
 [group('ticket')]
 [positional-arguments]
 ticket-list *ARGS: _install-ticket
@@ -3221,7 +3539,7 @@ ticket-labels-sync:
 
 # Read one ticket, with its comments numbered for replies.
 #
-# Pass `--json` for the machine-readable form.
+# Run it as `jp -F json ticket show NNN` for the machine-readable form.
 [group('ticket')]
 [positional-arguments]
 ticket-show NNN *ARGS: _install-ticket
@@ -3263,7 +3581,7 @@ ticket-promote NNN CATEGORY="design": _install-ticket
     #!/usr/bin/env sh
     set -eu
 
-    detail=$(jp ticket show {{quote(NNN)}} --json)
+    detail=$(jp --format json ticket show {{quote(NNN)}})
     id=$(echo "$detail" | jq -r '.id')
     title=$(echo "$detail" | jq -r '.title')
     description=$(echo "$detail" | jq -r '.description')
@@ -3278,6 +3596,17 @@ ticket-promote NNN CATEGORY="design": _install-ticket
         echo "${id} names ${promoted}, but no such RFD exists; seeding a new draft." >&2
     fi
 
+    # A run interrupted between the draft and the `promote` below leaves the
+    # ticket unmarked, so a retry would seed a second draft. The seeded Summary
+    # names the ticket, which is the marker to find it by.
+    seeded=$(grep -rl "^Promoted from ticket ${id}\.$" docs/rfd --include='*.md' 2>/dev/null | head -1 || true)
+    if [ -n "$seeded" ]; then
+        draft=$(basename "$seeded" | sed 's/^\([D0-9][0-9]*\)-.*/\1/')
+        echo "${id} already seeded ${seeded}; linking it." >&2
+        jp ticket promote "$id" --to "$draft"
+        exit 0
+    fi
+
     out=$(just rfd-draft {{quote(CATEGORY)}} "$title")
     echo "$out"
     file=${out#Created }
@@ -3565,6 +3894,17 @@ fmt-comments-ci: _install-comfort _install_ci_matchers
 fmt-markdown-ci: _install-comfort _install_ci_matchers
     comfort --check --workspace --language markdown --format-markdown --reference-links --prune-reference-links
 
+# Type-check the web UI's scripts on CI.
+#
+# The scripts are served exactly as written, so nothing is compiled: `checkJs`
+# reads the JSDoc annotations and the DOM types and emits no output.
+#
+# The version tracks `docs/package.json`, which is the other place this project
+# pins TypeScript.
+[group('ci')]
+typecheck-js-ci:
+    npx --yes --package=typescript@5 -- tsc --project crates/plugins/command/serve-web/tsconfig.json
+
 # Test the code on CI.
 #
 # `SCOPE` selects the crates to test: `workspace` covers every member, `jp-only`
@@ -3663,6 +4003,44 @@ _install-ticket *args:
     fi
     cargo install {{quiet_flag}} --locked --path crates/plugins/command/ticket --debug {{args}}
 
+# Build the `jp-serve-web` command plugin into JP's plugin directory.
+#
+# Not `cargo install`, unlike the other plugins. `jp` resolves a plugin by
+# checking its own plugin directory first and returning immediately, and
+# `serve-web` is an official registry plugin, so anything the registry put there
+# shadows a build in `~/.cargo/bin` forever. Writing the local build to the same
+# place is what lets a checkout win.
+#
+# Deliberately ignores `JP_NO_INSTALL`: that variable exists to stop recipes from
+# rebuilding `jp` itself, and this recipe's only job is to build the plugin.
+_install-serve-web *args:
+    #!/usr/bin/env sh
+    set -eu
+
+    # Mirrors `jp_workspace::user_data_dir`.
+    if [ -n "${JP_USER_DATA_DIR:-}" ]; then
+        data="$JP_USER_DATA_DIR"
+    elif [ -n "${XDG_DATA_HOME:-}" ]; then
+        data="$XDG_DATA_HOME/jp"
+    elif [ "$(uname -s)" = "Darwin" ]; then
+        data="$HOME/Library/Application Support/jp"
+    else
+        data="$HOME/.local/share/jp"
+    fi
+
+    cargo build {{quiet_flag}} --locked --package jp-serve-web {{args}}
+
+    dir="$data/plugins/command"
+    mkdir -p "$dir"
+    build=$(cargo metadata --format-version 1 | jq -r .build_directory)
+
+    # Copy beside the target and rename, so replacing the binary of a server
+    # that's still running can't fail on a busy file.
+    cp "$build/debug/jp-serve-web" "$dir/.jp-serve-web.new"
+    chmod 755 "$dir/.jp-serve-web.new"
+    mv -f "$dir/.jp-serve-web.new" "$dir/jp-serve-web"
+    echo "Installed jp-serve-web to $dir" >&2
+
 _install-comfort *args:
     #!/usr/bin/env sh
     set -eu