diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17b9f2b..03c9453 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,14 @@ and a release's notes are its section. The procedure is in [`docs/RELEASING.md`]
 
 ### Fixed
 
+- Desktop overlays follow modal visibility changes on the client UI thread, avoiding background-thread reads of changing pane layouts.
+
+- The desktop window answers terminal cell-pixel queries with its actual measured pixels, allowing
+  servers to size images correctly. Unix terminal mode also reports cells when the terminal publishes
+  an exact pixel extent; unavailable dimensions stay unknown. Servers that asked receive refreshed
+  dimensions after zoom or display-scaling changes, even when the character grid is unchanged.
+  Replies use the opted-in TNC terminal-query plugin and never forward server escapes to the local terminal.
+
 - Desktop MXP images use the measured font cell dimensions when sizing pictures, instead of assuming an 8×16 cell.
   This avoids stretching pictures when the selected font has a different shape. Explicit server-specified cell boxes
   stay unchanged, and terminal hosts without measured cells keep their existing sizing.
diff --git a/Directory.Packages.props b/Directory.Packages.props
index d32e792..8c63b8e 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -10,7 +10,7 @@
     <PackageVersion Include="SharpConsoleUI" Version="2.7.8" />
 
     <!-- Telnet negotiation: TELOPT/NAWS/MTTS/EOR/CHARSET/MSSP/GMCP/MSDP/MCCP/MXP negotiation. -->
-    <PackageVersion Include="TelnetNegotiationCore" Version="4.5.3" />
+    <PackageVersion Include="TelnetNegotiationCore" Version="4.9.0" />
 
     <!-- The version, from the git tag (see Directory.Build.props). Build-time only. -->
     <PackageVersion Include="MinVer" Version="8.0.0" />
@@ -49,7 +49,7 @@
     <PackageVersion Include="AngleSharp" Version="1.7.1" />
 
     <!-- Logging abstractions (TelnetNegotiationCore takes an ILogger). -->
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.13" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.14" />
 
     <!--
       Client diagnostics: Serilog behind Microsoft.Extensions.Logging. Only the Tui's composition root
diff --git a/src/SharpMUTerm.Avalonia/AvaloniaConsoleDriver.cs b/src/SharpMUTerm.Avalonia/AvaloniaConsoleDriver.cs
index 78807d1..6969b6e 100644
--- a/src/SharpMUTerm.Avalonia/AvaloniaConsoleDriver.cs
+++ b/src/SharpMUTerm.Avalonia/AvaloniaConsoleDriver.cs
@@ -67,6 +67,8 @@ public AvaloniaConsoleDriver(int columns, int rows)
     /// <summary>What the client says is under the pointer, for the window to show (<see cref="WindowPointer"/>).</summary>
     public WindowPointer Pointer { get; } = new();
 
+    public CellMetrics CellMetrics { get; } = new();
+
     /// <summary>The window's screen-reader regions; the window adds them beside the view.</summary>
     public WindowAnnouncer Announcer { get; } = new();
 
diff --git a/src/SharpMUTerm.Avalonia/TerminalView.cs b/src/SharpMUTerm.Avalonia/TerminalView.cs
index a4a262b..8cc9cb8 100644
--- a/src/SharpMUTerm.Avalonia/TerminalView.cs
+++ b/src/SharpMUTerm.Avalonia/TerminalView.cs
@@ -85,6 +85,7 @@ public TerminalView(AvaloniaConsoleDriver driver, SKColor foreground, SKColor ba
         _renderer = new CellRenderer(new CellFonts(fontPoints, family, lineHeight), foreground, background);
         _zoomRenderers[(1, 100)] = _renderer;
         _driver.Pointer.CellHeightMeasured = CellSize.Height;
+        _driver.CellMetrics.Current = new SharpMUTerm.Core.Telnet.TerminalCellSize(_renderer.Fonts.CellWidth, _renderer.Fonts.CellHeight);
         _driver.Pointer.ImageCellSizeMeasured = new ImageCellSize(CellSize.Width, CellSize.Height);
         Focusable = true;
         ClipToBounds = true;
@@ -240,12 +241,35 @@ internal double RowTop(int row, int column)
     /// <summary>The window size that holds a grid of <paramref name="columns"/> × <paramref name="rows"/>.</summary>
     public Size SizeFor(int columns, int rows) => new(columns * CellSize.Width, (rows * CellSize.Height) + FieldReserve);
 
+    private TopLevel? _scalingOwner;
+
     protected override void OnAttachedToVisualTree(VisualTreeAttachmentEventArgs e)
     {
         base.OnAttachedToVisualTree(e);
-        if (TopLevel.GetTopLevel(this) is { } top && Math.Abs(top.RenderScaling - _scale) > 0.001)
+        _scalingOwner = TopLevel.GetTopLevel(this);
+        if (_scalingOwner is { } top)
+        {
+            top.ScalingChanged += OnDisplayScalingChanged;
+            PrepareScale(top.RenderScaling);
+        }
+    }
+
+    protected override void OnDetachedFromVisualTree(VisualTreeAttachmentEventArgs e)
+    {
+        if (_scalingOwner is { } top)
+        {
+            top.ScalingChanged -= OnDisplayScalingChanged;
+            _scalingOwner = null;
+        }
+
+        base.OnDetachedFromVisualTree(e);
+    }
+
+    private void OnDisplayScalingChanged(object? sender, EventArgs e)
+    {
+        if (_scalingOwner is { } top)
         {
-            Rescale(top.RenderScaling);
+            PrepareScale(top.RenderScaling);
         }
     }
 
@@ -338,6 +362,7 @@ private void Rescale(double scale)
 
         _renderer = renderer;
         _driver.Pointer.CellHeightMeasured = CellSize.Height;
+        _driver.CellMetrics.Current = new SharpMUTerm.Core.Telnet.TerminalCellSize(_renderer.Fonts.CellWidth, _renderer.Fonts.CellHeight);
         _driver.Pointer.ImageCellSizeMeasured = new ImageCellSize(CellSize.Width, CellSize.Height);
         // Font changes leave the control's bounds alone, so OnSizeChanged will not do this for us.
         // Going through the driver resize also recomputes pane geometry and schedules per-pane NAWS.
diff --git a/src/SharpMUTerm.Avalonia/WindowHost.cs b/src/SharpMUTerm.Avalonia/WindowHost.cs
index 4b1c2b4..0284dbd 100644
--- a/src/SharpMUTerm.Avalonia/WindowHost.cs
+++ b/src/SharpMUTerm.Avalonia/WindowHost.cs
@@ -98,6 +98,7 @@ public static ClientHost Create(AvaloniaConsoleDriver driver, Action<string>? cl
         Keys = Keys,
         RunsInline = false,
         Pointer = driver.Pointer,
+        CellMetrics = driver.CellMetrics,
         SixelCell = SharpMUTermApp.SixelCellSize(null),
 
         // The same desktop device as the terminal: both are desktop processes on the same machine.
diff --git a/src/SharpMUTerm.Core/Session/WorldSession.cs b/src/SharpMUTerm.Core/Session/WorldSession.cs
index 5cb6839..e8e92fe 100644
--- a/src/SharpMUTerm.Core/Session/WorldSession.cs
+++ b/src/SharpMUTerm.Core/Session/WorldSession.cs
@@ -640,6 +640,7 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
 
         var telnet = _sessionFactory(World.ToConnectionOptions());
         _telnet = telnet;
+        telnet.TerminalCellSizeProvider = () => TerminalCellSizeProvider?.Invoke();
         telnet.OutputReceived += OnOutputReceived;
         GameData.Clear();
         Occupants.Clear();
@@ -1519,6 +1520,12 @@ public async Task SendRawAsync(string command, CancellationToken cancellationTok
         return macro.Command;
     }
 
+    /// <summary>The host's current physical cell dimensions; null for hosts without measurements.</summary>
+    public Func<TerminalCellSize?>? TerminalCellSizeProvider { get; set; }
+
+    public ValueTask RefreshTerminalCellSizeAsync() =>
+        _telnet?.RefreshTerminalCellSizeAsync() ?? ValueTask.CompletedTask;
+
     public ValueTask SetWindowSizeAsync(int width, int height) =>
         _telnet?.SetWindowSizeAsync(width, height) ?? ValueTask.CompletedTask;
 
diff --git a/src/SharpMUTerm.Core/Telnet/ITelnetSession.cs b/src/SharpMUTerm.Core/Telnet/ITelnetSession.cs
index 7a55186..0dc77e7 100644
--- a/src/SharpMUTerm.Core/Telnet/ITelnetSession.cs
+++ b/src/SharpMUTerm.Core/Telnet/ITelnetSession.cs
@@ -98,6 +98,12 @@ ValueTask SendMooEditAsync(MooEdit edit, IReadOnlyList<string> lines) =>
     /// <summary>Connects the transport and begins negotiation and the receive loop.</summary>
     Task ConnectAsync(CancellationToken cancellationToken = default);
 
+    /// <summary>Measured physical cell pixels, if this host knows them. Read at query time.</summary>
+    Func<TerminalCellSize?>? TerminalCellSizeProvider { get => null; set { } }
+
+    /// <summary>Refresh a previously requested terminal cell report after a zoom or display change.</summary>
+    ValueTask RefreshTerminalCellSizeAsync() => ValueTask.CompletedTask;
+
     /// <summary>Sends a command line to the server (a trailing CR/LF is appended).</summary>
     ValueTask SendLineAsync(string text, CancellationToken cancellationToken = default);
 
diff --git a/src/SharpMUTerm.Core/Telnet/TelnetSession.cs b/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
index e94e153..bcee333 100644
--- a/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
+++ b/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
@@ -399,6 +399,12 @@ private Encoding? Negotiated
     private Encoding Fallback =>
         _options.CharsetOrder is [var first, ..] ? first : Encoding.UTF8;
 
+    public Func<TerminalCellSize?>? TerminalCellSizeProvider { get; set; }
+    private TerminalQueryProtocol? _cellQueries;
+
+    public ValueTask RefreshTerminalCellSizeAsync() =>
+        IsConnected ? _cellQueries?.ReportCellSizeAsync() ?? ValueTask.CompletedTask : ValueTask.CompletedTask;
+
     public event EventHandler<TelnetOutputEventArgs>? OutputReceived;
 
     /// <summary>Raised when <see cref="CurrentEncoding"/> changes — in practice, when CHARSET settles.</summary>
@@ -439,10 +445,13 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
         {
             // Building/wiring the interpreter failed after the socket opened; close it so we
             // don't leak a half-open connection, and stay in the not-connected state.
+            var stopping = _cellQueries?.OnDisabledAsync() ?? ValueTask.CompletedTask;
+            _cellQueries = null;
             _interpreter = null;
             _seeded = null;
             _negotiated = null;
             await _transport.CloseAsync().ConfigureAwait(false);
+            await stopping.ConfigureAwait(false);
             throw;
         }
 
@@ -457,11 +466,16 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
 
     private Task<TelnetInterpreter> BuildInterpreterAsync()
     {
+        _cellQueries = new TerminalQueryProtocol().WithCellSizeProvider(() =>
+            TerminalCellSizeProvider?.Invoke() is { IsValid: true } size
+                ? new TelnetNegotiationCore.Models.TerminalCellSize(size.Width, size.Height)
+                : null);
         TelnetInterpreterBuilder builder = new TelnetInterpreterBuilder()
             .UseMode(TelnetInterpreter.TelnetMode.Client)
             .UseLogger(_logger)
             .OnNegotiation(WriteToTransportAsync)
             .OnSubmit(OnSubmitAsync)
+            .AddPlugin(_cellQueries)
             // Who this client is, for every protocol in the library that names it.
             .WithClientIdentity(Identity())
             // Explicit defaults let NAWS observe negotiation completion, so an early pane report
@@ -1023,12 +1037,16 @@ private static async ValueTask ReportBothAsync(WindowSizeProtocol protocol, MudC
 
     public async Task DisconnectAsync()
     {
+        // Disable queued replies immediately, but close transport before awaiting an active socket write.
+        var stopping = _cellQueries?.OnDisabledAsync() ?? ValueTask.CompletedTask;
+        _cellQueries = null;
         if (_loopCts is not null)
         {
             await _loopCts.CancelAsync().ConfigureAwait(false);
         }
 
         await _transport.CloseAsync().ConfigureAwait(false);
+        await stopping.ConfigureAwait(false);
 
         if (_readLoop is not null)
         {
diff --git a/src/SharpMUTerm.Core/Telnet/TerminalCellSize.cs b/src/SharpMUTerm.Core/Telnet/TerminalCellSize.cs
new file mode 100644
index 0000000..95f5b67
--- /dev/null
+++ b/src/SharpMUTerm.Core/Telnet/TerminalCellSize.cs
@@ -0,0 +1,7 @@
+namespace SharpMUTerm.Core.Telnet;
+
+/// <summary>One terminal character cell in physical pixels, not display-independent units.</summary>
+public sealed record TerminalCellSize(int Width, int Height)
+{
+    public bool IsValid => Width is > 0 and <= 65535 && Height is > 0 and <= 65535;
+}
diff --git a/src/SharpMUTerm.Tui/Hosting/CellMetrics.cs b/src/SharpMUTerm.Tui/Hosting/CellMetrics.cs
new file mode 100644
index 0000000..365880f
--- /dev/null
+++ b/src/SharpMUTerm.Tui/Hosting/CellMetrics.cs
@@ -0,0 +1,27 @@
+using SharpMUTerm.Core.Telnet;
+
+namespace SharpMUTerm.Tui;
+
+/// <summary>A host-owned, thread-safe snapshot of actual physical cell pixels. Unknown is never guessed.</summary>
+internal class CellMetrics : IDisposable
+{
+    private TerminalCellSize? _current;
+
+    public TerminalCellSize? Current
+    {
+        get => Volatile.Read(ref _current);
+        set
+        {
+            if (Interlocked.Exchange(ref _current, value) != value)
+            {
+                Changed?.Invoke();
+            }
+        }
+    }
+
+    public event Action? Changed;
+
+    public virtual void Start() { }
+
+    public virtual void Dispose() { }
+}
diff --git a/src/SharpMUTerm.Tui/Hosting/ClientHost.cs b/src/SharpMUTerm.Tui/Hosting/ClientHost.cs
index c761655..13fe73f 100644
--- a/src/SharpMUTerm.Tui/Hosting/ClientHost.cs
+++ b/src/SharpMUTerm.Tui/Hosting/ClientHost.cs
@@ -58,6 +58,9 @@ internal sealed record ClientHost
     /// </summary>
     public required IPointerPresenter? Pointer { get; init; }
 
+    /// <summary>Measured physical cell pixels, independent of pointer presentation; null when unavailable.</summary>
+    public required CellMetrics? CellMetrics { get; init; }
+
     /// <summary>The keys this host delivers differently from the others, or keeps for itself.</summary>
     public required HostKeys Keys { get; init; }
 
@@ -221,6 +224,7 @@ public static ClientHost Terminal(TerminalCapabilities capabilities)
         FocusReporting = PlatformDecodesFocusReports,
         Keys = HostKeys.Terminal,
         Pointer = TerminalPointer.Create(driver),
+        CellMetrics = new TerminalCellMetrics(),
         RunsInline = false,
         SixelCell = SharpMUTermApp.SixelCellSize(Environment.GetEnvironmentVariable(SharpMUTermApp.SixelCellVariable)),
         Audio = () => DesktopAudio.TryCreate(),
@@ -256,6 +260,7 @@ public static ClientHost Terminal(TerminalCapabilities capabilities)
         FocusReporting = false,
         Keys = HostKeys.Terminal,
         Pointer = null,
+        CellMetrics = null,
         RunsInline = true,
         SixelCell = SharpMUTermApp.SixelCellSize(null),
         Audio = null,
diff --git a/src/SharpMUTerm.Tui/Hosting/TerminalCellMetrics.cs b/src/SharpMUTerm.Tui/Hosting/TerminalCellMetrics.cs
new file mode 100644
index 0000000..7a181b1
--- /dev/null
+++ b/src/SharpMUTerm.Tui/Hosting/TerminalCellMetrics.cs
@@ -0,0 +1,91 @@
+using System.Runtime.InteropServices;
+using SharpMUTerm.Core.Telnet;
+
+namespace SharpMUTerm.Tui;
+
+/// <summary>
+/// Reads the Unix terminal's published pixel extent without touching its input stream. Some emulators
+/// publish no pixels; Windows pseudoconsoles do not expose reliable renderer metrics. Those stay unknown.
+/// </summary>
+internal sealed class TerminalCellMetrics : CellMetrics
+{
+    private readonly Func<TerminalCellSize?> _read;
+    private Timer? _timer;
+    private readonly object _gate = new();
+    private bool _disposed;
+
+    public TerminalCellMetrics() : this(ReadTerminal) { }
+
+    internal TerminalCellMetrics(Func<TerminalCellSize?> read) => _read = read;
+
+    public override void Start()
+    {
+        lock (_gate)
+        {
+            if (_disposed || _timer is not null) { return; }
+            Sample();
+            // Pixel-only zoom need not resize the character grid.
+            _timer = new Timer(_ => Sample(), null, TimeSpan.FromMilliseconds(500), TimeSpan.FromMilliseconds(500));
+        }
+    }
+
+    internal void Sample()
+    {
+        lock (_gate)
+        {
+            if (!_disposed) { Current = _read(); }
+        }
+    }
+
+    public override void Dispose()
+    {
+        lock (_gate)
+        {
+            _disposed = true;
+            _timer?.Dispose();
+            _timer = null;
+        }
+    }
+
+    internal static TerminalCellSize? FromWindowSize(int columns, int rows, int width, int height)
+    {
+        if (columns <= 0 || rows <= 0 || width <= 0 || height <= 0 || width % columns != 0 || height % rows != 0)
+        {
+            return null;
+        }
+
+        var cell = new TerminalCellSize(width / columns, height / rows);
+        return cell.IsValid ? cell : null;
+    }
+
+    private static TerminalCellSize? ReadTerminal()
+    {
+        if (!OperatingSystem.IsLinux() && !OperatingSystem.IsMacOS()) { return null; }
+        // Query stdout only: a redirected stream must not silently borrow a different terminal's dimensions.
+        var request = OperatingSystem.IsMacOS() ? 0x40087468UL : 0x5413UL;
+        WindowSize size;
+        // macOS ARM64 passes variadic ioctl arguments on the stack, not in x2.
+        var result = OperatingSystem.IsMacOS() && RuntimeInformation.ProcessArchitecture == Architecture.Arm64
+            ? IoctlArm64(1, (nuint)request, 0, 0, 0, 0, 0, 0, out size)
+            : Ioctl(1, (nuint)request, out size);
+        return result == 0
+            ? FromWindowSize(size.Columns, size.Rows, size.Width, size.Height)
+            : null;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct WindowSize
+    {
+        public ushort Rows;
+        public ushort Columns;
+        public ushort Width;
+        public ushort Height;
+    }
+
+    [DllImport("libc", EntryPoint = "ioctl", SetLastError = true)]
+    private static extern int IoctlArm64(int descriptor, nuint request,
+        ulong x2, ulong x3, ulong x4, ulong x5, ulong x6, ulong x7, out WindowSize size);
+
+    [DllImport("libc", EntryPoint = "ioctl", SetLastError = true)]
+    private static extern int Ioctl(int descriptor, nuint request, out WindowSize size);
+}
diff --git a/src/SharpMUTerm.Tui/SharpMUTermApp.cs b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
index d9bc986..03bef7c 100644
--- a/src/SharpMUTerm.Tui/SharpMUTermApp.cs
+++ b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
@@ -1070,6 +1070,12 @@ public SharpMUTermApp(
         };
         _window.PreviewKeyPressed += OnWindowKey;
 
+        // Physical pixels can change without a character-grid resize or a new frame.
+        if (Host.CellMetrics is not null)
+        {
+            Host.CellMetrics.Changed += OnTerminalCellPixelsChanged;
+        }
+
         // NAWS rides the frame. Pane rectangles exist only while an arranged layout does, and every
         // layout change (a resize, a split, a closed tab, a zoom, a window moved between panes) tears
         // the pane area down and rebuilds it — so inside RebuildPaneArea, where the change is made,
@@ -1107,13 +1113,15 @@ public SharpMUTermApp(
 
         // A modal that covers the main window entirely leaves it unpainted, so no PostBufferPaint says the native
         // panels are now under it; the modal stack changing says it instead.
-        _system.ModalStateService.StateChanged += (_, _) =>
+        // The framework delivers this notification on the thread pool. Native overlay models read
+        // UI-owned layout state, so publish on the same thread as frame-driven updates.
+        _system.ModalStateService.StateChanged += (_, _) => OnUiThread(() =>
         {
             PublishPanels();
             PublishInputBand();
             PublishDividers();
             PublishPaneChrome();
-        };
+        });
         if (_sixel is not null)
         {
             // Another window over this one rewrites the cells a picture sits on, and the frame that puts
@@ -1159,10 +1167,11 @@ public int Run(IReadOnlyList<StartupConnection> startup)
         // Here and not in the constructor: this is the one method that means "there is a live terminal
         // in front of this app", and asking a terminal to report focus is a write to it.
         _focus.Start();
-        StartTitle();
         int exitCode;
         try
         {
+            Host.CellMetrics?.Start();
+            StartTitle();
             exitCode = _system.Run();
         }
         finally
@@ -1170,6 +1179,7 @@ public int Run(IReadOnlyList<StartupConnection> startup)
             // Focus reporting is turned off as the loop ends rather than at disposal, which the live entry point never
             // reaches: left on, the shell (or the new version an update execs into this terminal) gets ESC [ I.
             _focus.Stop();
+            Host.CellMetrics?.Dispose();
         }
 
         // The colours are kitty's, not this window's: left set, they would go on drawing the shell's own
@@ -3566,6 +3576,9 @@ private void BindSession(WorldSession session, string? windowId = null)
         {
             if (e.State == ConnectionState.Connected)
             {
+                // A query may have arrived while ConnectAsync was still finishing. Catch a
+                // pixel change whose event occurred before the session entered Connected.
+                _ = RefreshCellPixelsAsync(session);
                 ReportAutomation(session);
 
                 // Recorded on the *connection*, not on the report — because "we reached this server and
@@ -9656,6 +9669,7 @@ private bool RunBuiltInCommand(string id)
     /// </summary>
     private void OnSessionAdded(object? sender, WorldSession session)
     {
+        session.TerminalCellSizeProvider = () => Host.CellMetrics?.Current;
         session.MsdpReports = StatusMeter.MsdpVariables(_config.Text.StatusMeters);
         WatchPresence(session);
         StartReconnecting(session);
@@ -14609,6 +14623,31 @@ private void ArmSizeFlush(DateTimeOffset now)
             Timeout.InfiniteTimeSpan);
     }
 
+    private void OnTerminalCellPixelsChanged() => OnUiThread(() =>
+    {
+        foreach (var session in _sessionWindows.Keys)
+        {
+            if (session.IsConnected)
+            {
+                _ = RefreshCellPixelsAsync(session);
+            }
+        }
+    });
+
+    private async Task RefreshCellPixelsAsync(WorldSession session)
+    {
+        try
+        {
+            await session.RefreshTerminalCellSizeAsync().ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            // A display-metrics event cannot await this send. Log without causing another repaint
+            // and retry loop; another metrics change or explicit query can retry an unsent size.
+            _diagnostics.For("SharpMUTerm.TerminalPixels").LogWarning(ex, "Could not report terminal cell pixels");
+        }
+    }
+
     /// <summary>
     /// Sends one session's NAWS report. The callers cannot await it — a paint callback, a timer and a
     /// connect continuation — but the failure is not swallowed the way the old fire-and-forget was: a
@@ -15468,6 +15507,12 @@ bool Fits(StatusSegment hint, IEnumerable<StatusSegment> cluster) =>
 
     public async ValueTask DisposeAsync()
     {
+        if (Host.CellMetrics is not null)
+        {
+            Host.CellMetrics.Changed -= OnTerminalCellPixelsChanged;
+            Host.CellMetrics.Dispose();
+        }
+
         _system.ConsoleDriver.MouseEvent -= OnDriverMouseEvent;
         _focus.Dispose();           // and the terminal is told to stop reporting focus at nobody
         ResetTransparentColours();  // and kitty's colours go back to its own
diff --git a/tests/SharpMUTerm.Avalonia.Tests/NativePanelTests.cs b/tests/SharpMUTerm.Avalonia.Tests/NativePanelTests.cs
index fe3d639..f5b7c74 100644
--- a/tests/SharpMUTerm.Avalonia.Tests/NativePanelTests.cs
+++ b/tests/SharpMUTerm.Avalonia.Tests/NativePanelTests.cs
@@ -154,10 +154,28 @@ public async Task WithNoSettingsWindowTheEditLinkOpensF4AndNoNativePanelCoversIt
         app.RenderSnapshot("layout-combat");
 
         var panel = driver.Pointer.Panels.Single(p => p.PanelId == PanelIds.QuickBar);
-        panel.Dispatch!(QuickBarModel.EditCommand);
-        app.RenderNextFrame();
-        await Assert.That(app.OpenSettingsKey).IsEqualTo(ConsoleKey.F4);
-        await Assert.That(driver.Pointer.Panels).IsEmpty().Because("a native view would sit over the modal's cells");
+        var hidden = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        void ObservePanels()
+        {
+            if (driver.Pointer.Panels.Count == 0) { hidden.TrySetResult(); }
+        }
+
+        driver.Pointer.PanelsChanged += ObservePanels;
+        try
+        {
+            panel.Dispatch!(QuickBarModel.EditCommand);
+            app.RenderNextFrame();
+            await Assert.That(app.OpenSettingsKey).IsEqualTo(ConsoleKey.F4);
+            // A fullscreen modal occludes the main pane, so rendering cannot publish its overlays.
+            // Modal state notifications arrive asynchronously; await the actual host update rather
+            // than assuming a thread-pool callback has run before this assertion.
+            await hidden.Task.WaitAsync(TimeSpan.FromSeconds(5));
+            await Assert.That(driver.Pointer.Panels).IsEmpty().Because("a native view would sit over the modal's cells");
+        }
+        finally
+        {
+            driver.Pointer.PanelsChanged -= ObservePanels;
+        }
     }
 
     private sealed class RecordingSettings : INativeSettings
diff --git a/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
new file mode 100644
index 0000000..9e7480f
--- /dev/null
+++ b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
@@ -0,0 +1,115 @@
+using SharpMUTerm.Core.Configuration;
+using SharpMUTerm.Core.Telnet;
+using SharpMUTerm.Tui;
+using SharpMUTerm.Tui.Tests;
+using SkiaSharp;
+
+namespace SharpMUTerm.Avalonia.Tests;
+
+// These cases create full client apps, as the native-composer fixture does.
+[NotInParallel]
+public class TerminalCellPixelTests
+{
+    [Test]
+    [Arguments(false, false)]
+    [Arguments(true, false)]
+    [Arguments(false, true)]
+    public async Task ADisplayMetricChangeReachesAConnectedSessionWithoutAFrameOrGridResize(bool duringHandshake, bool withoutPointer)
+    {
+        var result = await TerminalViewTests.Session.Dispatch(() =>
+        {
+            using var driver = new AvaloniaConsoleDriver(80, 24);
+            var view = new TerminalView(driver, SKColors.White, SKColors.Black, 16, null);
+            var config = new AppConfiguration();
+            var world = new WorldDefinition { Name = "Pixels", Host = "example.invalid", Port = 4000 };
+            config.Worlds.Add(world);
+            var telnet = new RecordingTelnetSession();
+            var host = DesktopLayerTests.InlineHost(driver);
+            if (withoutPointer) { host = host with { Pointer = null }; }
+            var app = new SharpMUTermApp(config, host);
+            app.TelnetFactory = _ => telnet;
+            try
+            {
+                if (duringHandshake)
+                {
+                    telnet.Connecting = () => view.PrepareScale(2);
+                }
+
+                var before = telnet.CellPixelReports.Count;
+                app.BindWorldWithoutConnecting(world).ConnectAsync().GetAwaiter().GetResult();
+                if (!duringHandshake)
+                {
+                    before = telnet.CellPixelReports.Count;
+                    view.PrepareScale(2);
+                }
+                var reports = telnet.CellPixelReports.Skip(before).ToArray();
+                return (reports, expected: new TerminalCellSize(view.Renderer.Fonts.CellWidth, view.Renderer.Fonts.CellHeight));
+            }
+            finally
+            {
+                app.DisposeAsync().AsTask().GetAwaiter().GetResult();
+            }
+        }, CancellationToken.None);
+        await Assert.That(result.reports).IsEquivalentTo(new TerminalCellSize?[] { result.expected });
+    }
+
+    [Test]
+    public async Task PixelChangesNotifyEvenWithoutAnArrangedGridResize()
+    {
+        var result = await TerminalViewTests.Session.Dispatch(() =>
+        {
+            using var driver = new AvaloniaConsoleDriver(80, 24);
+            var view = new TerminalView(driver, SKColors.White, SKColors.Black, 16, null);
+            var changes = 0;
+            var resizes = 0;
+            driver.CellMetrics.Changed += () => changes++;
+            driver.ScreenResized += (_, _) => resizes++;
+            // No bounds: there is no character grid change to piggyback a report on.
+            view.PrepareScale(2);
+            view.PrepareScale(2);
+            return (changes, resizes, pixels: driver.CellMetrics.Current);
+        }, CancellationToken.None);
+        await Assert.That(result.changes).IsEqualTo(1);
+        await Assert.That(result.resizes).IsEqualTo(0);
+        await Assert.That(result.pixels!.Width).IsGreaterThan(10);
+    }
+
+    [Test]
+    [Arguments(1.0)]
+    [Arguments(1.25)]
+    [Arguments(1.5)]
+    [Arguments(2.0)]
+    public async Task FreshSessionUsesPhysicalPixelsAndTracksZoomAndDpiWithoutSavingSettings(double scale)
+    {
+        var results = await TerminalViewTests.Session.Dispatch(() =>
+        {
+            using var driver = new AvaloniaConsoleDriver(80, 24);
+            var view = new TerminalView(driver, SKColors.White, SKColors.Black, 16, null, 1.12f);
+            var config = new AppConfiguration();
+            var world = new WorldDefinition { Name = "Pixels", Host = "example.invalid", Port = 4000 };
+            config.Worlds.Add(world);
+            var app = new SharpMUTermApp(config, DesktopLayerTests.InlineHost(driver));
+            try
+            {
+                var session = app.BindWorldWithoutConnecting(world);
+                TerminalCellSize? Read() => session.TerminalCellSizeProvider?.Invoke();
+                var initial = Read();
+                view.PrepareScale(scale);
+                var dpi = Read();
+                var expectedDpi = new TerminalCellSize(view.Renderer.Fonts.CellWidth, view.Renderer.Fonts.CellHeight);
+                view.SetZoom(200);
+                var zoomed = Read();
+                var expectedZoom = new TerminalCellSize(view.Renderer.Fonts.CellWidth, view.Renderer.Fonts.CellHeight);
+                return (initial, dpi, expectedDpi, zoomed, expectedZoom);
+            }
+            finally
+            {
+                app.DisposeAsync().AsTask().GetAwaiter().GetResult();
+            }
+        }, CancellationToken.None);
+        await Assert.That(results.initial).IsEqualTo(new TerminalCellSize(10, 24));
+        await Assert.That(results.dpi).IsEqualTo(results.expectedDpi);
+        await Assert.That(results.zoomed).IsEqualTo(results.expectedZoom);
+        await Assert.That(results.zoomed!.Width).IsGreaterThan(results.dpi!.Width);
+    }
+}
diff --git a/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs b/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs
new file mode 100644
index 0000000..13939a1
--- /dev/null
+++ b/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs
@@ -0,0 +1,188 @@
+using System.Text;
+using Microsoft.Extensions.Logging.Abstractions;
+using SharpMUTerm.Core.Telnet;
+
+namespace SharpMUTerm.Core.Tests.Telnet;
+
+public class TerminalCellQueryTests
+{
+    [Test]
+    [Arguments(false)]
+    [Arguments(true)]
+    public async Task AnswersBeforeAnyNewlineWithHeightThenWidthAndNoTerminator(bool fragmented)
+    {
+        var transport = new ScriptedTransport { Fragmented = fragmented };
+        await using var session = new TelnetSession(transport, NullLogger.Instance)
+        {
+            TerminalCellSizeProvider = () => new(10, 24),
+        };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+        await session.SendLineAsync("look");
+        await Until(() => Encoding.ASCII.GetString(transport.Sent).Contains("look\r\n"));
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10tlook\r\n");
+    }
+
+    [Test]
+    [Arguments("\u001b]title\r\0\u001b[16t\a")]
+    [Arguments("\u001bPdata\r\0\u001b[16t\u001b\\")]
+    [Arguments("\u001b^data\u001b[16t\u001b\\")]
+    [Arguments("\u001b]title\u001b[16t\a")]
+    [Arguments("\u001bPdata\u001b[16t\u001b\\")]
+    [Arguments("\u001b_Gpayload\u001b[16t\u001b\\")]
+    [Arguments("\u001bXdata\u001b[16t\u001b\\")]
+    [Arguments("\u001b[?16t\u001b[16;1t\u001b[016t\u001b[16 t")]
+    public async Task NeverAnswersControlStringContentsOrDifferentCommands(string input)
+    {
+        var transport = new ScriptedTransport { Fragmented = true };
+        await using var session = new TelnetSession(transport, NullLogger.Instance)
+        {
+            TerminalCellSizeProvider = () => new(10, 24),
+        };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        await DeliverLine(session, transport, input + "done");
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+    }
+
+    [Test]
+    public async Task OnlyRefreshesAPeerThatAskedAndOnlyForChangedMeasuredPixels()
+    {
+        TerminalCellSize? size = new(10, 24);
+        var transport = new ScriptedTransport();
+        await using var session = new TelnetSession(transport, NullLogger.Instance)
+        {
+            TerminalCellSizeProvider = () => size,
+        };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        offset = transport.Sent.Length;
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+        size = new(16, 40);
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;40;16t");
+        offset = transport.Sent.Length;
+        size = null;
+        await session.RefreshTerminalCellSizeAsync();
+        size = new(0, 24);
+        await session.RefreshTerminalCellSizeAsync();
+        size = new(10, 65536);
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+    }
+
+    [Test]
+    public async Task UnknownMetricsDoNotInventAReplyAndCanBecomeAvailableLater()
+    {
+        TerminalCellSize? size = null;
+        var transport = new ScriptedTransport();
+        await using var session = new TelnetSession(transport, NullLogger.Instance) { TerminalCellSizeProvider = () => size };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        await DeliverLine(session, transport, "\u001b[16tdone");
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+        size = new(10, 24);
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+    }
+
+    [Test]
+    public async Task ObservingQueriesPreservesTheOriginalApplicationBytes()
+    {
+        var transport = new ScriptedTransport { Fragmented = true };
+        await using var session = new TelnetSession(transport, NullLogger.Instance,
+            new TelnetSessionOptions { EncodingOverride = Encoding.Latin1 })
+        {
+            TerminalCellSizeProvider = () => new(10, 24),
+        };
+        await session.ConnectAsync();
+        const string input = "caf\u00e9\u001b[31m red\u001b[0m\u001b[16t";
+        var completion = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        session.OutputReceived += (_, e) => completion.TrySetResult(e.Text);
+        transport.SendToClient(Encoding.Latin1.GetBytes(input + "\r\n"));
+        var output = await completion.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        await Assert.That(output).IsEqualTo(input);
+    }
+
+    [Test]
+    public async Task QueriesInsideTelnetSubnegotiationDoNotReachTheObserver()
+    {
+        var transport = new ScriptedTransport();
+        await using var session = new TelnetSession(transport, NullLogger.Instance) { TerminalCellSizeProvider = () => new(10, 24) };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        transport.SendToClient([255, 250, 200, 27, 91, 49, 54, 116, 255, 240]);
+        await DeliverLine(session, transport, "done");
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+    }
+
+    [Test]
+    public async Task ALineBoundaryRecoversFromAnUnterminatedControlString()
+    {
+        var transport = new ScriptedTransport { Fragmented = true };
+        await using var session = new TelnetSession(transport, NullLogger.Instance) { TerminalCellSizeProvider = () => new(10, 24) };
+        await session.ConnectAsync();
+        await DeliverLine(session, transport, "\u001b]unterminated");
+        var offset = transport.Sent.Length;
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+        await session.DisconnectAsync();
+        offset = transport.Sent.Length;
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+    }
+
+    [Test]
+    public async Task AGoAheadPromptBoundaryRecoversAnUnfinishedControlString()
+    {
+        var transport = new ScriptedTransport { Fragmented = true };
+        await using var session = new TelnetSession(transport, NullLogger.Instance) { TerminalCellSizeProvider = () => new(10, 24) };
+        var prompt = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        session.OutputReceived += (_, e) => { if (e.IsPrompt) prompt.TrySetResult(); };
+        await session.ConnectAsync();
+        transport.SendToClient([.. "\u001b]unfinished"u8.ToArray(), 255, 249]);
+        await prompt.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        var offset = transport.Sent.Length;
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+    }
+
+    private static async Task DeliverLine(TelnetSession session, ScriptedTransport transport, string text)
+    {
+        var completion = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        void OnOutput(object? sender, TelnetOutputEventArgs e) => completion.TrySetResult();
+        session.OutputReceived += OnOutput;
+        try
+        {
+            transport.SendToClient(Encoding.ASCII.GetBytes(text + "\r\n"));
+            await completion.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        }
+        finally
+        {
+            session.OutputReceived -= OnOutput;
+        }
+    }
+
+    private static async Task Until(Func<bool> predicate)
+    {
+        for (var i = 0; i < 250 && !predicate(); i++)
+        {
+            await Task.Delay(10);
+        }
+
+        await Assert.That(predicate()).IsTrue();
+    }
+}
diff --git a/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs b/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
index ec2bf9f..c9be616 100644
--- a/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
+++ b/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
@@ -15,6 +15,15 @@ internal sealed class RecordingTelnetSession : ITelnetSession
 
     public bool IsConnected { get; private set; }
 
+    public Func<TerminalCellSize?>? TerminalCellSizeProvider { get; set; }
+    public List<TerminalCellSize?> CellPixelReports { get; } = [];
+
+    public ValueTask RefreshTerminalCellSizeAsync()
+    {
+        CellPixelReports.Add(TerminalCellSizeProvider?.Invoke());
+        return ValueTask.CompletedTask;
+    }
+
     /// <summary>What this fake reports as in force; a test that cares sets it and raises the event.</summary>
     public SessionEncoding CurrentEncoding { get; set; } =
         new(new UTF8Encoding(encoderShouldEmitUTF8Identifier: false), EncodingSource.Assumed);
@@ -29,6 +38,8 @@ internal sealed class RecordingTelnetSession : ITelnetSession
     /// <summary>How many times a connection was asked for, refused ones included.</summary>
     public int ConnectAttempts { get; private set; }
 
+    public Action? Connecting { get; set; }
+
     /// <summary>Every NAWS report this session was given, oldest first.</summary>
     public IReadOnlyList<(int Width, int Height)> Sizes
     {
@@ -144,6 +155,7 @@ public Task ConnectAsync(CancellationToken cancellationToken = default)
             return Task.FromException(fault);
         }
 
+        Connecting?.Invoke();
         IsConnected = true;
         return Task.CompletedTask;
     }
diff --git a/tests/SharpMUTerm.Tui.Tests/TerminalCellMetricsTests.cs b/tests/SharpMUTerm.Tui.Tests/TerminalCellMetricsTests.cs
new file mode 100644
index 0000000..91f224b
--- /dev/null
+++ b/tests/SharpMUTerm.Tui.Tests/TerminalCellMetricsTests.cs
@@ -0,0 +1,65 @@
+using SharpMUTerm.Core.Telnet;
+using SharpMUTerm.Tui;
+
+namespace SharpMUTerm.Tui.Tests;
+
+public class TerminalCellMetricsTests
+{
+    [Test]
+    public async Task DerivesPhysicalPixelsFromTheTerminalExtent()
+    {
+        await Assert.That(TerminalCellMetrics.FromWindowSize(120, 40, 1200, 960)).IsEqualTo(new TerminalCellSize(10, 24));
+        await Assert.That(TerminalCellMetrics.FromWindowSize(120, 40, 1440, 1200)).IsEqualTo(new TerminalCellSize(12, 30));
+    }
+
+    [Test]
+    [Arguments(0, 40, 1200, 960)]
+    [Arguments(120, 0, 1200, 960)]
+    [Arguments(120, 40, 0, 960)]
+    [Arguments(120, 40, 1200, 0)]
+    [Arguments(120, 40, 1201, 960)]
+    public async Task NeverInventsMetricsForMissingOrInexactDimensions(int columns, int rows, int width, int height)
+        => await Assert.That(TerminalCellMetrics.FromWindowSize(columns, rows, width, height)).IsNull();
+
+    [Test]
+    public async Task PollsPixelOnlyChangesAndStopsOnDisposal()
+    {
+        TerminalCellSize? size = new(10, 24);
+        using var metrics = new TerminalCellMetrics(() => Volatile.Read(ref size));
+        var changed = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        metrics.Changed += () =>
+        {
+            if (metrics.Current == new TerminalCellSize(12, 30)) { changed.TrySetResult(); }
+        };
+        metrics.Start();
+        Volatile.Write(ref size, new(12, 30));
+        await changed.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        metrics.Dispose();
+        Volatile.Write(ref size, new(16, 40));
+        await Task.Delay(600);
+        await Assert.That(metrics.Current).IsEqualTo(new TerminalCellSize(12, 30));
+    }
+
+    [Test]
+    public async Task PublishesPixelOnlyChangesAndForgetsUnavailableMetrics()
+    {
+        TerminalCellSize? size = new(10, 24);
+        using var metrics = new TerminalCellMetrics(() => size);
+        var changes = 0;
+        metrics.Changed += () => changes++;
+        metrics.Sample();
+        metrics.Sample();
+        size = new(12, 30);
+        metrics.Sample();
+        await Assert.That(metrics.Current).IsEqualTo(size);
+        size = null;
+        metrics.Sample();
+        await Assert.That(metrics.Current).IsNull();
+        await Assert.That(changes).IsEqualTo(3);
+        metrics.Dispose();
+        size = new(10, 24);
+        metrics.Sample();
+        metrics.Start();
+        await Assert.That(changes).IsEqualTo(3);
+    }
+}