From 623597a326ca776d464c2cd0aebf30debceee37d Mon Sep 17 00:00:00 2001
From: Harry Cordewener <admin@twilightdays.org>
Date: Sun, 8 Nov 2026 19:30:45 -0600
Subject: [PATCH 1/6] Report measured terminal cell pixels through CSI queries

---
 CHANGELOG.md                                  |   5 +
 Directory.Packages.props                      |   2 +-
 src/SharpMUTerm.Avalonia/TerminalView.cs      |  29 ++-
 src/SharpMUTerm.Avalonia/WindowPointer.cs     |  17 ++
 src/SharpMUTerm.Core/Session/WorldSession.cs  |   7 +
 src/SharpMUTerm.Core/SharpMUTerm.Core.csproj  |   4 +
 src/SharpMUTerm.Core/Telnet/ITelnetSession.cs |   6 +
 src/SharpMUTerm.Core/Telnet/TelnetSession.cs  |  11 +
 .../Telnet/TerminalCellQueryResponder.cs      | 135 ++++++++++
 .../Telnet/TerminalCellSize.cs                |   7 +
 src/SharpMUTerm.Tui/Pointer/PointerTarget.cs  |   6 +
 src/SharpMUTerm.Tui/SharpMUTermApp.cs         |  36 +++
 .../TerminalCellPixelTests.cs                 |  99 +++++++
 .../Telnet/TerminalCellQueryTests.cs          | 241 ++++++++++++++++++
 .../RecordingTelnetSession.cs                 |   9 +
 15 files changed, 611 insertions(+), 3 deletions(-)
 create mode 100644 src/SharpMUTerm.Core/Telnet/TerminalCellQueryResponder.cs
 create mode 100644 src/SharpMUTerm.Core/Telnet/TerminalCellSize.cs
 create mode 100644 tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
 create mode 100644 tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17b9f2b5..20e30aa7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,11 @@ and a release's notes are its section. The procedure is in [`docs/RELEASING.md`]
 
 ### Fixed
 
+- The desktop window answers terminal cell-pixel queries with its actual measured pixels, allowing
+  servers to size images correctly. Servers that asked receive refreshed cell dimensions after zoom
+  or display-scaling changes. Replies do not add a command newline or forward server escapes to
+  the local terminal.
+
 - Desktop MXP images use the measured font cell dimensions when sizing pictures, instead of assuming an 8×16 cell.
   This avoids stretching pictures when the selected font has a different shape. Explicit server-specified cell boxes
   stay unchanged, and terminal hosts without measured cells keep their existing sizing.
diff --git a/Directory.Packages.props b/Directory.Packages.props
index d32e792e..01490984 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -49,7 +49,7 @@
     <PackageVersion Include="AngleSharp" Version="1.7.1" />
 
     <!-- Logging abstractions (TelnetNegotiationCore takes an ILogger). -->
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.13" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.14" />
 
     <!--
       Client diagnostics: Serilog behind Microsoft.Extensions.Logging. Only the Tui's composition root
diff --git a/src/SharpMUTerm.Avalonia/TerminalView.cs b/src/SharpMUTerm.Avalonia/TerminalView.cs
index a4a262bf..abf0c416 100644
--- a/src/SharpMUTerm.Avalonia/TerminalView.cs
+++ b/src/SharpMUTerm.Avalonia/TerminalView.cs
@@ -85,6 +85,7 @@ public TerminalView(AvaloniaConsoleDriver driver, SKColor foreground, SKColor ba
         _renderer = new CellRenderer(new CellFonts(fontPoints, family, lineHeight), foreground, background);
         _zoomRenderers[(1, 100)] = _renderer;
         _driver.Pointer.CellHeightMeasured = CellSize.Height;
+        _driver.Pointer.TerminalCellPixelsMeasured = new SharpMUTerm.Core.Telnet.TerminalCellSize(_renderer.Fonts.CellWidth, _renderer.Fonts.CellHeight);
         _driver.Pointer.ImageCellSizeMeasured = new ImageCellSize(CellSize.Width, CellSize.Height);
         Focusable = true;
         ClipToBounds = true;
@@ -240,12 +241,35 @@ internal double RowTop(int row, int column)
     /// <summary>The window size that holds a grid of <paramref name="columns"/> × <paramref name="rows"/>.</summary>
     public Size SizeFor(int columns, int rows) => new(columns * CellSize.Width, (rows * CellSize.Height) + FieldReserve);
 
+    private TopLevel? _scalingOwner;
+
     protected override void OnAttachedToVisualTree(VisualTreeAttachmentEventArgs e)
     {
         base.OnAttachedToVisualTree(e);
-        if (TopLevel.GetTopLevel(this) is { } top && Math.Abs(top.RenderScaling - _scale) > 0.001)
+        _scalingOwner = TopLevel.GetTopLevel(this);
+        if (_scalingOwner is { } top)
+        {
+            top.ScalingChanged += OnDisplayScalingChanged;
+            PrepareScale(top.RenderScaling);
+        }
+    }
+
+    protected override void OnDetachedFromVisualTree(VisualTreeAttachmentEventArgs e)
+    {
+        if (_scalingOwner is { } top)
+        {
+            top.ScalingChanged -= OnDisplayScalingChanged;
+            _scalingOwner = null;
+        }
+
+        base.OnDetachedFromVisualTree(e);
+    }
+
+    private void OnDisplayScalingChanged(object? sender, EventArgs e)
+    {
+        if (_scalingOwner is { } top)
         {
-            Rescale(top.RenderScaling);
+            PrepareScale(top.RenderScaling);
         }
     }
 
@@ -338,6 +362,7 @@ private void Rescale(double scale)
 
         _renderer = renderer;
         _driver.Pointer.CellHeightMeasured = CellSize.Height;
+        _driver.Pointer.TerminalCellPixelsMeasured = new SharpMUTerm.Core.Telnet.TerminalCellSize(_renderer.Fonts.CellWidth, _renderer.Fonts.CellHeight);
         _driver.Pointer.ImageCellSizeMeasured = new ImageCellSize(CellSize.Width, CellSize.Height);
         // Font changes leave the control's bounds alone, so OnSizeChanged will not do this for us.
         // Going through the driver resize also recomputes pane geometry and schedules per-pane NAWS.
diff --git a/src/SharpMUTerm.Avalonia/WindowPointer.cs b/src/SharpMUTerm.Avalonia/WindowPointer.cs
index 9f046a8a..785a5b13 100644
--- a/src/SharpMUTerm.Avalonia/WindowPointer.cs
+++ b/src/SharpMUTerm.Avalonia/WindowPointer.cs
@@ -91,6 +91,23 @@ internal int WindowColumnsMeasured
 
     int? IPointerPresenter.WindowColumns => WindowColumnsMeasured is > 0 and var columns ? columns : null;
 
+    private SharpMUTerm.Core.Telnet.TerminalCellSize? _terminalCellPixels;
+    internal SharpMUTerm.Core.Telnet.TerminalCellSize? TerminalCellPixelsMeasured
+    {
+        get => Volatile.Read(ref _terminalCellPixels);
+        set
+        {
+            if (Interlocked.Exchange(ref _terminalCellPixels, value) != value)
+            {
+                TerminalCellPixelsChanged?.Invoke();
+            }
+        }
+    }
+
+    public event Action? TerminalCellPixelsChanged;
+
+    SharpMUTerm.Core.Telnet.TerminalCellSize? IPointerPresenter.TerminalCellPixels => TerminalCellPixelsMeasured;
+
     private ImageCellSize? _imageCellSize;
 
     internal ImageCellSize? ImageCellSizeMeasured
diff --git a/src/SharpMUTerm.Core/Session/WorldSession.cs b/src/SharpMUTerm.Core/Session/WorldSession.cs
index 5cb6839b..e8e92fef 100644
--- a/src/SharpMUTerm.Core/Session/WorldSession.cs
+++ b/src/SharpMUTerm.Core/Session/WorldSession.cs
@@ -640,6 +640,7 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
 
         var telnet = _sessionFactory(World.ToConnectionOptions());
         _telnet = telnet;
+        telnet.TerminalCellSizeProvider = () => TerminalCellSizeProvider?.Invoke();
         telnet.OutputReceived += OnOutputReceived;
         GameData.Clear();
         Occupants.Clear();
@@ -1519,6 +1520,12 @@ public async Task SendRawAsync(string command, CancellationToken cancellationTok
         return macro.Command;
     }
 
+    /// <summary>The host's current physical cell dimensions; null for hosts without measurements.</summary>
+    public Func<TerminalCellSize?>? TerminalCellSizeProvider { get; set; }
+
+    public ValueTask RefreshTerminalCellSizeAsync() =>
+        _telnet?.RefreshTerminalCellSizeAsync() ?? ValueTask.CompletedTask;
+
     public ValueTask SetWindowSizeAsync(int width, int height) =>
         _telnet?.SetWindowSizeAsync(width, height) ?? ValueTask.CompletedTask;
 
diff --git a/src/SharpMUTerm.Core/SharpMUTerm.Core.csproj b/src/SharpMUTerm.Core/SharpMUTerm.Core.csproj
index 16201207..09ec9fce 100644
--- a/src/SharpMUTerm.Core/SharpMUTerm.Core.csproj
+++ b/src/SharpMUTerm.Core/SharpMUTerm.Core.csproj
@@ -11,4 +11,8 @@
     <PackageReference Include="WeCantSpell.Hunspell" />
   </ItemGroup>
 
+  <ItemGroup>
+    <InternalsVisibleTo Include="SharpMUTerm.Core.Tests" />
+  </ItemGroup>
+
 </Project>
diff --git a/src/SharpMUTerm.Core/Telnet/ITelnetSession.cs b/src/SharpMUTerm.Core/Telnet/ITelnetSession.cs
index 7a55186f..0dc77e71 100644
--- a/src/SharpMUTerm.Core/Telnet/ITelnetSession.cs
+++ b/src/SharpMUTerm.Core/Telnet/ITelnetSession.cs
@@ -98,6 +98,12 @@ ValueTask SendMooEditAsync(MooEdit edit, IReadOnlyList<string> lines) =>
     /// <summary>Connects the transport and begins negotiation and the receive loop.</summary>
     Task ConnectAsync(CancellationToken cancellationToken = default);
 
+    /// <summary>Measured physical cell pixels, if this host knows them. Read at query time.</summary>
+    Func<TerminalCellSize?>? TerminalCellSizeProvider { get => null; set { } }
+
+    /// <summary>Refresh a previously requested terminal cell report after a zoom or display change.</summary>
+    ValueTask RefreshTerminalCellSizeAsync() => ValueTask.CompletedTask;
+
     /// <summary>Sends a command line to the server (a trailing CR/LF is appended).</summary>
     ValueTask SendLineAsync(string text, CancellationToken cancellationToken = default);
 
diff --git a/src/SharpMUTerm.Core/Telnet/TelnetSession.cs b/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
index e94e153a..b00031cf 100644
--- a/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
+++ b/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
@@ -399,6 +399,12 @@ private Encoding? Negotiated
     private Encoding Fallback =>
         _options.CharsetOrder is [var first, ..] ? first : Encoding.UTF8;
 
+    public Func<TerminalCellSize?>? TerminalCellSizeProvider { get; set; }
+    private TerminalCellQueryResponder? _cellQueries;
+
+    public ValueTask RefreshTerminalCellSizeAsync() =>
+        IsConnected ? _cellQueries?.ReportAsync() ?? ValueTask.CompletedTask : ValueTask.CompletedTask;
+
     public event EventHandler<TelnetOutputEventArgs>? OutputReceived;
 
     /// <summary>Raised when <see cref="CurrentEncoding"/> changes — in practice, when CHARSET settles.</summary>
@@ -439,6 +445,7 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
         {
             // Building/wiring the interpreter failed after the socket opened; close it so we
             // don't leak a half-open connection, and stay in the not-connected state.
+            _cellQueries?.Stop();
             _interpreter = null;
             _seeded = null;
             _negotiated = null;
@@ -457,11 +464,13 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
 
     private Task<TelnetInterpreter> BuildInterpreterAsync()
     {
+        _cellQueries = new TerminalCellQueryResponder(() => TerminalCellSizeProvider?.Invoke(), WriteToTransportAsync);
         TelnetInterpreterBuilder builder = new TelnetInterpreterBuilder()
             .UseMode(TelnetInterpreter.TelnetMode.Client)
             .UseLogger(_logger)
             .OnNegotiation(WriteToTransportAsync)
             .OnSubmit(OnSubmitAsync)
+            .OnByte(_cellQueries.ObserveAsync)
             // Who this client is, for every protocol in the library that names it.
             .WithClientIdentity(Identity())
             // Explicit defaults let NAWS observe negotiation completion, so an early pane report
@@ -689,6 +698,7 @@ private ValueTask OnSubmitAsync(byte[] bytes, Encoding? encoding, TelnetInterpre
     /// </summary>
     private ValueTask OnPromptAsync()
     {
+        _cellQueries?.FinishLine();
         if (_interpreter?.LastPromptBytes is { Length: > 0 } bytes)
         {
             Emit(CurrentEncoding.Encoding.GetString(bytes.Span), isPrompt: true);
@@ -1023,6 +1033,7 @@ private static async ValueTask ReportBothAsync(WindowSizeProtocol protocol, MudC
 
     public async Task DisconnectAsync()
     {
+        _cellQueries?.Stop();
         if (_loopCts is not null)
         {
             await _loopCts.CancelAsync().ConfigureAwait(false);
diff --git a/src/SharpMUTerm.Core/Telnet/TerminalCellQueryResponder.cs b/src/SharpMUTerm.Core/Telnet/TerminalCellQueryResponder.cs
new file mode 100644
index 00000000..44542cb5
--- /dev/null
+++ b/src/SharpMUTerm.Core/Telnet/TerminalCellQueryResponder.cs
@@ -0,0 +1,135 @@
+using System.Globalization;
+using System.Text;
+
+namespace SharpMUTerm.Core.Telnet;
+
+/// <summary>
+/// Observes CSI 16 t before TNC buffers a line. The existing ANSI parser still consumes the escape;
+/// all input is passed through unchanged. Never answers queries embedded in OSC/DCS/APC strings,
+/// and never forwards server escapes to the local terminal. Only measured cell pixels are disclosed.
+/// </summary>
+internal sealed class TerminalCellQueryResponder(Func<TerminalCellSize?> measure, Func<ReadOnlyMemory<byte>, ValueTask> send)
+{
+    private enum State { Ground, Escape, Csi, String, StringEscape }
+    private State _state;
+    private bool _osc;
+    private int _queryLength;
+    private bool _candidate;
+    private int _codePage = -1;
+    private bool _asciiCompatible;
+    private volatile bool _asked;
+    private volatile bool _stopped;
+
+    internal void Stop() => _stopped = true;
+    private TerminalCellSize? _sent;
+    private readonly SemaphoreSlim _sendGate = new(1, 1);
+
+    // The rendering parsers abandon unfinished escapes on a line boundary too.
+    internal void FinishLine() => _state = State.Ground;
+
+    internal async ValueTask ObserveAsync(byte value, Encoding encoding)
+    {
+        // Check the control syntax rather than guessing from single-/multibyte classification:
+        // Shift-JIS is ASCII-compatible; UTF-16 and EBCDIC are not.
+        if (_codePage != encoding.CodePage)
+        {
+            _codePage = encoding.CodePage;
+            _asciiCompatible = encoding.GetBytes("\u001b[16t]P_^X\\\a").AsSpan().SequenceEqual("\u001b[16t]P_^X\\\a"u8);
+        }
+
+        if (_stopped || !_asciiCompatible)
+        {
+            _state = State.Ground;
+            return;
+        }
+
+        if (value is 0x18 or 0x1a or 10)
+        {
+            _state = State.Ground;
+            return;
+        }
+
+        if (_state is State.String or State.StringEscape)
+        {
+            if ((_osc && value == 7) || (_state == State.StringEscape && value == '\\'))
+            {
+                _state = State.Ground;
+            }
+            else
+            {
+                _state = value == 27 ? State.StringEscape : State.String;
+            }
+
+            return;
+        }
+
+        if (value == 27)
+        {
+            _state = State.Escape;
+            return;
+        }
+
+        switch (_state)
+        {
+            case State.Escape:
+                _state = value switch
+                {
+                    (byte)'[' => State.Csi,
+                    (byte)']' or (byte)'P' or (byte)'_' or (byte)'^' or (byte)'X' => State.String,
+                    _ => State.Ground,
+                };
+                _osc = value == ']';
+                _queryLength = 0;
+                _candidate = true;
+                break;
+            case State.Csi:
+                if (value is >= 0x40 and <= 0x7e)
+                {
+                    _state = State.Ground;
+                    if (_candidate && _queryLength == 2 && value == 't')
+                    {
+                        _asked = true;
+                        await ReportAsync(force: true).ConfigureAwait(false);
+                    }
+                }
+                else if (value is >= 0x20 and <= 0x3f)
+                {
+                    _candidate &= _queryLength switch { 0 => value == '1', 1 => value == '6', _ => false };
+                    _queryLength = Math.Min(3, _queryLength + 1);
+                }
+                else
+                {
+                    _state = State.Ground;
+                }
+
+                break;
+        }
+
+        return;
+    }
+
+    /// <summary>Refresh only a server that has asked, and only when the measured pixels changed.</summary>
+    internal async ValueTask ReportAsync(bool force = false)
+    {
+        if (_stopped || !_asked)
+        {
+            return;
+        }
+
+        await _sendGate.WaitAsync().ConfigureAwait(false);
+        try
+        {
+            // Re-read after waiting so a zoom burst cannot publish an older size after a newer one.
+            if (!_stopped && measure() is { IsValid: true } current && (force || current != _sent))
+            {
+                var reply = string.Create(CultureInfo.InvariantCulture, $"\u001b[6;{current.Height};{current.Width}t");
+                await send(Encoding.ASCII.GetBytes(reply)).ConfigureAwait(false);
+                Volatile.Write(ref _sent, current);
+            }
+        }
+        finally
+        {
+            _sendGate.Release();
+        }
+    }
+}
diff --git a/src/SharpMUTerm.Core/Telnet/TerminalCellSize.cs b/src/SharpMUTerm.Core/Telnet/TerminalCellSize.cs
new file mode 100644
index 00000000..95f5b671
--- /dev/null
+++ b/src/SharpMUTerm.Core/Telnet/TerminalCellSize.cs
@@ -0,0 +1,7 @@
+namespace SharpMUTerm.Core.Telnet;
+
+/// <summary>One terminal character cell in physical pixels, not display-independent units.</summary>
+public sealed record TerminalCellSize(int Width, int Height)
+{
+    public bool IsValid => Width is > 0 and <= 65535 && Height is > 0 and <= 65535;
+}
diff --git a/src/SharpMUTerm.Tui/Pointer/PointerTarget.cs b/src/SharpMUTerm.Tui/Pointer/PointerTarget.cs
index 50589abb..a1f2d35a 100644
--- a/src/SharpMUTerm.Tui/Pointer/PointerTarget.cs
+++ b/src/SharpMUTerm.Tui/Pointer/PointerTarget.cs
@@ -109,6 +109,12 @@ public bool SameAs(PaneScrollbar other) =>
 /// </summary>
 internal interface IPointerPresenter
 {
+    /// <summary>Physical pixels for terminal reports; never inferred from a font guess.</summary>
+    SharpMUTerm.Core.Telnet.TerminalCellSize? TerminalCellPixels => null;
+
+    /// <summary>Pixel metrics can change on a DPI move even when the character grid does not.</summary>
+    event Action? TerminalCellPixelsChanged { add { } remove { } }
+
     /// <summary>Measured cell size in logical pixels, or null for terminal hosts with unknown metrics.</summary>
     ImageCellSize? ImageCellSize => null;
 
diff --git a/src/SharpMUTerm.Tui/SharpMUTermApp.cs b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
index d9bc9865..9ad3c146 100644
--- a/src/SharpMUTerm.Tui/SharpMUTermApp.cs
+++ b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
@@ -1078,6 +1078,11 @@ public SharpMUTermApp(
         // repaints. One hook therefore covers the lot, and none of them can be forgotten later.
         // (The event's adder is a silent no-op while a window has no renderer; this one has had one
         // since its constructor ran, and NawsPaneReportTests fails loudly if that ever stops holding.)
+        if (_pointer is not null)
+        {
+            _pointer.TerminalCellPixelsChanged += OnTerminalCellPixelsChanged;
+        }
+
         _window.PostBufferPaint += (buffer, _, _) =>
         {
             ReportPaneSizes();
@@ -9656,6 +9661,7 @@ private bool RunBuiltInCommand(string id)
     /// </summary>
     private void OnSessionAdded(object? sender, WorldSession session)
     {
+        session.TerminalCellSizeProvider = () => _pointer?.TerminalCellPixels;
         session.MsdpReports = StatusMeter.MsdpVariables(_config.Text.StatusMeters);
         WatchPresence(session);
         StartReconnecting(session);
@@ -14609,6 +14615,31 @@ private void ArmSizeFlush(DateTimeOffset now)
             Timeout.InfiniteTimeSpan);
     }
 
+    private void OnTerminalCellPixelsChanged() => OnUiThread(() =>
+    {
+        foreach (var session in _sessionWindows.Keys)
+        {
+            if (session.IsConnected)
+            {
+                _ = RefreshCellPixelsAsync(session);
+            }
+        }
+    });
+
+    private async Task RefreshCellPixelsAsync(WorldSession session)
+    {
+        try
+        {
+            await session.RefreshTerminalCellSizeAsync().ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            // A display-metrics event cannot await this send. Log without causing another repaint
+            // and retry loop; another metrics change or explicit query can retry an unsent size.
+            _diagnostics.For("SharpMUTerm.TerminalPixels").LogWarning(ex, "Could not report terminal cell pixels");
+        }
+    }
+
     /// <summary>
     /// Sends one session's NAWS report. The callers cannot await it — a paint callback, a timer and a
     /// connect continuation — but the failure is not swallowed the way the old fire-and-forget was: a
@@ -15468,6 +15499,11 @@ bool Fits(StatusSegment hint, IEnumerable<StatusSegment> cluster) =>
 
     public async ValueTask DisposeAsync()
     {
+        if (_pointer is not null)
+        {
+            _pointer.TerminalCellPixelsChanged -= OnTerminalCellPixelsChanged;
+        }
+
         _system.ConsoleDriver.MouseEvent -= OnDriverMouseEvent;
         _focus.Dispose();           // and the terminal is told to stop reporting focus at nobody
         ResetTransparentColours();  // and kitty's colours go back to its own
diff --git a/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
new file mode 100644
index 00000000..37b0430b
--- /dev/null
+++ b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
@@ -0,0 +1,99 @@
+using SharpMUTerm.Core.Configuration;
+using SharpMUTerm.Core.Telnet;
+using SharpMUTerm.Tui;
+using SharpMUTerm.Tui.Tests;
+using SkiaSharp;
+
+namespace SharpMUTerm.Avalonia.Tests;
+
+public class TerminalCellPixelTests
+{
+    [Test]
+    public async Task ADisplayMetricChangeReachesAConnectedSessionWithoutAFrameOrGridResize()
+    {
+        var result = await TerminalViewTests.Session.Dispatch(() =>
+        {
+            using var driver = new AvaloniaConsoleDriver(80, 24);
+            var view = new TerminalView(driver, SKColors.White, SKColors.Black, 16, null);
+            var config = new AppConfiguration();
+            var world = new WorldDefinition { Name = "Pixels", Host = "example.invalid", Port = 4000 };
+            config.Worlds.Add(world);
+            var telnet = new RecordingTelnetSession();
+            var app = new SharpMUTermApp(config, DesktopLayerTests.InlineHost(driver));
+            app.TelnetFactory = _ => telnet;
+            try
+            {
+                app.BindWorldWithoutConnecting(world).ConnectAsync().GetAwaiter().GetResult();
+                var before = telnet.CellPixelReports.Count;
+                view.PrepareScale(2);
+                var reports = telnet.CellPixelReports.Skip(before).ToArray();
+                return (reports, expected: new TerminalCellSize(view.Renderer.Fonts.CellWidth, view.Renderer.Fonts.CellHeight));
+            }
+            finally
+            {
+                app.DisposeAsync().AsTask().GetAwaiter().GetResult();
+            }
+        }, CancellationToken.None);
+        await Assert.That(result.reports).IsEquivalentTo(new TerminalCellSize?[] { result.expected });
+    }
+
+    [Test]
+    public async Task PixelChangesNotifyEvenWithoutAnArrangedGridResize()
+    {
+        var result = await TerminalViewTests.Session.Dispatch(() =>
+        {
+            using var driver = new AvaloniaConsoleDriver(80, 24);
+            var view = new TerminalView(driver, SKColors.White, SKColors.Black, 16, null);
+            var changes = 0;
+            var resizes = 0;
+            driver.Pointer.TerminalCellPixelsChanged += () => changes++;
+            driver.ScreenResized += (_, _) => resizes++;
+            // No bounds: there is no character grid change to piggyback a report on.
+            view.PrepareScale(2);
+            view.PrepareScale(2);
+            return (changes, resizes, pixels: ((IPointerPresenter)driver.Pointer).TerminalCellPixels);
+        }, CancellationToken.None);
+        await Assert.That(result.changes).IsEqualTo(1);
+        await Assert.That(result.resizes).IsEqualTo(0);
+        await Assert.That(result.pixels!.Width).IsGreaterThan(10);
+    }
+
+    [Test]
+    [Arguments(1.0)]
+    [Arguments(1.25)]
+    [Arguments(1.5)]
+    [Arguments(2.0)]
+    public async Task FreshSessionUsesPhysicalPixelsAndTracksZoomAndDpiWithoutSavingSettings(double scale)
+    {
+        var results = await TerminalViewTests.Session.Dispatch(() =>
+        {
+            using var driver = new AvaloniaConsoleDriver(80, 24);
+            var view = new TerminalView(driver, SKColors.White, SKColors.Black, 16, null, 1.12f);
+            var config = new AppConfiguration();
+            var world = new WorldDefinition { Name = "Pixels", Host = "example.invalid", Port = 4000 };
+            config.Worlds.Add(world);
+            var app = new SharpMUTermApp(config, DesktopLayerTests.InlineHost(driver));
+            try
+            {
+                var session = app.BindWorldWithoutConnecting(world);
+                TerminalCellSize? Read() => session.TerminalCellSizeProvider?.Invoke();
+                var initial = Read();
+                view.PrepareScale(scale);
+                var dpi = Read();
+                var expectedDpi = new TerminalCellSize(view.Renderer.Fonts.CellWidth, view.Renderer.Fonts.CellHeight);
+                view.SetZoom(200);
+                var zoomed = Read();
+                var expectedZoom = new TerminalCellSize(view.Renderer.Fonts.CellWidth, view.Renderer.Fonts.CellHeight);
+                return (initial, dpi, expectedDpi, zoomed, expectedZoom);
+            }
+            finally
+            {
+                app.DisposeAsync().AsTask().GetAwaiter().GetResult();
+            }
+        }, CancellationToken.None);
+        await Assert.That(results.initial).IsEqualTo(new TerminalCellSize(10, 24));
+        await Assert.That(results.dpi).IsEqualTo(results.expectedDpi);
+        await Assert.That(results.zoomed).IsEqualTo(results.expectedZoom);
+        await Assert.That(results.zoomed!.Width).IsGreaterThan(results.dpi!.Width);
+    }
+}
diff --git a/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs b/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs
new file mode 100644
index 00000000..4f50cd6e
--- /dev/null
+++ b/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs
@@ -0,0 +1,241 @@
+using System.Text;
+using Microsoft.Extensions.Logging.Abstractions;
+using SharpMUTerm.Core.Telnet;
+
+namespace SharpMUTerm.Core.Tests.Telnet;
+
+public class TerminalCellQueryTests
+{
+    [Test]
+    [Arguments(false)]
+    [Arguments(true)]
+    public async Task AnswersBeforeAnyNewlineWithHeightThenWidthAndNoTerminator(bool fragmented)
+    {
+        var transport = new ScriptedTransport { Fragmented = fragmented };
+        await using var session = new TelnetSession(transport, NullLogger.Instance)
+        {
+            TerminalCellSizeProvider = () => new(10, 24),
+        };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+        await session.SendLineAsync("look");
+        await Until(() => Encoding.ASCII.GetString(transport.Sent).Contains("look\r\n"));
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10tlook\r\n");
+    }
+
+    [Test]
+    [Arguments("\u001b]title\r\0\u001b[16t\a")]
+    [Arguments("\u001bPdata\r\0\u001b[16t\u001b\\")]
+    [Arguments("\u001b^data\u001b[16t\u001b\\")]
+    [Arguments("\u001b]title\u001b[16t\a")]
+    [Arguments("\u001bPdata\u001b[16t\u001b\\")]
+    [Arguments("\u001b_Gpayload\u001b[16t\u001b\\")]
+    [Arguments("\u001bXdata\u001b[16t\u001b\\")]
+    [Arguments("\u001b[?16t\u001b[16;1t\u001b[016t\u001b[16 t")]
+    public async Task NeverAnswersControlStringContentsOrDifferentCommands(string input)
+    {
+        var transport = new ScriptedTransport { Fragmented = true };
+        await using var session = new TelnetSession(transport, NullLogger.Instance)
+        {
+            TerminalCellSizeProvider = () => new(10, 24),
+        };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        await DeliverLine(session, transport, input + "done");
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+    }
+
+    [Test]
+    public async Task OnlyRefreshesAPeerThatAskedAndOnlyForChangedMeasuredPixels()
+    {
+        TerminalCellSize? size = new(10, 24);
+        var transport = new ScriptedTransport();
+        await using var session = new TelnetSession(transport, NullLogger.Instance)
+        {
+            TerminalCellSizeProvider = () => size,
+        };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        offset = transport.Sent.Length;
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+        size = new(16, 40);
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;40;16t");
+        offset = transport.Sent.Length;
+        size = null;
+        await session.RefreshTerminalCellSizeAsync();
+        size = new(0, 24);
+        await session.RefreshTerminalCellSizeAsync();
+        size = new(10, 65536);
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+    }
+
+    [Test]
+    public async Task UnknownMetricsDoNotInventAReplyAndCanBecomeAvailableLater()
+    {
+        TerminalCellSize? size = null;
+        var transport = new ScriptedTransport();
+        await using var session = new TelnetSession(transport, NullLogger.Instance) { TerminalCellSizeProvider = () => size };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        await DeliverLine(session, transport, "\u001b[16tdone");
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+        size = new(10, 24);
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+    }
+
+    [Test]
+    public async Task ObservingQueriesPreservesTheOriginalApplicationBytes()
+    {
+        var transport = new ScriptedTransport { Fragmented = true };
+        await using var session = new TelnetSession(transport, NullLogger.Instance,
+            new TelnetSessionOptions { EncodingOverride = Encoding.Latin1 })
+        {
+            TerminalCellSizeProvider = () => new(10, 24),
+        };
+        await session.ConnectAsync();
+        const string input = "caf\u00e9\u001b[31m red\u001b[0m\u001b[16t";
+        var completion = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        session.OutputReceived += (_, e) => completion.TrySetResult(e.Text);
+        transport.SendToClient(Encoding.Latin1.GetBytes(input + "\r\n"));
+        var output = await completion.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        await Assert.That(output).IsEqualTo(input);
+    }
+
+    [Test]
+    public async Task QueriesInsideTelnetSubnegotiationDoNotReachTheObserver()
+    {
+        var transport = new ScriptedTransport();
+        await using var session = new TelnetSession(transport, NullLogger.Instance) { TerminalCellSizeProvider = () => new(10, 24) };
+        await session.ConnectAsync();
+        var offset = transport.Sent.Length;
+        transport.SendToClient([255, 250, 200, 27, 91, 49, 54, 116, 255, 240]);
+        await DeliverLine(session, transport, "done");
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+    }
+
+    [Test]
+    public async Task ALineBoundaryRecoversFromAnUnterminatedControlString()
+    {
+        var transport = new ScriptedTransport { Fragmented = true };
+        await using var session = new TelnetSession(transport, NullLogger.Instance) { TerminalCellSizeProvider = () => new(10, 24) };
+        await session.ConnectAsync();
+        await DeliverLine(session, transport, "\u001b]unterminated");
+        var offset = transport.Sent.Length;
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+        await session.DisconnectAsync();
+        offset = transport.Sent.Length;
+        await session.RefreshTerminalCellSizeAsync();
+        await Assert.That(transport.Sent.Length).IsEqualTo(offset);
+    }
+
+    [Test]
+    public async Task ReturningToTheOldSizeDuringAnInFlightReportStillSendsTheFinalSize()
+    {
+        var size = new TerminalCellSize(10, 24);
+        var started = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var replies = new System.Collections.Concurrent.ConcurrentQueue<string>();
+        var responder = new TerminalCellQueryResponder(() => size, async bytes =>
+        {
+            var reply = Encoding.ASCII.GetString(bytes.Span);
+            if (reply == "\u001b[6;40;16t")
+            {
+                started.TrySetResult();
+                await release.Task;
+            }
+
+            replies.Enqueue(reply);
+        });
+        foreach (var value in "\u001b[16t"u8.ToArray())
+        {
+            await responder.ObserveAsync(value, Encoding.UTF8);
+        }
+
+        size = new(16, 40);
+        var larger = responder.ReportAsync().AsTask();
+        await started.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        size = new(10, 24);
+        var smaller = responder.ReportAsync().AsTask();
+        release.TrySetResult();
+        await Task.WhenAll(larger, smaller).WaitAsync(TimeSpan.FromSeconds(5));
+        await Assert.That(replies.ToArray()).IsEquivalentTo(new[] { "\u001b[6;24;10t", "\u001b[6;40;16t", "\u001b[6;24;10t" });
+    }
+
+    [Test]
+    public async Task AnEncodingWhoseBytesAreNotAsciiControlsCannotTriggerAReply()
+    {
+        var sent = 0;
+        var responder = new TerminalCellQueryResponder(() => new(10, 24), _ => { sent++; return ValueTask.CompletedTask; });
+        // Even exact ASCII-looking raw bytes are not CSI syntax in a UTF-16 stream.
+        foreach (var value in "\u001b[16t"u8.ToArray())
+        {
+            await responder.ObserveAsync(value, Encoding.Unicode);
+        }
+
+        await Assert.That(sent).IsEqualTo(0);
+        foreach (var value in "\u001b[16t"u8.ToArray())
+        {
+            await responder.ObserveAsync(value, Encoding.UTF8);
+        }
+
+        await Assert.That(sent).IsEqualTo(1);
+    }
+
+    [Test]
+    public async Task AGoAheadPromptBoundaryRecoversAnUnfinishedControlString()
+    {
+        var transport = new ScriptedTransport { Fragmented = true };
+        await using var session = new TelnetSession(transport, NullLogger.Instance) { TerminalCellSizeProvider = () => new(10, 24) };
+        var prompt = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        session.OutputReceived += (_, e) => { if (e.IsPrompt) prompt.TrySetResult(); };
+        await session.ConnectAsync();
+        transport.SendToClient([.. "\u001b]unfinished"u8.ToArray(), 255, 249]);
+        await prompt.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        var offset = transport.Sent.Length;
+        transport.SendToClient("\u001b[16t"u8.ToArray());
+        await Until(() => transport.Sent.Length > offset);
+        await Assert.That(Encoding.ASCII.GetString(transport.Sent[offset..])).IsEqualTo("\u001b[6;24;10t");
+    }
+
+    private static async Task DeliverLine(TelnetSession session, ScriptedTransport transport, string text)
+    {
+        var completion = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        void OnOutput(object? sender, TelnetOutputEventArgs e) => completion.TrySetResult();
+        session.OutputReceived += OnOutput;
+        try
+        {
+            transport.SendToClient(Encoding.ASCII.GetBytes(text + "\r\n"));
+            await completion.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        }
+        finally
+        {
+            session.OutputReceived -= OnOutput;
+        }
+    }
+
+    private static async Task Until(Func<bool> predicate)
+    {
+        for (var i = 0; i < 250 && !predicate(); i++)
+        {
+            await Task.Delay(10);
+        }
+
+        await Assert.That(predicate()).IsTrue();
+    }
+}
diff --git a/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs b/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
index ec2bf9ff..62673721 100644
--- a/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
+++ b/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
@@ -15,6 +15,15 @@ internal sealed class RecordingTelnetSession : ITelnetSession
 
     public bool IsConnected { get; private set; }
 
+    public Func<TerminalCellSize?>? TerminalCellSizeProvider { get; set; }
+    public List<TerminalCellSize?> CellPixelReports { get; } = [];
+
+    public ValueTask RefreshTerminalCellSizeAsync()
+    {
+        CellPixelReports.Add(TerminalCellSizeProvider?.Invoke());
+        return ValueTask.CompletedTask;
+    }
+
     /// <summary>What this fake reports as in force; a test that cares sets it and raises the event.</summary>
     public SessionEncoding CurrentEncoding { get; set; } =
         new(new UTF8Encoding(encoderShouldEmitUTF8Identifier: false), EncodingSource.Assumed);

From b47d1084069438aa1d08b18bf400579dfe9a8516 Mon Sep 17 00:00:00 2001
From: Harry Cordewener <admin@twilightdays.org>
Date: Sun, 8 Nov 2026 19:33:38 -0600
Subject: [PATCH 2/6] Refresh queried pixel metrics after connection completes

---
 src/SharpMUTerm.Tui/SharpMUTermApp.cs           |  3 +++
 .../TerminalCellPixelTests.cs                   | 17 ++++++++++++++---
 .../RecordingTelnetSession.cs                   |  3 +++
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/src/SharpMUTerm.Tui/SharpMUTermApp.cs b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
index 9ad3c146..387fcc27 100644
--- a/src/SharpMUTerm.Tui/SharpMUTermApp.cs
+++ b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
@@ -3571,6 +3571,9 @@ private void BindSession(WorldSession session, string? windowId = null)
         {
             if (e.State == ConnectionState.Connected)
             {
+                // A query may have arrived while ConnectAsync was still finishing. Catch a
+                // pixel change whose event occurred before the session entered Connected.
+                _ = RefreshCellPixelsAsync(session);
                 ReportAutomation(session);
 
                 // Recorded on the *connection*, not on the report — because "we reached this server and
diff --git a/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
index 37b0430b..e5521826 100644
--- a/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
+++ b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
@@ -9,7 +9,9 @@ namespace SharpMUTerm.Avalonia.Tests;
 public class TerminalCellPixelTests
 {
     [Test]
-    public async Task ADisplayMetricChangeReachesAConnectedSessionWithoutAFrameOrGridResize()
+    [Arguments(false)]
+    [Arguments(true)]
+    public async Task ADisplayMetricChangeReachesAConnectedSessionWithoutAFrameOrGridResize(bool duringHandshake)
     {
         var result = await TerminalViewTests.Session.Dispatch(() =>
         {
@@ -23,9 +25,18 @@ public async Task ADisplayMetricChangeReachesAConnectedSessionWithoutAFrameOrGri
             app.TelnetFactory = _ => telnet;
             try
             {
-                app.BindWorldWithoutConnecting(world).ConnectAsync().GetAwaiter().GetResult();
+                if (duringHandshake)
+                {
+                    telnet.Connecting = () => view.PrepareScale(2);
+                }
+
                 var before = telnet.CellPixelReports.Count;
-                view.PrepareScale(2);
+                app.BindWorldWithoutConnecting(world).ConnectAsync().GetAwaiter().GetResult();
+                if (!duringHandshake)
+                {
+                    before = telnet.CellPixelReports.Count;
+                    view.PrepareScale(2);
+                }
                 var reports = telnet.CellPixelReports.Skip(before).ToArray();
                 return (reports, expected: new TerminalCellSize(view.Renderer.Fonts.CellWidth, view.Renderer.Fonts.CellHeight));
             }
diff --git a/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs b/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
index 62673721..c9be6168 100644
--- a/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
+++ b/tests/SharpMUTerm.Tui.Tests/RecordingTelnetSession.cs
@@ -38,6 +38,8 @@ public ValueTask RefreshTerminalCellSizeAsync()
     /// <summary>How many times a connection was asked for, refused ones included.</summary>
     public int ConnectAttempts { get; private set; }
 
+    public Action? Connecting { get; set; }
+
     /// <summary>Every NAWS report this session was given, oldest first.</summary>
     public IReadOnlyList<(int Width, int Height)> Sizes
     {
@@ -153,6 +155,7 @@ public Task ConnectAsync(CancellationToken cancellationToken = default)
             return Task.FromException(fault);
         }
 
+        Connecting?.Invoke();
         IsConnected = true;
         return Task.CompletedTask;
     }

From 57a3d5eacca3fd770d753633cb7a794d54e666a3 Mon Sep 17 00:00:00 2001
From: Harry Cordewener <admin@twilightdays.org>
Date: Sun, 8 Nov 2026 19:41:01 -0600
Subject: [PATCH 3/6] Isolate full-client pixel metric UI fixtures

---
 tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
index e5521826..cb68c289 100644
--- a/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
+++ b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
@@ -6,6 +6,8 @@
 
 namespace SharpMUTerm.Avalonia.Tests;
 
+// These cases create full client apps, as the native-composer fixture does.
+[NotInParallel]
 public class TerminalCellPixelTests
 {
     [Test]

From a2281af881251467a375aa509f9f9074d5014ee2 Mon Sep 17 00:00:00 2001
From: Harry Cordewener <admin@twilightdays.org>
Date: Sun, 8 Nov 2026 21:38:11 -0600
Subject: [PATCH 4/6] Use opt-in terminal query plugin and host-owned cell
 metrics

---
 CHANGELOG.md                                  |   7 +-
 .../AvaloniaConsoleDriver.cs                  |   2 +
 src/SharpMUTerm.Avalonia/TerminalView.cs      |   4 +-
 src/SharpMUTerm.Avalonia/WindowHost.cs        |   1 +
 src/SharpMUTerm.Avalonia/WindowPointer.cs     |  17 ---
 src/SharpMUTerm.Core/SharpMUTerm.Core.csproj  |   4 -
 src/SharpMUTerm.Core/Telnet/TelnetSession.cs  |  21 ++-
 .../Telnet/TerminalCellQueryResponder.cs      | 135 ------------------
 src/SharpMUTerm.Tui/Hosting/CellMetrics.cs    |  27 ++++
 src/SharpMUTerm.Tui/Hosting/ClientHost.cs     |   5 +
 .../Hosting/TerminalCellMetrics.cs            |  91 ++++++++++++
 src/SharpMUTerm.Tui/Pointer/PointerTarget.cs  |   6 -
 src/SharpMUTerm.Tui/SharpMUTermApp.cs         |  22 +--
 .../TerminalCellPixelTests.cs                 |  15 +-
 .../Telnet/TerminalCellQueryTests.cs          |  53 -------
 .../TerminalCellMetricsTests.cs               |  65 +++++++++
 16 files changed, 233 insertions(+), 242 deletions(-)
 delete mode 100644 src/SharpMUTerm.Core/Telnet/TerminalCellQueryResponder.cs
 create mode 100644 src/SharpMUTerm.Tui/Hosting/CellMetrics.cs
 create mode 100644 src/SharpMUTerm.Tui/Hosting/TerminalCellMetrics.cs
 create mode 100644 tests/SharpMUTerm.Tui.Tests/TerminalCellMetricsTests.cs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20e30aa7..8d8a5c1d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -54,9 +54,10 @@ and a release's notes are its section. The procedure is in [`docs/RELEASING.md`]
 ### Fixed
 
 - The desktop window answers terminal cell-pixel queries with its actual measured pixels, allowing
-  servers to size images correctly. Servers that asked receive refreshed cell dimensions after zoom
-  or display-scaling changes. Replies do not add a command newline or forward server escapes to
-  the local terminal.
+  servers to size images correctly. Unix terminal mode also reports cells when the terminal publishes
+  an exact pixel extent; unavailable dimensions stay unknown. Servers that asked receive refreshed
+  dimensions after zoom or display-scaling changes, even when the character grid is unchanged.
+  Replies use the opted-in TNC terminal-query plugin and never forward server escapes to the local terminal.
 
 - Desktop MXP images use the measured font cell dimensions when sizing pictures, instead of assuming an 8×16 cell.
   This avoids stretching pictures when the selected font has a different shape. Explicit server-specified cell boxes
diff --git a/src/SharpMUTerm.Avalonia/AvaloniaConsoleDriver.cs b/src/SharpMUTerm.Avalonia/AvaloniaConsoleDriver.cs
index 78807d1b..6969b6eb 100644
--- a/src/SharpMUTerm.Avalonia/AvaloniaConsoleDriver.cs
+++ b/src/SharpMUTerm.Avalonia/AvaloniaConsoleDriver.cs
@@ -67,6 +67,8 @@ public AvaloniaConsoleDriver(int columns, int rows)
     /// <summary>What the client says is under the pointer, for the window to show (<see cref="WindowPointer"/>).</summary>
     public WindowPointer Pointer { get; } = new();
 
+    public CellMetrics CellMetrics { get; } = new();
+
     /// <summary>The window's screen-reader regions; the window adds them beside the view.</summary>
     public WindowAnnouncer Announcer { get; } = new();
 
diff --git a/src/SharpMUTerm.Avalonia/TerminalView.cs b/src/SharpMUTerm.Avalonia/TerminalView.cs
index abf0c416..8cc9cb86 100644
--- a/src/SharpMUTerm.Avalonia/TerminalView.cs
+++ b/src/SharpMUTerm.Avalonia/TerminalView.cs
@@ -85,7 +85,7 @@ public TerminalView(AvaloniaConsoleDriver driver, SKColor foreground, SKColor ba
         _renderer = new CellRenderer(new CellFonts(fontPoints, family, lineHeight), foreground, background);
         _zoomRenderers[(1, 100)] = _renderer;
         _driver.Pointer.CellHeightMeasured = CellSize.Height;
-        _driver.Pointer.TerminalCellPixelsMeasured = new SharpMUTerm.Core.Telnet.TerminalCellSize(_renderer.Fonts.CellWidth, _renderer.Fonts.CellHeight);
+        _driver.CellMetrics.Current = new SharpMUTerm.Core.Telnet.TerminalCellSize(_renderer.Fonts.CellWidth, _renderer.Fonts.CellHeight);
         _driver.Pointer.ImageCellSizeMeasured = new ImageCellSize(CellSize.Width, CellSize.Height);
         Focusable = true;
         ClipToBounds = true;
@@ -362,7 +362,7 @@ private void Rescale(double scale)
 
         _renderer = renderer;
         _driver.Pointer.CellHeightMeasured = CellSize.Height;
-        _driver.Pointer.TerminalCellPixelsMeasured = new SharpMUTerm.Core.Telnet.TerminalCellSize(_renderer.Fonts.CellWidth, _renderer.Fonts.CellHeight);
+        _driver.CellMetrics.Current = new SharpMUTerm.Core.Telnet.TerminalCellSize(_renderer.Fonts.CellWidth, _renderer.Fonts.CellHeight);
         _driver.Pointer.ImageCellSizeMeasured = new ImageCellSize(CellSize.Width, CellSize.Height);
         // Font changes leave the control's bounds alone, so OnSizeChanged will not do this for us.
         // Going through the driver resize also recomputes pane geometry and schedules per-pane NAWS.
diff --git a/src/SharpMUTerm.Avalonia/WindowHost.cs b/src/SharpMUTerm.Avalonia/WindowHost.cs
index 4b1c2b44..0284dbd8 100644
--- a/src/SharpMUTerm.Avalonia/WindowHost.cs
+++ b/src/SharpMUTerm.Avalonia/WindowHost.cs
@@ -98,6 +98,7 @@ public static ClientHost Create(AvaloniaConsoleDriver driver, Action<string>? cl
         Keys = Keys,
         RunsInline = false,
         Pointer = driver.Pointer,
+        CellMetrics = driver.CellMetrics,
         SixelCell = SharpMUTermApp.SixelCellSize(null),
 
         // The same desktop device as the terminal: both are desktop processes on the same machine.
diff --git a/src/SharpMUTerm.Avalonia/WindowPointer.cs b/src/SharpMUTerm.Avalonia/WindowPointer.cs
index 785a5b13..9f046a8a 100644
--- a/src/SharpMUTerm.Avalonia/WindowPointer.cs
+++ b/src/SharpMUTerm.Avalonia/WindowPointer.cs
@@ -91,23 +91,6 @@ internal int WindowColumnsMeasured
 
     int? IPointerPresenter.WindowColumns => WindowColumnsMeasured is > 0 and var columns ? columns : null;
 
-    private SharpMUTerm.Core.Telnet.TerminalCellSize? _terminalCellPixels;
-    internal SharpMUTerm.Core.Telnet.TerminalCellSize? TerminalCellPixelsMeasured
-    {
-        get => Volatile.Read(ref _terminalCellPixels);
-        set
-        {
-            if (Interlocked.Exchange(ref _terminalCellPixels, value) != value)
-            {
-                TerminalCellPixelsChanged?.Invoke();
-            }
-        }
-    }
-
-    public event Action? TerminalCellPixelsChanged;
-
-    SharpMUTerm.Core.Telnet.TerminalCellSize? IPointerPresenter.TerminalCellPixels => TerminalCellPixelsMeasured;
-
     private ImageCellSize? _imageCellSize;
 
     internal ImageCellSize? ImageCellSizeMeasured
diff --git a/src/SharpMUTerm.Core/SharpMUTerm.Core.csproj b/src/SharpMUTerm.Core/SharpMUTerm.Core.csproj
index 09ec9fce..16201207 100644
--- a/src/SharpMUTerm.Core/SharpMUTerm.Core.csproj
+++ b/src/SharpMUTerm.Core/SharpMUTerm.Core.csproj
@@ -11,8 +11,4 @@
     <PackageReference Include="WeCantSpell.Hunspell" />
   </ItemGroup>
 
-  <ItemGroup>
-    <InternalsVisibleTo Include="SharpMUTerm.Core.Tests" />
-  </ItemGroup>
-
 </Project>
diff --git a/src/SharpMUTerm.Core/Telnet/TelnetSession.cs b/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
index b00031cf..bcee3336 100644
--- a/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
+++ b/src/SharpMUTerm.Core/Telnet/TelnetSession.cs
@@ -400,10 +400,10 @@ private Encoding? Negotiated
         _options.CharsetOrder is [var first, ..] ? first : Encoding.UTF8;
 
     public Func<TerminalCellSize?>? TerminalCellSizeProvider { get; set; }
-    private TerminalCellQueryResponder? _cellQueries;
+    private TerminalQueryProtocol? _cellQueries;
 
     public ValueTask RefreshTerminalCellSizeAsync() =>
-        IsConnected ? _cellQueries?.ReportAsync() ?? ValueTask.CompletedTask : ValueTask.CompletedTask;
+        IsConnected ? _cellQueries?.ReportCellSizeAsync() ?? ValueTask.CompletedTask : ValueTask.CompletedTask;
 
     public event EventHandler<TelnetOutputEventArgs>? OutputReceived;
 
@@ -445,11 +445,13 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
         {
             // Building/wiring the interpreter failed after the socket opened; close it so we
             // don't leak a half-open connection, and stay in the not-connected state.
-            _cellQueries?.Stop();
+            var stopping = _cellQueries?.OnDisabledAsync() ?? ValueTask.CompletedTask;
+            _cellQueries = null;
             _interpreter = null;
             _seeded = null;
             _negotiated = null;
             await _transport.CloseAsync().ConfigureAwait(false);
+            await stopping.ConfigureAwait(false);
             throw;
         }
 
@@ -464,13 +466,16 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
 
     private Task<TelnetInterpreter> BuildInterpreterAsync()
     {
-        _cellQueries = new TerminalCellQueryResponder(() => TerminalCellSizeProvider?.Invoke(), WriteToTransportAsync);
+        _cellQueries = new TerminalQueryProtocol().WithCellSizeProvider(() =>
+            TerminalCellSizeProvider?.Invoke() is { IsValid: true } size
+                ? new TelnetNegotiationCore.Models.TerminalCellSize(size.Width, size.Height)
+                : null);
         TelnetInterpreterBuilder builder = new TelnetInterpreterBuilder()
             .UseMode(TelnetInterpreter.TelnetMode.Client)
             .UseLogger(_logger)
             .OnNegotiation(WriteToTransportAsync)
             .OnSubmit(OnSubmitAsync)
-            .OnByte(_cellQueries.ObserveAsync)
+            .AddPlugin(_cellQueries)
             // Who this client is, for every protocol in the library that names it.
             .WithClientIdentity(Identity())
             // Explicit defaults let NAWS observe negotiation completion, so an early pane report
@@ -698,7 +703,6 @@ private ValueTask OnSubmitAsync(byte[] bytes, Encoding? encoding, TelnetInterpre
     /// </summary>
     private ValueTask OnPromptAsync()
     {
-        _cellQueries?.FinishLine();
         if (_interpreter?.LastPromptBytes is { Length: > 0 } bytes)
         {
             Emit(CurrentEncoding.Encoding.GetString(bytes.Span), isPrompt: true);
@@ -1033,13 +1037,16 @@ private static async ValueTask ReportBothAsync(WindowSizeProtocol protocol, MudC
 
     public async Task DisconnectAsync()
     {
-        _cellQueries?.Stop();
+        // Disable queued replies immediately, but close transport before awaiting an active socket write.
+        var stopping = _cellQueries?.OnDisabledAsync() ?? ValueTask.CompletedTask;
+        _cellQueries = null;
         if (_loopCts is not null)
         {
             await _loopCts.CancelAsync().ConfigureAwait(false);
         }
 
         await _transport.CloseAsync().ConfigureAwait(false);
+        await stopping.ConfigureAwait(false);
 
         if (_readLoop is not null)
         {
diff --git a/src/SharpMUTerm.Core/Telnet/TerminalCellQueryResponder.cs b/src/SharpMUTerm.Core/Telnet/TerminalCellQueryResponder.cs
deleted file mode 100644
index 44542cb5..00000000
--- a/src/SharpMUTerm.Core/Telnet/TerminalCellQueryResponder.cs
+++ /dev/null
@@ -1,135 +0,0 @@
-using System.Globalization;
-using System.Text;
-
-namespace SharpMUTerm.Core.Telnet;
-
-/// <summary>
-/// Observes CSI 16 t before TNC buffers a line. The existing ANSI parser still consumes the escape;
-/// all input is passed through unchanged. Never answers queries embedded in OSC/DCS/APC strings,
-/// and never forwards server escapes to the local terminal. Only measured cell pixels are disclosed.
-/// </summary>
-internal sealed class TerminalCellQueryResponder(Func<TerminalCellSize?> measure, Func<ReadOnlyMemory<byte>, ValueTask> send)
-{
-    private enum State { Ground, Escape, Csi, String, StringEscape }
-    private State _state;
-    private bool _osc;
-    private int _queryLength;
-    private bool _candidate;
-    private int _codePage = -1;
-    private bool _asciiCompatible;
-    private volatile bool _asked;
-    private volatile bool _stopped;
-
-    internal void Stop() => _stopped = true;
-    private TerminalCellSize? _sent;
-    private readonly SemaphoreSlim _sendGate = new(1, 1);
-
-    // The rendering parsers abandon unfinished escapes on a line boundary too.
-    internal void FinishLine() => _state = State.Ground;
-
-    internal async ValueTask ObserveAsync(byte value, Encoding encoding)
-    {
-        // Check the control syntax rather than guessing from single-/multibyte classification:
-        // Shift-JIS is ASCII-compatible; UTF-16 and EBCDIC are not.
-        if (_codePage != encoding.CodePage)
-        {
-            _codePage = encoding.CodePage;
-            _asciiCompatible = encoding.GetBytes("\u001b[16t]P_^X\\\a").AsSpan().SequenceEqual("\u001b[16t]P_^X\\\a"u8);
-        }
-
-        if (_stopped || !_asciiCompatible)
-        {
-            _state = State.Ground;
-            return;
-        }
-
-        if (value is 0x18 or 0x1a or 10)
-        {
-            _state = State.Ground;
-            return;
-        }
-
-        if (_state is State.String or State.StringEscape)
-        {
-            if ((_osc && value == 7) || (_state == State.StringEscape && value == '\\'))
-            {
-                _state = State.Ground;
-            }
-            else
-            {
-                _state = value == 27 ? State.StringEscape : State.String;
-            }
-
-            return;
-        }
-
-        if (value == 27)
-        {
-            _state = State.Escape;
-            return;
-        }
-
-        switch (_state)
-        {
-            case State.Escape:
-                _state = value switch
-                {
-                    (byte)'[' => State.Csi,
-                    (byte)']' or (byte)'P' or (byte)'_' or (byte)'^' or (byte)'X' => State.String,
-                    _ => State.Ground,
-                };
-                _osc = value == ']';
-                _queryLength = 0;
-                _candidate = true;
-                break;
-            case State.Csi:
-                if (value is >= 0x40 and <= 0x7e)
-                {
-                    _state = State.Ground;
-                    if (_candidate && _queryLength == 2 && value == 't')
-                    {
-                        _asked = true;
-                        await ReportAsync(force: true).ConfigureAwait(false);
-                    }
-                }
-                else if (value is >= 0x20 and <= 0x3f)
-                {
-                    _candidate &= _queryLength switch { 0 => value == '1', 1 => value == '6', _ => false };
-                    _queryLength = Math.Min(3, _queryLength + 1);
-                }
-                else
-                {
-                    _state = State.Ground;
-                }
-
-                break;
-        }
-
-        return;
-    }
-
-    /// <summary>Refresh only a server that has asked, and only when the measured pixels changed.</summary>
-    internal async ValueTask ReportAsync(bool force = false)
-    {
-        if (_stopped || !_asked)
-        {
-            return;
-        }
-
-        await _sendGate.WaitAsync().ConfigureAwait(false);
-        try
-        {
-            // Re-read after waiting so a zoom burst cannot publish an older size after a newer one.
-            if (!_stopped && measure() is { IsValid: true } current && (force || current != _sent))
-            {
-                var reply = string.Create(CultureInfo.InvariantCulture, $"\u001b[6;{current.Height};{current.Width}t");
-                await send(Encoding.ASCII.GetBytes(reply)).ConfigureAwait(false);
-                Volatile.Write(ref _sent, current);
-            }
-        }
-        finally
-        {
-            _sendGate.Release();
-        }
-    }
-}
diff --git a/src/SharpMUTerm.Tui/Hosting/CellMetrics.cs b/src/SharpMUTerm.Tui/Hosting/CellMetrics.cs
new file mode 100644
index 00000000..365880f6
--- /dev/null
+++ b/src/SharpMUTerm.Tui/Hosting/CellMetrics.cs
@@ -0,0 +1,27 @@
+using SharpMUTerm.Core.Telnet;
+
+namespace SharpMUTerm.Tui;
+
+/// <summary>A host-owned, thread-safe snapshot of actual physical cell pixels. Unknown is never guessed.</summary>
+internal class CellMetrics : IDisposable
+{
+    private TerminalCellSize? _current;
+
+    public TerminalCellSize? Current
+    {
+        get => Volatile.Read(ref _current);
+        set
+        {
+            if (Interlocked.Exchange(ref _current, value) != value)
+            {
+                Changed?.Invoke();
+            }
+        }
+    }
+
+    public event Action? Changed;
+
+    public virtual void Start() { }
+
+    public virtual void Dispose() { }
+}
diff --git a/src/SharpMUTerm.Tui/Hosting/ClientHost.cs b/src/SharpMUTerm.Tui/Hosting/ClientHost.cs
index c7616555..13fe73f3 100644
--- a/src/SharpMUTerm.Tui/Hosting/ClientHost.cs
+++ b/src/SharpMUTerm.Tui/Hosting/ClientHost.cs
@@ -58,6 +58,9 @@ internal sealed record ClientHost
     /// </summary>
     public required IPointerPresenter? Pointer { get; init; }
 
+    /// <summary>Measured physical cell pixels, independent of pointer presentation; null when unavailable.</summary>
+    public required CellMetrics? CellMetrics { get; init; }
+
     /// <summary>The keys this host delivers differently from the others, or keeps for itself.</summary>
     public required HostKeys Keys { get; init; }
 
@@ -221,6 +224,7 @@ public static ClientHost Terminal(TerminalCapabilities capabilities)
         FocusReporting = PlatformDecodesFocusReports,
         Keys = HostKeys.Terminal,
         Pointer = TerminalPointer.Create(driver),
+        CellMetrics = new TerminalCellMetrics(),
         RunsInline = false,
         SixelCell = SharpMUTermApp.SixelCellSize(Environment.GetEnvironmentVariable(SharpMUTermApp.SixelCellVariable)),
         Audio = () => DesktopAudio.TryCreate(),
@@ -256,6 +260,7 @@ public static ClientHost Terminal(TerminalCapabilities capabilities)
         FocusReporting = false,
         Keys = HostKeys.Terminal,
         Pointer = null,
+        CellMetrics = null,
         RunsInline = true,
         SixelCell = SharpMUTermApp.SixelCellSize(null),
         Audio = null,
diff --git a/src/SharpMUTerm.Tui/Hosting/TerminalCellMetrics.cs b/src/SharpMUTerm.Tui/Hosting/TerminalCellMetrics.cs
new file mode 100644
index 00000000..7a181b1a
--- /dev/null
+++ b/src/SharpMUTerm.Tui/Hosting/TerminalCellMetrics.cs
@@ -0,0 +1,91 @@
+using System.Runtime.InteropServices;
+using SharpMUTerm.Core.Telnet;
+
+namespace SharpMUTerm.Tui;
+
+/// <summary>
+/// Reads the Unix terminal's published pixel extent without touching its input stream. Some emulators
+/// publish no pixels; Windows pseudoconsoles do not expose reliable renderer metrics. Those stay unknown.
+/// </summary>
+internal sealed class TerminalCellMetrics : CellMetrics
+{
+    private readonly Func<TerminalCellSize?> _read;
+    private Timer? _timer;
+    private readonly object _gate = new();
+    private bool _disposed;
+
+    public TerminalCellMetrics() : this(ReadTerminal) { }
+
+    internal TerminalCellMetrics(Func<TerminalCellSize?> read) => _read = read;
+
+    public override void Start()
+    {
+        lock (_gate)
+        {
+            if (_disposed || _timer is not null) { return; }
+            Sample();
+            // Pixel-only zoom need not resize the character grid.
+            _timer = new Timer(_ => Sample(), null, TimeSpan.FromMilliseconds(500), TimeSpan.FromMilliseconds(500));
+        }
+    }
+
+    internal void Sample()
+    {
+        lock (_gate)
+        {
+            if (!_disposed) { Current = _read(); }
+        }
+    }
+
+    public override void Dispose()
+    {
+        lock (_gate)
+        {
+            _disposed = true;
+            _timer?.Dispose();
+            _timer = null;
+        }
+    }
+
+    internal static TerminalCellSize? FromWindowSize(int columns, int rows, int width, int height)
+    {
+        if (columns <= 0 || rows <= 0 || width <= 0 || height <= 0 || width % columns != 0 || height % rows != 0)
+        {
+            return null;
+        }
+
+        var cell = new TerminalCellSize(width / columns, height / rows);
+        return cell.IsValid ? cell : null;
+    }
+
+    private static TerminalCellSize? ReadTerminal()
+    {
+        if (!OperatingSystem.IsLinux() && !OperatingSystem.IsMacOS()) { return null; }
+        // Query stdout only: a redirected stream must not silently borrow a different terminal's dimensions.
+        var request = OperatingSystem.IsMacOS() ? 0x40087468UL : 0x5413UL;
+        WindowSize size;
+        // macOS ARM64 passes variadic ioctl arguments on the stack, not in x2.
+        var result = OperatingSystem.IsMacOS() && RuntimeInformation.ProcessArchitecture == Architecture.Arm64
+            ? IoctlArm64(1, (nuint)request, 0, 0, 0, 0, 0, 0, out size)
+            : Ioctl(1, (nuint)request, out size);
+        return result == 0
+            ? FromWindowSize(size.Columns, size.Rows, size.Width, size.Height)
+            : null;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct WindowSize
+    {
+        public ushort Rows;
+        public ushort Columns;
+        public ushort Width;
+        public ushort Height;
+    }
+
+    [DllImport("libc", EntryPoint = "ioctl", SetLastError = true)]
+    private static extern int IoctlArm64(int descriptor, nuint request,
+        ulong x2, ulong x3, ulong x4, ulong x5, ulong x6, ulong x7, out WindowSize size);
+
+    [DllImport("libc", EntryPoint = "ioctl", SetLastError = true)]
+    private static extern int Ioctl(int descriptor, nuint request, out WindowSize size);
+}
diff --git a/src/SharpMUTerm.Tui/Pointer/PointerTarget.cs b/src/SharpMUTerm.Tui/Pointer/PointerTarget.cs
index a1f2d35a..50589abb 100644
--- a/src/SharpMUTerm.Tui/Pointer/PointerTarget.cs
+++ b/src/SharpMUTerm.Tui/Pointer/PointerTarget.cs
@@ -109,12 +109,6 @@ public bool SameAs(PaneScrollbar other) =>
 /// </summary>
 internal interface IPointerPresenter
 {
-    /// <summary>Physical pixels for terminal reports; never inferred from a font guess.</summary>
-    SharpMUTerm.Core.Telnet.TerminalCellSize? TerminalCellPixels => null;
-
-    /// <summary>Pixel metrics can change on a DPI move even when the character grid does not.</summary>
-    event Action? TerminalCellPixelsChanged { add { } remove { } }
-
     /// <summary>Measured cell size in logical pixels, or null for terminal hosts with unknown metrics.</summary>
     ImageCellSize? ImageCellSize => null;
 
diff --git a/src/SharpMUTerm.Tui/SharpMUTermApp.cs b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
index 387fcc27..66df2507 100644
--- a/src/SharpMUTerm.Tui/SharpMUTermApp.cs
+++ b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
@@ -1070,6 +1070,12 @@ public SharpMUTermApp(
         };
         _window.PreviewKeyPressed += OnWindowKey;
 
+        // Physical pixels can change without a character-grid resize or a new frame.
+        if (Host.CellMetrics is not null)
+        {
+            Host.CellMetrics.Changed += OnTerminalCellPixelsChanged;
+        }
+
         // NAWS rides the frame. Pane rectangles exist only while an arranged layout does, and every
         // layout change (a resize, a split, a closed tab, a zoom, a window moved between panes) tears
         // the pane area down and rebuilds it — so inside RebuildPaneArea, where the change is made,
@@ -1078,11 +1084,6 @@ public SharpMUTermApp(
         // repaints. One hook therefore covers the lot, and none of them can be forgotten later.
         // (The event's adder is a silent no-op while a window has no renderer; this one has had one
         // since its constructor ran, and NawsPaneReportTests fails loudly if that ever stops holding.)
-        if (_pointer is not null)
-        {
-            _pointer.TerminalCellPixelsChanged += OnTerminalCellPixelsChanged;
-        }
-
         _window.PostBufferPaint += (buffer, _, _) =>
         {
             ReportPaneSizes();
@@ -1164,10 +1165,11 @@ public int Run(IReadOnlyList<StartupConnection> startup)
         // Here and not in the constructor: this is the one method that means "there is a live terminal
         // in front of this app", and asking a terminal to report focus is a write to it.
         _focus.Start();
-        StartTitle();
         int exitCode;
         try
         {
+            Host.CellMetrics?.Start();
+            StartTitle();
             exitCode = _system.Run();
         }
         finally
@@ -1175,6 +1177,7 @@ public int Run(IReadOnlyList<StartupConnection> startup)
             // Focus reporting is turned off as the loop ends rather than at disposal, which the live entry point never
             // reaches: left on, the shell (or the new version an update execs into this terminal) gets ESC [ I.
             _focus.Stop();
+            Host.CellMetrics?.Dispose();
         }
 
         // The colours are kitty's, not this window's: left set, they would go on drawing the shell's own
@@ -9664,7 +9667,7 @@ private bool RunBuiltInCommand(string id)
     /// </summary>
     private void OnSessionAdded(object? sender, WorldSession session)
     {
-        session.TerminalCellSizeProvider = () => _pointer?.TerminalCellPixels;
+        session.TerminalCellSizeProvider = () => Host.CellMetrics?.Current;
         session.MsdpReports = StatusMeter.MsdpVariables(_config.Text.StatusMeters);
         WatchPresence(session);
         StartReconnecting(session);
@@ -15502,9 +15505,10 @@ bool Fits(StatusSegment hint, IEnumerable<StatusSegment> cluster) =>
 
     public async ValueTask DisposeAsync()
     {
-        if (_pointer is not null)
+        if (Host.CellMetrics is not null)
         {
-            _pointer.TerminalCellPixelsChanged -= OnTerminalCellPixelsChanged;
+            Host.CellMetrics.Changed -= OnTerminalCellPixelsChanged;
+            Host.CellMetrics.Dispose();
         }
 
         _system.ConsoleDriver.MouseEvent -= OnDriverMouseEvent;
diff --git a/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
index cb68c289..9e7480f4 100644
--- a/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
+++ b/tests/SharpMUTerm.Avalonia.Tests/TerminalCellPixelTests.cs
@@ -11,9 +11,10 @@ namespace SharpMUTerm.Avalonia.Tests;
 public class TerminalCellPixelTests
 {
     [Test]
-    [Arguments(false)]
-    [Arguments(true)]
-    public async Task ADisplayMetricChangeReachesAConnectedSessionWithoutAFrameOrGridResize(bool duringHandshake)
+    [Arguments(false, false)]
+    [Arguments(true, false)]
+    [Arguments(false, true)]
+    public async Task ADisplayMetricChangeReachesAConnectedSessionWithoutAFrameOrGridResize(bool duringHandshake, bool withoutPointer)
     {
         var result = await TerminalViewTests.Session.Dispatch(() =>
         {
@@ -23,7 +24,9 @@ public async Task ADisplayMetricChangeReachesAConnectedSessionWithoutAFrameOrGri
             var world = new WorldDefinition { Name = "Pixels", Host = "example.invalid", Port = 4000 };
             config.Worlds.Add(world);
             var telnet = new RecordingTelnetSession();
-            var app = new SharpMUTermApp(config, DesktopLayerTests.InlineHost(driver));
+            var host = DesktopLayerTests.InlineHost(driver);
+            if (withoutPointer) { host = host with { Pointer = null }; }
+            var app = new SharpMUTermApp(config, host);
             app.TelnetFactory = _ => telnet;
             try
             {
@@ -59,12 +62,12 @@ public async Task PixelChangesNotifyEvenWithoutAnArrangedGridResize()
             var view = new TerminalView(driver, SKColors.White, SKColors.Black, 16, null);
             var changes = 0;
             var resizes = 0;
-            driver.Pointer.TerminalCellPixelsChanged += () => changes++;
+            driver.CellMetrics.Changed += () => changes++;
             driver.ScreenResized += (_, _) => resizes++;
             // No bounds: there is no character grid change to piggyback a report on.
             view.PrepareScale(2);
             view.PrepareScale(2);
-            return (changes, resizes, pixels: ((IPointerPresenter)driver.Pointer).TerminalCellPixels);
+            return (changes, resizes, pixels: driver.CellMetrics.Current);
         }, CancellationToken.None);
         await Assert.That(result.changes).IsEqualTo(1);
         await Assert.That(result.resizes).IsEqualTo(0);
diff --git a/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs b/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs
index 4f50cd6e..13939a1e 100644
--- a/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs
+++ b/tests/SharpMUTerm.Core.Tests/Telnet/TerminalCellQueryTests.cs
@@ -144,59 +144,6 @@ public async Task ALineBoundaryRecoversFromAnUnterminatedControlString()
         await Assert.That(transport.Sent.Length).IsEqualTo(offset);
     }
 
-    [Test]
-    public async Task ReturningToTheOldSizeDuringAnInFlightReportStillSendsTheFinalSize()
-    {
-        var size = new TerminalCellSize(10, 24);
-        var started = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
-        var release = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
-        var replies = new System.Collections.Concurrent.ConcurrentQueue<string>();
-        var responder = new TerminalCellQueryResponder(() => size, async bytes =>
-        {
-            var reply = Encoding.ASCII.GetString(bytes.Span);
-            if (reply == "\u001b[6;40;16t")
-            {
-                started.TrySetResult();
-                await release.Task;
-            }
-
-            replies.Enqueue(reply);
-        });
-        foreach (var value in "\u001b[16t"u8.ToArray())
-        {
-            await responder.ObserveAsync(value, Encoding.UTF8);
-        }
-
-        size = new(16, 40);
-        var larger = responder.ReportAsync().AsTask();
-        await started.Task.WaitAsync(TimeSpan.FromSeconds(5));
-        size = new(10, 24);
-        var smaller = responder.ReportAsync().AsTask();
-        release.TrySetResult();
-        await Task.WhenAll(larger, smaller).WaitAsync(TimeSpan.FromSeconds(5));
-        await Assert.That(replies.ToArray()).IsEquivalentTo(new[] { "\u001b[6;24;10t", "\u001b[6;40;16t", "\u001b[6;24;10t" });
-    }
-
-    [Test]
-    public async Task AnEncodingWhoseBytesAreNotAsciiControlsCannotTriggerAReply()
-    {
-        var sent = 0;
-        var responder = new TerminalCellQueryResponder(() => new(10, 24), _ => { sent++; return ValueTask.CompletedTask; });
-        // Even exact ASCII-looking raw bytes are not CSI syntax in a UTF-16 stream.
-        foreach (var value in "\u001b[16t"u8.ToArray())
-        {
-            await responder.ObserveAsync(value, Encoding.Unicode);
-        }
-
-        await Assert.That(sent).IsEqualTo(0);
-        foreach (var value in "\u001b[16t"u8.ToArray())
-        {
-            await responder.ObserveAsync(value, Encoding.UTF8);
-        }
-
-        await Assert.That(sent).IsEqualTo(1);
-    }
-
     [Test]
     public async Task AGoAheadPromptBoundaryRecoversAnUnfinishedControlString()
     {
diff --git a/tests/SharpMUTerm.Tui.Tests/TerminalCellMetricsTests.cs b/tests/SharpMUTerm.Tui.Tests/TerminalCellMetricsTests.cs
new file mode 100644
index 00000000..91f224bf
--- /dev/null
+++ b/tests/SharpMUTerm.Tui.Tests/TerminalCellMetricsTests.cs
@@ -0,0 +1,65 @@
+using SharpMUTerm.Core.Telnet;
+using SharpMUTerm.Tui;
+
+namespace SharpMUTerm.Tui.Tests;
+
+public class TerminalCellMetricsTests
+{
+    [Test]
+    public async Task DerivesPhysicalPixelsFromTheTerminalExtent()
+    {
+        await Assert.That(TerminalCellMetrics.FromWindowSize(120, 40, 1200, 960)).IsEqualTo(new TerminalCellSize(10, 24));
+        await Assert.That(TerminalCellMetrics.FromWindowSize(120, 40, 1440, 1200)).IsEqualTo(new TerminalCellSize(12, 30));
+    }
+
+    [Test]
+    [Arguments(0, 40, 1200, 960)]
+    [Arguments(120, 0, 1200, 960)]
+    [Arguments(120, 40, 0, 960)]
+    [Arguments(120, 40, 1200, 0)]
+    [Arguments(120, 40, 1201, 960)]
+    public async Task NeverInventsMetricsForMissingOrInexactDimensions(int columns, int rows, int width, int height)
+        => await Assert.That(TerminalCellMetrics.FromWindowSize(columns, rows, width, height)).IsNull();
+
+    [Test]
+    public async Task PollsPixelOnlyChangesAndStopsOnDisposal()
+    {
+        TerminalCellSize? size = new(10, 24);
+        using var metrics = new TerminalCellMetrics(() => Volatile.Read(ref size));
+        var changed = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        metrics.Changed += () =>
+        {
+            if (metrics.Current == new TerminalCellSize(12, 30)) { changed.TrySetResult(); }
+        };
+        metrics.Start();
+        Volatile.Write(ref size, new(12, 30));
+        await changed.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        metrics.Dispose();
+        Volatile.Write(ref size, new(16, 40));
+        await Task.Delay(600);
+        await Assert.That(metrics.Current).IsEqualTo(new TerminalCellSize(12, 30));
+    }
+
+    [Test]
+    public async Task PublishesPixelOnlyChangesAndForgetsUnavailableMetrics()
+    {
+        TerminalCellSize? size = new(10, 24);
+        using var metrics = new TerminalCellMetrics(() => size);
+        var changes = 0;
+        metrics.Changed += () => changes++;
+        metrics.Sample();
+        metrics.Sample();
+        size = new(12, 30);
+        metrics.Sample();
+        await Assert.That(metrics.Current).IsEqualTo(size);
+        size = null;
+        metrics.Sample();
+        await Assert.That(metrics.Current).IsNull();
+        await Assert.That(changes).IsEqualTo(3);
+        metrics.Dispose();
+        size = new(10, 24);
+        metrics.Sample();
+        metrics.Start();
+        await Assert.That(changes).IsEqualTo(3);
+    }
+}

From 8832f5abe7cc10a880769c093dc3950885472820 Mon Sep 17 00:00:00 2001
From: Harry Cordewener <admin@twilightdays.org>
Date: Sun, 8 Nov 2026 22:16:58 -0600
Subject: [PATCH 5/6] Use released TelnetNegotiationCore 4.9.0

---
 Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 01490984..8c63b8e0 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -10,7 +10,7 @@
     <PackageVersion Include="SharpConsoleUI" Version="2.7.8" />
 
     <!-- Telnet negotiation: TELOPT/NAWS/MTTS/EOR/CHARSET/MSSP/GMCP/MSDP/MCCP/MXP negotiation. -->
-    <PackageVersion Include="TelnetNegotiationCore" Version="4.5.3" />
+    <PackageVersion Include="TelnetNegotiationCore" Version="4.9.0" />
 
     <!-- The version, from the git tag (see Directory.Build.props). Build-time only. -->
     <PackageVersion Include="MinVer" Version="8.0.0" />

From 69ef0ebc684a6c2cff3a713917b3ce12f640fc63 Mon Sep 17 00:00:00 2001
From: Harry Cordewener <admin@twilightdays.org>
Date: Sun, 8 Nov 2026 22:41:56 -0600
Subject: [PATCH 6/6] Synchronize native overlays with asynchronous modal
 notifications

---
 CHANGELOG.md                                  |  2 ++
 src/SharpMUTerm.Tui/SharpMUTermApp.cs         |  6 +++--
 .../NativePanelTests.cs                       | 26 ++++++++++++++++---
 3 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8d8a5c1d..03c94538 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,8 @@ and a release's notes are its section. The procedure is in [`docs/RELEASING.md`]
 
 ### Fixed
 
+- Desktop overlays follow modal visibility changes on the client UI thread, avoiding background-thread reads of changing pane layouts.
+
 - The desktop window answers terminal cell-pixel queries with its actual measured pixels, allowing
   servers to size images correctly. Unix terminal mode also reports cells when the terminal publishes
   an exact pixel extent; unavailable dimensions stay unknown. Servers that asked receive refreshed
diff --git a/src/SharpMUTerm.Tui/SharpMUTermApp.cs b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
index 66df2507..03bef7c3 100644
--- a/src/SharpMUTerm.Tui/SharpMUTermApp.cs
+++ b/src/SharpMUTerm.Tui/SharpMUTermApp.cs
@@ -1113,13 +1113,15 @@ public SharpMUTermApp(
 
         // A modal that covers the main window entirely leaves it unpainted, so no PostBufferPaint says the native
         // panels are now under it; the modal stack changing says it instead.
-        _system.ModalStateService.StateChanged += (_, _) =>
+        // The framework delivers this notification on the thread pool. Native overlay models read
+        // UI-owned layout state, so publish on the same thread as frame-driven updates.
+        _system.ModalStateService.StateChanged += (_, _) => OnUiThread(() =>
         {
             PublishPanels();
             PublishInputBand();
             PublishDividers();
             PublishPaneChrome();
-        };
+        });
         if (_sixel is not null)
         {
             // Another window over this one rewrites the cells a picture sits on, and the frame that puts
diff --git a/tests/SharpMUTerm.Avalonia.Tests/NativePanelTests.cs b/tests/SharpMUTerm.Avalonia.Tests/NativePanelTests.cs
index fe3d639f..f5b7c74b 100644
--- a/tests/SharpMUTerm.Avalonia.Tests/NativePanelTests.cs
+++ b/tests/SharpMUTerm.Avalonia.Tests/NativePanelTests.cs
@@ -154,10 +154,28 @@ public async Task WithNoSettingsWindowTheEditLinkOpensF4AndNoNativePanelCoversIt
         app.RenderSnapshot("layout-combat");
 
         var panel = driver.Pointer.Panels.Single(p => p.PanelId == PanelIds.QuickBar);
-        panel.Dispatch!(QuickBarModel.EditCommand);
-        app.RenderNextFrame();
-        await Assert.That(app.OpenSettingsKey).IsEqualTo(ConsoleKey.F4);
-        await Assert.That(driver.Pointer.Panels).IsEmpty().Because("a native view would sit over the modal's cells");
+        var hidden = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        void ObservePanels()
+        {
+            if (driver.Pointer.Panels.Count == 0) { hidden.TrySetResult(); }
+        }
+
+        driver.Pointer.PanelsChanged += ObservePanels;
+        try
+        {
+            panel.Dispatch!(QuickBarModel.EditCommand);
+            app.RenderNextFrame();
+            await Assert.That(app.OpenSettingsKey).IsEqualTo(ConsoleKey.F4);
+            // A fullscreen modal occludes the main pane, so rendering cannot publish its overlays.
+            // Modal state notifications arrive asynchronously; await the actual host update rather
+            // than assuming a thread-pool callback has run before this assertion.
+            await hidden.Task.WaitAsync(TimeSpan.FromSeconds(5));
+            await Assert.That(driver.Pointer.Panels).IsEmpty().Because("a native view would sit over the modal's cells");
+        }
+        finally
+        {
+            driver.Pointer.PanelsChanged -= ObservePanels;
+        }
     }
 
     private sealed class RecordingSettings : INativeSettings