review(directory-picker-browse): re-arm the draft-following wait per keystroke

ds-review-bot round one. Keying the debounce on the directory part the draft
named left two states with no recovery until the operator crossed a separator:
a keystroke that superseded an in-flight scan never re-armed one, and an edit
after a rejected submission released the hold with no timer left to release.
The wait is now keyed on the draft itself and decides its target when it
fires, reading the panes through a ref so a landing cannot re-arm it (a host
answering with a differently spelled path would otherwise scan forever).

A landed scan that unmounts the row a keyboard operator Tabbed onto re-parks
focus on the still-open editor; the Modal has no focus trap. That a walked-to
level survives closing the editor is now stated in the README, the Agent Note,
and the module contract. The new e2e stages its own beta directory so running
it alone sees the tree its assertions describe.

.agents/notes/implemented/architecture/2026-07-28-directory-picker-capability-seam.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-28-directory-picker-capability-seam.md
-2026-07-28-directory-picker-capability-seam.md: 90aa8bc7cfc0dc0fb3d057b9991682c9b531ea23
-2026-07-28-directory-picker-capability-seam.zh.md: 12917c95456bca9cdd5e20ae97847156af81277e
+2026-07-28-directory-picker-capability-seam.md: c7833eaee691618bb76e40bf34c2114dda030315
+2026-07-28-directory-picker-capability-seam.zh.md: 9a6d52a3e1e3629ae54dbcf46ee8e785536294cd

.agents/notes/implemented/architecture/2026-07-28-directory-picker-capability-seam.md

@@ -20,7 +20,7 @@ Placement and policy rulings folded into this decision:
 - **Dependency survey (hand-roll vs adopt).** Node's stdlib *is* the maintained cross-platform OS layer (`readdir(withFileTypes)`, `homedir`, path semantics); surveyed alternatives fail the dependency bar — file-manager packages (`node-file-manager`, `files-and-folders`, Syncfusion's provider) are whole HTTP apps (fit), drive-letter helpers (`drivelist` native addon, `windows-drive-letters` ~7y stale) fail health/proportionality. The browse backend is a thin adapter over stdlib.
 - **Hidden entries: return-and-flag.** The host stamps `hidden` (POSIX dot convention) and returns everything; the client filters. Display policy stays client-side, and the show-hidden toggle shipped as exactly that client-only change: a fixed-label footer toggle whose state lives in the pressed presentation (`aria-pressed` + check glyph), a dot-led path-draft prefix reveals the hidden entries it names, and the current selection is exempt from both the hidden and the prefix filter (it anchors the two-pane view). Windows' `FILE_ATTRIBUTE_HIDDEN` is not exposed by dirents — documented limitation until a native probe pays for itself.
 - **Path-editor cancel scope: the dialog card.** The browse client's path editor cancels on Escape and on focus leaving the card, both observed at a card-scope wrapper rather than the input — after Tab parks focus on a filtered row the input is off the event path, yet Escape must collapse the editor (not the dialog) and a later focus departure must still cancel. Non-cancel exemptions: window/tab focus loss, in-card focus moves, and pointer paths (rows and the toggle suppress focus steal on mousedown while editing). Separators for seeding and draft-tail filtering are inferred from `listing.home`; the wire-field alternative below records the deferred authoritative form. Combobox semantics between the editor and the list it filters (`aria-expanded`/`aria-controls`/active-descendant, result announcements) are likewise deferred — today they read to assistive tech as separate widgets.
-- **The path editor advertises itself, and the panes follow the draft.** The click-to-edit zone is not invisible: a pencil glyph sits at the bar's right edge and hover/focus lights the zone in the editor's own footprint, so the one route into typing a path is discoverable and the bar does not resize when zone and input swap. While the editor is open the panes track the draft instead of whatever level happened to be listed when it opened — the final segment prefix-filters the level its directory part names, a tail nobody matches releases the filter (a name still being spelled must not empty the pane it is being spelled into), and a directory part no pane lists is scanned after a 250ms rest and lands single-wide in place, so typing deeper descends and erasing segments steps back up without leaving the editor. That scan is speculative — half-typed directories are unreadable most of the time — so a failure keeps the last readable panes and stays silent. Enter remains the authoritative commit: it owns the view from submission until landing (a debounce timer armed by the same keystrokes is held back rather than superseding the navigation, and a rejected submission stays held until the next edit) and it alone surfaces the failure.
+- **The path editor advertises itself, and the panes follow the draft.** The click-to-edit zone is not invisible: a pencil glyph sits at the bar's right edge and hover/focus lights the zone in the editor's own footprint, so the one route into typing a path is discoverable and the bar does not resize when zone and input swap. While the editor is open the panes track the draft instead of whatever level happened to be listed when it opened — the final segment prefix-filters the level its directory part names, a tail nobody matches releases the filter (a name still being spelled must not empty the pane it is being spelled into), and a directory part no pane lists is scanned after a 250ms rest and lands single-wide in place, so typing deeper descends and erasing segments steps back up without leaving the editor. That scan is speculative — half-typed directories are unreadable most of the time — so a failure keeps the last readable panes and stays silent. Enter remains the authoritative commit: it owns the view from submission until landing (a debounce timer armed by the same keystrokes is held back rather than superseding the navigation, and a rejected submission stays held until the next edit) and it alone surfaces the failure. Two consequences are deliberate. The wait is keyed on the draft, not on the directory part it names, so a keystroke that superseded an in-flight scan re-arms one and an edit after a rejected submission releases the hold; the panes it reads are a ref rather than a dependency, or the landing would re-arm the wait and a host answering with a differently spelled path would scan forever. And a walk is not rewound: closing the editor — cancellation included — leaves the panes where the draft took them, named by the crumbs and followed by Open's fallback target, because the operator watched them move. A landing that unmounts the row a keyboard operator Tabbed onto re-parks focus on the editor, since the Modal has no focus trap.
 - **Navigation lands selection-anchored, quiet, and bounded.** Away from the display root (the same collapse the crumb header renders, so crumbs and pane shape never disagree), the landing is two-pane: the target's actual parent-level entry re-selected (platform case folding on Windows), its children on the right, so a crumb jump reads as stepping back one pane rather than collapsing to a single column. Target and parent legs land as **one frame** when the parent leg settles within the 200ms wait bound — the stale view keeps rendering until then, so navigation swaps the panes without an intermediate single-pane flash — and past the bound the target commits alone at once (an Enter-submitted navigation is never held hostage by a stalled parent) with the late parent leg upgrading the landing in place. The parent leg runs under the landing's supersession scope and is aborted on the wire by any newer intent (Escape inside the landing window therefore withdraws the whole navigation); a failed parent leg, or a truncated parent window lacking the target, leaves the single-pane landing — the upgrade must never orphan the selection it exists to anchor. The loading indicator follows the same quiet rule: it floats over the content's bottom-right corner (never a layout-shifting row; the truncated/error rows own the bottom left and keep rendering through a scan) and only once a scan outlives a 300ms silence window, so a local listing swaps with nothing shown at all. Row picks are deliberately exempt from the one-frame rule: a pick's immediate pane split is its selected-state feedback (aria-current, crumbs following), while a navigation has nothing to acknowledge the click but the swap itself. Both timing constants are calibrated for local enumeration; a remote deployment (one RPC per level, commonly 100–400ms) would sit inside the silence window with no pressed state on the crumbs — revisit the window or add pressed feedback when a remote consumer lands.
 - **Symlinks: follow for enterability.** `stat` probes symlinks (broken/cyclic → skipped); crumbs keep the logical path the operator navigated, and `workspace.create` already canonicalizes via realpath at adoption.
 - **Listing levels are bounded, and streamed.** One `list` call returns at most `maxEntries` rows (config, default 1000 — GitHub's web-UI directory-listing bound). The level streams via `opendir` into a name-sorted window of `maxEntries + 1` candidates, so memory stays O(maxEntries) and enterability probing touches only windowed candidates; the wire `DirectoryListing` carries a required `truncated` flag so the client states incompleteness instead of silently missing tail entries. A windowed broken symlink is not backfilled from beyond the window — the eviction already marks the level truncated. Window insertion is binary with an O(1) full-window tail rejection (an oversized level must not pay a window scan per dirent), and `list(path, signal)` threads the carrier's request signal so a scan of a stalled network directory cannot outlive a disconnected caller — every await in the scan (open, each read, each symlink probe) races the signal, an aborted exit abandons rather than awaits the close (Node queues close behind in-flight reads), and abandoned settlements are swallowed so cleanup can never surface as an unhandled rejection. An unbounded level is a memory/responsiveness hole for large or adversarial directories.

.agents/notes/implemented/architecture/2026-07-28-directory-picker-capability-seam.zh.md

@@ -20,7 +20,7 @@ web GUI 的"打开本地文件夹"流程被焊死在一种交互上：`host.pick
 - **依赖调研（手写 vs 引入）。** Node 标准库本身就是维护中的跨平台 OS 层（`readdir(withFileTypes)`、`homedir`、路径语义）；调研过的替代品都过不了依赖门槛——文件管理器包（`node-file-manager`、`files-and-folders`、Syncfusion 的 provider）是整套 HTTP 应用（契合度不过），盘符工具（原生插件 `drivelist`、约七年未更的 `windows-drive-letters`）健康度／比例失当。browse 后端是标准库上的薄适配。
 - **隐藏条目：返回并打标。** 宿主标注 `hidden`（POSIX 点前缀约定）并返回全部条目；客户端过滤。展示策略留在客户端，"显示隐藏"开关正是作为这一纯客户端改动落地：标签固定的 footer 开关，其状态由按下态呈现承载（`aria-pressed` + 勾选符号）；以点开头的路径草稿前缀会显出它所指名的隐藏条目；当前选中项则不受隐藏与前缀两种过滤影响（它锚定着双栏视图）。Windows 的 `FILE_ATTRIBUTE_HIDDEN` 不被 dirent 暴露——记为限制，直到原生探测值回其成本。
 - **路径编辑器的取消范围：对话框卡片。** browse 客户端的路径编辑器在按 Escape 与焦点离开卡片时取消，两者都在卡片范围的包装层而非输入框上监听——Tab 把焦点停到某个过滤命中的行之后，输入框已不在事件路径上，但 Escape 仍须收起编辑器（而非对话框），其后的焦点离开也仍须取消。不取消的豁免：窗口／标签页失焦、卡片内焦点移动，以及指针路径（编辑期间行与开关在 mousedown 时抑制焦点夺取）。预填与草稿末段过滤所用的分隔符从 `listing.home` 推断；下文的线上字段替代方案记录了被延期的权威形态。编辑器与其过滤的列表之间的 combobox 语义（`aria-expanded`／`aria-controls`／active-descendant、结果播报）同样被延期——目前二者在辅助技术看来是彼此独立的控件。
-- **路径编辑器自我点明，各栏跟随草稿。** 点击即编辑的区域不再是隐形的：栏右端坐着一枚铅笔图标，悬停／聚焦时该区以编辑器自身的轮廓亮起，于是键入路径这唯一入口可被发现，且区域与输入框互换时栏高不变。编辑器打开期间，各栏跟随草稿，而不是停在它打开那一刻恰好列出的层级——末段对其目录部分所指的层级做前缀过滤，无一匹配的末段解除过滤（还在拼写中的名字不该把正在拼写它的那一栏清空），而任何一栏都未列出的目录部分会在停顿 250ms 后被扫描、以单宽栏就地落地，于是继续键入即下潜、删掉末段即上退，全程不必离开编辑器。该扫描是推测性的——键入到一半的目录多数时候读不出来——因此失败时保留最后一次可读的分栏并保持沉默。Enter 仍是权威提交：自提交至落地由它独占视图（同一批按键武装的防抖计时器会被扣住，而不是顶掉这次导航；提交被拒后仍扣住，直到下一次编辑），也只有它把失败呈现出来。
+- **路径编辑器自我点明，各栏跟随草稿。** 点击即编辑的区域不再是隐形的：栏右端坐着一枚铅笔图标，悬停／聚焦时该区以编辑器自身的轮廓亮起，于是键入路径这唯一入口可被发现，且区域与输入框互换时栏高不变。编辑器打开期间，各栏跟随草稿，而不是停在它打开那一刻恰好列出的层级——末段对其目录部分所指的层级做前缀过滤，无一匹配的末段解除过滤（还在拼写中的名字不该把正在拼写它的那一栏清空），而任何一栏都未列出的目录部分会在停顿 250ms 后被扫描、以单宽栏就地落地，于是继续键入即下潜、删掉末段即上退，全程不必离开编辑器。该扫描是推测性的——键入到一半的目录多数时候读不出来——因此失败时保留最后一次可读的分栏并保持沉默。Enter 仍是权威提交：自提交至落地由它独占视图（同一批按键武装的防抖计时器会被扣住，而不是顶掉这次导航；提交被拒后仍扣住，直到下一次编辑），也只有它把失败呈现出来。有两点是刻意为之。等待以草稿为键，而非以它指名的目录部分为键，于是顶掉在飞扫描的那次按键会重新武装等待，被拒提交之后的编辑也能释放那道扣留；而它读取的分栏是 ref 而非依赖，否则落地会重新武装等待，遇到以不同拼写作答的宿主便会永远扫描下去。以及，走过的路不回退：关闭编辑器——包括取消——都把分栏留在草稿带到的地方，由面包屑指明、Open 的兜底目标随之而动，因为操作者亲眼看着它们移动。若落地卸载了键盘操作者 Tab 停留的那一行，焦点会被重新停回编辑器——Modal 并没有焦点陷阱。
 - **导航以选中项为锚、安静且有界地落地。** 在展示根之外（与 crumb 头部渲染的是同一塌缩，因此 crumb 与分栏形态永不相左），落地即双栏：重新选中目标在父层级中的实际条目（Windows 上按平台惯例折叠大小写），右侧展示其子项，因此 crumb 跳转读作后退一栏，而不是塌缩成单列。父层级这一程在 200ms 等待上限内落定时，目标与父层级两程以**同一帧**落地——在此之前陈旧视图持续渲染，导航换栏时因此没有中间的单栏闪现——超出该上限则目标即刻单独提交（Enter 提交的导航绝不会被滞塞的父层级扣作人质），迟到的父层级这一程再就地升级这次落地。父层级这一程在落地的 supersession 范围下运行，任何较新的意图都会在线上将其中止（因此在落地窗口内按 Escape 即撤回整次导航）；父层级这一程失败，或被截断的父窗口缺少目标时，都保留单栏落地——升级的存在正是为了锚定选中项，绝不能反而让它悬空。加载指示器遵循同一安静规则：它浮于内容右下角（绝不是会挪动布局的一行；截断／错误行占据左下角，并在扫描期间持续渲染），且仅在扫描超出 300ms 静默窗口后才出现，因此本地列举切换时什么也不显示。行选取被刻意豁免于同一帧规则：选取后立即分栏本身就是其选中态反馈（aria-current、crumb 跟随），而导航除了换栏本身没有任何东西可确认这次点击。两个时序常量都按本地列举校准；远程部署（每层级一次 RPC，通常 100–400ms）会落在静默窗口之内、crumb 上却没有按下态——待远程消费方落地时，重新审视该窗口或补上按下反馈。
 - **符号链接：为可进入性而跟随。** 用 `stat` 探测符号链接（断链／循环→跳过）；面包屑保留操作者导航的逻辑路径，`workspace.create` 在接纳时本就做 realpath 规范化。
 - **列举层级有上限，且流式处理。** 单次 `list` 至多返回 `maxEntries` 行（配置项，默认 1000——GitHub 网页端目录列举的同一上限）。层级经 `opendir` 流入一个按名排序、容量 `maxEntries + 1` 的候选窗口，内存保持 O(maxEntries)，可进入性探测只触及窗口内候选；线上 `DirectoryListing` 携带必填的 `truncated` 标志，让客户端明示不完整而不是静默缺尾。窗口内的断链符号链接不从窗口外回填——发生过驱逐本身已把层级标记为截断。窗口插入为二分查找、满窗尾部单次比较即拒绝（超大层级不能为每个 dirent 付出一次全窗扫描），且 `list(path, signal)` 透传载体的请求信号，滞塞网络目录的扫描不会在调用方断连后继续存活——扫描中的每个 await（打开、每次读取、每次符号链接探测）都与信号赛跑，中止路径放弃而非等待 close（Node 会把 close 排在在飞读取之后），被放弃的 settlement 全部吞掉，清理不会以未处理拒绝的形式冒出。无上限的层级对超大或恶意构造的目录就是内存／响应性漏洞。

apps/web/tests/workspace-management.e2e.ts

@@ -407,8 +407,11 @@ describe('web e2e: workspace management (create / rename / flat view / hover aff
   it('walks the panes with the typed path: deeper past a separator, back up on erase, whole on a miss', async () => {
     // The panes must track the draft without leaving the editor, so the
     // typed text and what is listed under it never disagree.
+    // Staged by this scenario itself (mkdir is recursive and idempotent), so
+    // running it alone through -t sees the same tree the assertions describe.
     const staged = join(scaffold.workspaceCwd, 'browse-golden')
     await mkdir(join(staged, 'alpha', 'only-under-alpha'), { recursive: true })
+    await mkdir(join(staged, 'beta'), { recursive: true })
     const dialog = await browseTo(staged)
     await expect.poll(() => dialog.getByText('alpha', { exact: true }).count(), { timeout: 10_000 }).toBe(1)
     await dialog.getByRole('button', { name: 'Edit path' }).click()

packages/host/directory-picker-browse/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/directory-picker-browse/README.md
-README.md: 7cb0ec785766e954ff4bb39df6825ee7e8c9d821
-README.zh.md: ec71a90bbcd004ec9f9c0d8a9a236882a7487b73
+README.md: a559f7f23b74f694c25fb43e005cbaccd4024308
+README.zh.md: 321e27d7a1dc9eb9bf0d1dab37c1af42e8ad6519

packages/host/directory-picker-browse/src/client/DirectoryBrowser.tsx

@@ -25,7 +25,9 @@
  * reveals the hidden entries it names, and a prefix nobody matches releases
  * the filter), while a directory part no pane lists is scanned after a short
  * debounce and shown in place — so typing deeper descends and erasing
- * segments steps back up without leaving the editor.
+ * segments steps back up without leaving the editor. Panes the draft walked
+ * to stay put when the editor closes (cancellation included): the crumbs name
+ * where the walk ended, and Open's fallback target follows them.
  */
 import { useCallback, useEffect, useRef, useState } from 'react'
 import clsx from 'clsx'
@@ -157,9 +159,9 @@ function draftPrefixFor(listing: DirectoryListing, draft: string | null): string
 function pendingPreviewDirectory(
   parent: DirectoryListing | null,
   child: DirectoryListing | null,
-  draft: string | null,
+  draft: string,
 ): string | null {
-  if (parent === null || draft === null) return null
+  if (parent === null) return null
   const directory = draftDirectory(parent, draft)
   if (directory === null || directory === levelDirectory(parent)) return null
   if (child !== null && directory === levelDirectory(child)) return null
@@ -453,10 +455,23 @@ export function DirectoryBrowser({ open, listDirectory, createDirectory, onOpen,
    * Enter owns the view from submission until its navigation lands, so the
    * debounce timer the same keystrokes armed must not supersede it. Cleared
    * by the next edit (and by opening the editor); a failed submission leaves
-   * it set, so the rejected path is not immediately re-scanned as a preview.
+   * it set until the operator edits again, so the rejected path is not
+   * immediately re-scanned as a preview.
    */
   const previewSuspended = useRef(false)
 
+  // The panes as the draft-following scan must read them when its wait
+  // fires: current, but NOT a dependency of the wait (see the effect below).
+  const viewRef = useRef<{ parent: DirectoryListing | null; child: DirectoryListing | null }>({ parent: null, child: null })
+  useEffect(() => { viewRef.current = { parent, child } }, [parent, child])
+
+  /**
+   * A landed preview replaced the pane a keyboard operator may have Tabbed
+   * onto, so the focus it drops is re-parked on the still-open editor (the
+   * Modal has no focus trap). Consumed by the refocus effect below.
+   */
+  const refocusPathInput = useRef(false)
+
   /**
    * List the directory the draft addresses and show it WITHOUT closing the
    * editor: the level replaces the panes single-wide (the selection and its
@@ -478,6 +493,7 @@ export function DirectoryBrowser({ open, listDirectory, createDirectory, onOpen,
       setChild(null)
       setLoading(false)
       setError(null)
+      refocusPathInput.current = true
     }, () => {
       if (seq !== requestSeq.current) return
       setLoading(false)
@@ -602,21 +618,25 @@ export function DirectoryBrowser({ open, listDirectory, createDirectory, onOpen,
     return () => { window.clearTimeout(timer) }
   }, [loading, scanWindow])
 
-  // The panes follow the draft: a directory part no pane lists is scanned
-  // once the typing rests. The dependency is the target STRING, so the
-  // landing it commits cannot re-arm the timer (a host that answers with a
-  // differently spelled path leaves the target unchanged, hence unrepeated),
-  // and every further keystroke replaces the pending timer instead of
-  // queueing another scan.
-  const previewDirectory = pendingPreviewDirectory(parent, child, pathDraft)
+  // The panes follow the draft: EVERY keystroke replaces the pending timer,
+  // and the target is decided when it fires, off the panes as they stand
+  // then. Keying the wait on the draft (not on the directory part it names)
+  // is what makes a keystroke that superseded an in-flight scan re-arm one,
+  // and what lets an edit after a rejected submission release the hold the
+  // submission took. The panes are read through a ref for the converse
+  // reason: were they dependencies, the landing this commits would re-arm the
+  // wait, and a host answering with a differently spelled path would scan
+  // forever.
   useEffect(() => {
-    if (previewDirectory === null) return
+    if (pathDraft === null) return
     const timer = window.setTimeout(() => {
       if (previewSuspended.current) return
-      previewDraftLevel(previewDirectory)
+      const directory = pendingPreviewDirectory(viewRef.current.parent, viewRef.current.child, pathDraft)
+      if (directory === null) return
+      previewDraftLevel(directory)
     }, DRAFT_PREVIEW_DEBOUNCE_MS)
     return () => { window.clearTimeout(timer) }
-  }, [previewDirectory, previewDraftLevel])
+  }, [pathDraft, previewDraftLevel])
 
   // After the hooks: a closed dialog renders nothing and evaluates no copy.
   const crumbSource = child ?? parent
@@ -642,6 +662,12 @@ export function DirectoryBrowser({ open, listDirectory, createDirectory, onOpen,
   // replacing the picked button's column — while Enter and an input-focused
   // Escape land on the crumb edit zone that replaces the input.
   useEffect(() => {
+    if (refocusPathInput.current) {
+      refocusPathInput.current = false
+      // Only when the swap actually dropped focus to body: focus the operator
+      // still holds (the input itself, a surviving row) stays theirs.
+      if (document.activeElement === document.body) pathInputRef.current?.focus()
+    }
     if (pathDraft !== null) return
     if (refocusPick.current) {
       refocusPick.current = false

packages/host/directory-picker-browse/tests/directory-browser.spec.tsx

@@ -678,7 +678,7 @@ describe('DirectoryBrowser', () => {
   })
 
   it('filters the child pane in two-pane mode and follows the draft back up a level', async () => {
-    mount()
+    const b = mount()
     await waitFor(() => { expect(screen.getByRole('listitem')).toBeTruthy() })
     fireEvent.click(rowButton(screen.getByRole('listitem')))
     await waitFor(() => { expect(columns()).toHaveLength(2) })
@@ -689,6 +689,12 @@ describe('DirectoryBrowser', () => {
     expect(input.value).toBe(`${DOCS}/`)
     fireEvent.change(input, { target: { value: `${DOCS}/h` } })
     expect(within(columns()[1]!).getByText('harness')).toBeTruthy()
+    // The child pane already lists that directory: no scan follows, and both
+    // panes stay.
+    const settled = b.listDirectory.mock.calls.length
+    await act(async () => { await new Promise((resolve) => { setTimeout(resolve, 400) }) })
+    expect(b.listDirectory.mock.calls).toHaveLength(settled)
+    expect(columns()).toHaveLength(2)
     // A miss releases the right pane's filter rather than emptying it.
     fireEvent.change(input, { target: { value: `${DOCS}/zzz` } })
     expect(within(columns()[1]!).getByText('harness')).toBeTruthy()
@@ -712,6 +718,12 @@ describe('DirectoryBrowser', () => {
     expect(b.listDirectory.mock.calls.at(-1)?.[0]).toBe(`${DOCS}/`)
     // Still editing: the panes moved under the draft, the editor stayed.
     expect(screen.getByLabelText<HTMLInputElement>('browser.editPath').value).toBe(`${DOCS}/h`)
+    // Typing on inside the level the panes now list costs no scan at all:
+    // the prefix filter alone answers the draft.
+    const settled = b.listDirectory.mock.calls.length
+    fireEvent.change(input, { target: { value: `${DOCS}/ha` } })
+    await act(async () => { await new Promise((resolve) => { setTimeout(resolve, 400) }) })
+    expect(b.listDirectory.mock.calls).toHaveLength(settled)
     // Erasing back past the separator steps the panes up a level again.
     fireEvent.change(input, { target: { value: `${HOME}/Do` } })
     await waitFor(() => { expect(screen.getByText('Documents')).toBeTruthy() })
@@ -719,6 +731,62 @@ describe('DirectoryBrowser', () => {
     expect(columns()).toHaveLength(1)
   })
 
+  it('re-arms the draft-following scan after a keystroke superseded one in flight', async () => {
+    let started = 0
+    const listDirectory = vi.fn(async (path?: string) => {
+      if (path !== `${DOCS}/`) return listingFor(path)
+      started += 1
+      // The first scan never settles: the next keystroke aborts it, and only
+      // a re-armed wait can still land the level the draft names.
+      if (started === 1) return await new Promise<DirectoryListing>(() => {})
+      return listingFor(path)
+    })
+    mount({ listDirectory })
+    await waitFor(() => { expect(screen.getByRole('listitem')).toBeTruthy() })
+    fireEvent.click(screen.getByRole('button', { name: 'browser.editPath' }))
+    const input = screen.getByLabelText<HTMLInputElement>('browser.editPath')
+    fireEvent.change(input, { target: { value: `${DOCS}/h` } })
+    await waitFor(() => { expect(started).toBe(1) })
+    // A further tail keystroke supersedes the in-flight scan; the panes must
+    // still follow, not sit on the stale level until a separator is typed.
+    fireEvent.change(input, { target: { value: `${DOCS}/ha` } })
+    await waitFor(() => { expect(screen.getByText('harness')).toBeTruthy() })
+  })
+
+  it('follows the draft again after an edit releases a failed submission hold', async () => {
+    const listDirectory = vi.fn(async (path?: string) => {
+      if (path === HARNESS) throw new Error('target unreadable')
+      return listingFor(path)
+    })
+    mount({ listDirectory })
+    await waitFor(() => { expect(screen.getByRole('listitem')).toBeTruthy() })
+    fireEvent.click(screen.getByRole('button', { name: 'browser.editPath' }))
+    const input = screen.getByLabelText<HTMLInputElement>('browser.editPath')
+    // Submitting inside the debounce window holds the pending scan back.
+    fireEvent.change(input, { target: { value: HARNESS } })
+    fireEvent.keyDown(input, { key: 'Enter' })
+    await waitFor(() => { expect(screen.getByRole('alert').textContent).toBe('target unreadable') })
+    // Correcting only the final segment leaves the directory part unchanged;
+    // the edit must still release the hold and re-arm the wait.
+    fireEvent.change(input, { target: { value: `${HARNESS}x` } })
+    await waitFor(() => { expect(listDirectory).toHaveBeenCalledWith(`${DOCS}/`, expect.anything()) })
+    await waitFor(() => { expect(screen.getByText('harness')).toBeTruthy() })
+  })
+
+  it('re-parks focus on the editor when a landed scan unmounts the focused row', async () => {
+    mount()
+    await waitFor(() => { expect(screen.getByRole('listitem')).toBeTruthy() })
+    fireEvent.click(screen.getByRole('button', { name: 'browser.editPath' }))
+    const input = screen.getByLabelText<HTMLInputElement>('browser.editPath')
+    fireEvent.change(input, { target: { value: `${DOCS}/h` } })
+    // The keyboard path: focus Tabbed onto a row of the level about to be
+    // replaced. Without a re-park it would fall to body, outside a Modal that
+    // has no focus trap.
+    rowButton(screen.getByRole('listitem')).focus()
+    await waitFor(() => { expect(screen.getByText('harness')).toBeTruthy() })
+    expect(document.activeElement).toBe(screen.getByLabelText('browser.editPath'))
+  })
+
   it('keeps the panes and stays silent when a draft-following scan fails', async () => {
     const b = mount()
     await waitFor(() => { expect(screen.getByRole('listitem')).toBeTruthy() })
@@ -1065,6 +1133,10 @@ describe('DirectoryBrowser', () => {
     fireEvent.click(screen.getByRole('button', { name: 'browser.editPath' }))
     const input = screen.getByLabelText('browser.editPath')
     fireEvent.change(input, { target: { value: DOCS } })
+    // With no level listed there is no platform separator to read, so the
+    // draft-following wait resolves to nothing and the editor types blind.
+    await act(async () => { await new Promise((resolve) => { setTimeout(resolve, 400) }) })
+    expect(listDirectory).toHaveBeenCalledTimes(1)
     listDirectory.mockImplementation(async (path?: string) => listingFor(path))
     fireEvent.keyDown(input, { key: 'Enter' })
     await waitFor(() => { expect(screen.getByText('harness')).toBeTruthy() })