From 1ee53a1aacbb1d15be5cc8d77be5d68b89e0c6ec Mon Sep 17 00:00:00 2001
From: Pearce Kieser <5055971+Pearcekieser@users.noreply.github.com>
Date: Thu, 3 Sep 2026 20:52:51 +0000
Subject: [PATCH] fix(pierre): recover failed highlight worker pools

---
 website/src/i18n/locales/bn.json              |   6 +
 website/src/i18n/locales/de.json              |   6 +
 website/src/i18n/locales/en-XA.json           |   6 +
 website/src/i18n/locales/en.json              |   6 +
 website/src/i18n/locales/es.json              |   6 +
 website/src/i18n/locales/fr.json              |   6 +
 website/src/i18n/locales/hi.json              |   6 +
 website/src/i18n/locales/it.json              |   6 +
 website/src/i18n/locales/ja.json              |   6 +
 website/src/i18n/locales/ko.json              |   6 +
 website/src/i18n/locales/pt.json              |   6 +
 website/src/i18n/locales/ru.json              |   6 +
 website/src/i18n/locales/zh-CN.json           |   6 +
 website/src/pierre/PierreEditorImpl.tsx       | 244 +++++++--
 website/src/pierre/PierreImpl.tsx             | 393 +++++++++++----
 website/src/pierre/PlainCodeFallback.tsx      |  75 ++-
 website/src/pierre/config.ts                  |  17 +-
 website/src/pierre/index.tsx                  |  80 ++-
 website/src/pierre/workerHealth.ts            |  61 ---
 website/src/pierre/workerPoolLifecycle.ts     | 159 ++++++
 website/src/test/PierreEditorImpl.test.tsx    | 222 ++++++++-
 .../src/test/PierreImpl.workerPool.test.tsx   | 466 ++++++++++++++----
 website/src/test/pierre.poolRebind.test.tsx   |  73 +++
 .../test/pierre.warmSwap.slowChunk.test.tsx   |  72 +++
 website/src/test/pierre.warmSwap.test.tsx     |   6 +
 website/src/test/pierre.workerHealth.test.tsx |  62 ---
 .../src/test/pierre.workerProtocol.test.ts    | 114 +++++
 website/src/test/workerPoolLifecycle.test.tsx | 178 +++++++
 28 files changed, 1892 insertions(+), 408 deletions(-)
 delete mode 100644 website/src/pierre/workerHealth.ts
 create mode 100644 website/src/pierre/workerPoolLifecycle.ts
 create mode 100644 website/src/test/pierre.poolRebind.test.tsx
 create mode 100644 website/src/test/pierre.warmSwap.slowChunk.test.tsx
 delete mode 100644 website/src/test/pierre.workerHealth.test.tsx
 create mode 100644 website/src/test/pierre.workerProtocol.test.ts
 create mode 100644 website/src/test/workerPoolLifecycle.test.tsx

diff --git a/website/src/i18n/locales/bn.json b/website/src/i18n/locales/bn.json
index 69986031b12..3f99c22a110 100644
--- a/website/src/i18n/locales/bn.json
+++ b/website/src/i18n/locales/bn.json
@@ -6984,6 +6984,12 @@
       "subtitle": "{{productName}} যে পাঁচটি বেনামী ফিল্ড পাঠায়, এবং কীভাবে তা বন্ধ করবেন।",
       "title": "গোপনীয়তা"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "হাইলাইটিং পুনরায় চালু হচ্ছে। সম্পাদনা করা যাবে।",
+      "highlighting_starting_editing_available": "সিনট্যাক্স হাইলাইটিং শুরু হচ্ছে। সম্পাদনা করা যাবে।",
+      "highlighting_unavailable_content_readable_reload": "পুনরায় লোড না করা পর্যন্ত সিনট্যাক্স হাইলাইটিং অনুপলব্ধ। বিষয়বস্তু পড়া যাবে।",
+      "highlighting_unavailable_reload": "সিনট্যাক্স হাইলাইটিং অনুপলব্ধ। আপনার খসড়া সংরক্ষণ বা অনুলিপি করুন, তারপর সিনট্যাক্স হাইলাইটিং পুনরুদ্ধার করতে পুনরায় লোড করুন; সম্পাদনা করা যাবে।"
+    },
     "projectPicker": {
       "back": "পেছনে",
       "browse": "ব্রাউজ করুন",
diff --git a/website/src/i18n/locales/de.json b/website/src/i18n/locales/de.json
index 14321401b68..8c3bacac647 100644
--- a/website/src/i18n/locales/de.json
+++ b/website/src/i18n/locales/de.json
@@ -6984,6 +6984,12 @@
       "subtitle": "Die fünf anonymen Felder, die {{productName}} sendet, und wie du sie abschaltest.",
       "title": "Datenschutz"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "Die Hervorhebung wird neu gestartet. Bearbeiten bleibt möglich.",
+      "highlighting_starting_editing_available": "Die Syntaxhervorhebung wird gestartet. Bearbeiten bleibt möglich.",
+      "highlighting_unavailable_content_readable_reload": "Die Syntaxhervorhebung ist bis zum Neuladen nicht verfügbar. Der Inhalt bleibt lesbar.",
+      "highlighting_unavailable_reload": "Die Syntaxhervorhebung ist nicht verfügbar. Speichern oder kopieren Sie Ihren Entwurf und laden Sie dann neu, um sie wiederherzustellen; Bearbeiten bleibt möglich."
+    },
     "projectPicker": {
       "back": "Zurück",
       "browse": "Durchsuchen",
diff --git a/website/src/i18n/locales/en-XA.json b/website/src/i18n/locales/en-XA.json
index 20d44e33f38..135e4a6b5af 100644
--- a/website/src/i18n/locales/en-XA.json
+++ b/website/src/i18n/locales/en-XA.json
@@ -6462,6 +6462,12 @@
       "tech_non_technical": "[Ñøţ ţèçĥñìçàĺ ············]",
       "tech_somewhat": "[Şøɱèẁĥàţ ············]"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "[Şýñţàẋ ĥìğĥĺìğĥţìñğ ìş ŕèşţàŕţìñğ. Èðìţìñğ ŕèɱàìñş àṽàìĺàƀĺè. ·····················]",
+      "highlighting_starting_editing_available": "[Şýñţàẋ ĥìğĥĺìğĥţìñğ ìş şţàŕţìñğ. Èðìţìñğ ŕèɱàìñş àṽàìĺàƀĺè. ·····················]",
+      "highlighting_unavailable_content_readable_reload": "[Şýñţàẋ ĥìğĥĺìğĥţìñğ ìş ùñàṽàìĺàƀĺè ùñţìĺ ýøù ŕèĺøàð. Çøñţèñţ ŕèɱàìñş ŕèàðàƀĺè. ·······················]",
+      "highlighting_unavailable_reload": "[Şýñţàẋ ĥìğĥĺìğĥţìñğ ìş ùñàṽàìĺàƀĺè. Şàṽè øŕ çøþý ýøùŕ ðŕàƒţ, ţĥèñ ŕèĺøàð ţø ŕèşţøŕè şýñţàẋ ĥìğĥĺìğĥţìñğ; èðìţìñğ ŕèɱàìñş àṽàìĺàƀĺè. ·······································]"
+    },
     "projectPicker": {
       "back": "[Ɓàçķ ······]",
       "browse": "[Ɓŕøẁşè ·········]",
diff --git a/website/src/i18n/locales/en.json b/website/src/i18n/locales/en.json
index a9fb703eb37..565e8ab9836 100644
--- a/website/src/i18n/locales/en.json
+++ b/website/src/i18n/locales/en.json
@@ -4803,6 +4803,12 @@
       "tell_kiro_about_you": "Tell Kiro about you",
       "your_role": "Your role"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "Syntax highlighting is restarting. Editing remains available.",
+      "highlighting_starting_editing_available": "Syntax highlighting is starting. Editing remains available.",
+      "highlighting_unavailable_content_readable_reload": "Syntax highlighting is unavailable until you reload. Content remains readable.",
+      "highlighting_unavailable_reload": "Syntax highlighting is unavailable. Save or copy your draft, then reload to restore syntax highlighting; editing remains available."
+    },
     "projectPicker": {
       "back": "Back",
       "browse": "Browse",
diff --git a/website/src/i18n/locales/es.json b/website/src/i18n/locales/es.json
index af9168df53f..d8278605785 100644
--- a/website/src/i18n/locales/es.json
+++ b/website/src/i18n/locales/es.json
@@ -7088,6 +7088,12 @@
       "subtitle": "Los cinco campos anónimos que envía {{productName}} y cómo desactivarlos.",
       "title": "Privacidad"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "El resaltado se está reiniciando. Puedes seguir editando.",
+      "highlighting_starting_editing_available": "El resaltado de sintaxis se está iniciando. Puedes seguir editando.",
+      "highlighting_unavailable_content_readable_reload": "El resaltado de sintaxis no estará disponible hasta que recargues. El contenido seguirá siendo legible.",
+      "highlighting_unavailable_reload": "El resaltado de sintaxis no está disponible. Guarda o copia tu borrador y luego recarga para restaurarlo; puedes seguir editando."
+    },
     "projectPicker": {
       "back": "Atrás",
       "browse": "Examinar",
diff --git a/website/src/i18n/locales/fr.json b/website/src/i18n/locales/fr.json
index 2e05b40e72d..572424683ea 100644
--- a/website/src/i18n/locales/fr.json
+++ b/website/src/i18n/locales/fr.json
@@ -7088,6 +7088,12 @@
       "subtitle": "Les cinq champs anonymes que {{productName}} envoie, et comment les désactiver.",
       "title": "Confidentialité"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "La coloration redémarre. La modification reste possible.",
+      "highlighting_starting_editing_available": "La coloration syntaxique démarre. La modification reste possible.",
+      "highlighting_unavailable_content_readable_reload": "La coloration syntaxique est indisponible jusqu’au rechargement. Le contenu reste lisible.",
+      "highlighting_unavailable_reload": "La coloration syntaxique est indisponible. Enregistrer ou copier le brouillon, puis recharger la page pour la restaurer ; la modification reste possible."
+    },
     "projectPicker": {
       "back": "Retour",
       "browse": "Parcourir",
diff --git a/website/src/i18n/locales/hi.json b/website/src/i18n/locales/hi.json
index 79cfa7e249e..256f885ecc5 100644
--- a/website/src/i18n/locales/hi.json
+++ b/website/src/i18n/locales/hi.json
@@ -6984,6 +6984,12 @@
       "subtitle": "{{productName}} जो पाँच अनाम फ़ील्ड भेजता है, और उन्हें कैसे बंद करना है।",
       "title": "गोपनीयता"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "हाइलाइटिंग फिर से शुरू हो रही है। संपादन जारी रखा जा सकता है।",
+      "highlighting_starting_editing_available": "सिंटैक्स हाइलाइटिंग शुरू हो रही है। संपादन जारी रखा जा सकता है।",
+      "highlighting_unavailable_content_readable_reload": "पुनः लोड करने तक सिंटैक्स हाइलाइटिंग उपलब्ध नहीं है। सामग्री पढ़ी जा सकती है।",
+      "highlighting_unavailable_reload": "सिंटैक्स हाइलाइटिंग उपलब्ध नहीं है। अपना ड्राफ़्ट सहेजें या कॉपी करें, फिर इसे बहाल करने के लिए पुनः लोड करें; संपादन जारी रखा जा सकता है।"
+    },
     "projectPicker": {
       "back": "वापस",
       "browse": "ब्राउज़ करें",
diff --git a/website/src/i18n/locales/it.json b/website/src/i18n/locales/it.json
index e0d687895d8..9af6d8259b3 100644
--- a/website/src/i18n/locales/it.json
+++ b/website/src/i18n/locales/it.json
@@ -7088,6 +7088,12 @@
       "subtitle": "I cinque campi anonimi che {{productName}} invia e come disattivarli.",
       "title": "Privacy"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "L'evidenziazione si sta riavviando. Puoi continuare a modificare.",
+      "highlighting_starting_editing_available": "L'evidenziazione della sintassi si sta avviando. Puoi continuare a modificare.",
+      "highlighting_unavailable_content_readable_reload": "L'evidenziazione della sintassi non sarà disponibile fino al ricaricamento. Il contenuto resta leggibile.",
+      "highlighting_unavailable_reload": "L'evidenziazione della sintassi non è disponibile. Salva o copia la bozza, quindi ricarica per ripristinarla; puoi continuare a modificare."
+    },
     "projectPicker": {
       "back": "Indietro",
       "browse": "Sfoglia",
diff --git a/website/src/i18n/locales/ja.json b/website/src/i18n/locales/ja.json
index ac1c325eb04..12620a40448 100644
--- a/website/src/i18n/locales/ja.json
+++ b/website/src/i18n/locales/ja.json
@@ -6880,6 +6880,12 @@
       "subtitle": "{{productName}}が送信する5つの匿名フィールドと、それをオフにする方法。",
       "title": "プライバシー"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "ハイライトを再起動しています。編集は続けられます。",
+      "highlighting_starting_editing_available": "構文ハイライトを開始しています。編集は続けられます。",
+      "highlighting_unavailable_content_readable_reload": "再読み込みするまで構文ハイライトを利用できません。内容は引き続き読めます。",
+      "highlighting_unavailable_reload": "構文ハイライトを利用できません。下書きを保存またはコピーしてから、構文ハイライトを復元するために再読み込みしてください。編集は続けられます。"
+    },
     "projectPicker": {
       "back": "戻る",
       "browse": "参照",
diff --git a/website/src/i18n/locales/ko.json b/website/src/i18n/locales/ko.json
index 84218ac694d..e666ed587a5 100644
--- a/website/src/i18n/locales/ko.json
+++ b/website/src/i18n/locales/ko.json
@@ -6880,6 +6880,12 @@
       "subtitle": "{{productName}}이(가) 전송하는 익명 필드 5개와 이를 끄는 방법입니다.",
       "title": "개인 정보"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "강조 표시를 다시 시작하는 중입니다. 편집은 계속할 수 있습니다.",
+      "highlighting_starting_editing_available": "구문 강조 표시를 시작하는 중입니다. 편집은 계속할 수 있습니다.",
+      "highlighting_unavailable_content_readable_reload": "다시 로드할 때까지 구문 강조 표시를 사용할 수 없습니다. 콘텐츠는 계속 읽을 수 있습니다.",
+      "highlighting_unavailable_reload": "구문 강조 표시를 사용할 수 없습니다. 초안을 저장하거나 복사한 다음, 구문 강조 표시를 복원하려면 다시 로드하세요. 편집은 계속할 수 있습니다."
+    },
     "projectPicker": {
       "back": "뒤로",
       "browse": "찾아보기",
diff --git a/website/src/i18n/locales/pt.json b/website/src/i18n/locales/pt.json
index 7e1a8d8e368..6bc7be12712 100644
--- a/website/src/i18n/locales/pt.json
+++ b/website/src/i18n/locales/pt.json
@@ -7088,6 +7088,12 @@
       "subtitle": "Os cinco campos anônimos que o {{productName}} envia e como desativá-los.",
       "title": "Privacidade"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "O realce está reiniciando. Você pode continuar editando.",
+      "highlighting_starting_editing_available": "O realce de sintaxe está iniciando. Você pode continuar editando.",
+      "highlighting_unavailable_content_readable_reload": "O realce de sintaxe ficará indisponível até você recarregar. O conteúdo continua legível.",
+      "highlighting_unavailable_reload": "O realce de sintaxe está indisponível. Salve ou copie seu rascunho e recarregue para restaurá-lo; você pode continuar editando."
+    },
     "projectPicker": {
       "back": "Voltar",
       "browse": "Procurar",
diff --git a/website/src/i18n/locales/ru.json b/website/src/i18n/locales/ru.json
index 55722273018..e2af1de2918 100644
--- a/website/src/i18n/locales/ru.json
+++ b/website/src/i18n/locales/ru.json
@@ -7192,6 +7192,12 @@
       "subtitle": "Пять анонимных полей, которые отправляет {{productName}}, и как их отключить.",
       "title": "Конфиденциальность"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "Подсветка перезапускается. Редактирование остаётся доступным.",
+      "highlighting_starting_editing_available": "Подсветка синтаксиса запускается. Редактирование остаётся доступным.",
+      "highlighting_unavailable_content_readable_reload": "Подсветка синтаксиса недоступна до перезагрузки. Содержимое остаётся читаемым.",
+      "highlighting_unavailable_reload": "Подсветка синтаксиса недоступна. Сохраните или скопируйте черновик, затем перезагрузите страницу, чтобы восстановить её; редактирование остаётся доступным."
+    },
     "projectPicker": {
       "back": "Назад",
       "browse": "Обзор",
diff --git a/website/src/i18n/locales/zh-CN.json b/website/src/i18n/locales/zh-CN.json
index ae2bad90b89..7c6ad34b3c2 100644
--- a/website/src/i18n/locales/zh-CN.json
+++ b/website/src/i18n/locales/zh-CN.json
@@ -6880,6 +6880,12 @@
       "subtitle": "{{productName}} 发送的五个匿名字段，以及如何关闭。",
       "title": "隐私"
     },
+    "pierreEditorImpl": {
+      "highlighting_restarting_editing_available": "正在重新启动高亮显示。仍可继续编辑。",
+      "highlighting_starting_editing_available": "正在启动语法高亮。仍可继续编辑。",
+      "highlighting_unavailable_content_readable_reload": "重新加载前语法高亮不可用。内容仍可阅读。",
+      "highlighting_unavailable_reload": "语法高亮不可用。请保存或复制草稿，然后重新加载以恢复语法高亮；仍可继续编辑。"
+    },
     "projectPicker": {
       "back": "返回",
       "browse": "浏览",
diff --git a/website/src/pierre/PierreEditorImpl.tsx b/website/src/pierre/PierreEditorImpl.tsx
index 9447c35d1d8..b0790eaefe3 100644
--- a/website/src/pierre/PierreEditorImpl.tsx
+++ b/website/src/pierre/PierreEditorImpl.tsx
@@ -3,11 +3,13 @@
  * editing surface for every code-editing view. Lives beside `PierreImpl` in
  * the same lazy chunk; reach it through `../pierre` only.
  */
-import { forwardRef, useEffect, useId, useImperativeHandle, useMemo, useRef } from 'react'
+import { forwardRef, useEffect, useId, useImperativeHandle, useLayoutEffect, useMemo, useRef, useState } from 'react'
 import type { BaseCodeOptions, FileContents } from '@pierre/diffs'
 import { EditProvider, File, MultiFileDiff, Virtualizer } from '@pierre/diffs/react'
 import { Editor, type EditorOptions } from '@pierre/diffs/edit'
 import { useIsDark } from '../hooks/useIsDark'
+import ErrorNotice from '../components/ErrorNotice'
+import { i18nT } from '../i18n/t'
 import {
   PIERRE_EDIT_CARET_ALIGN_CSS,
   PIERRE_VIRTUALIZER_CONFIG,
@@ -15,7 +17,7 @@ import {
   pierreFileOptions,
   pierreThemeType,
 } from './config'
-import { contentCacheKey, PierreShell } from './PierreImpl'
+import { activeWorkerPool, contentCacheKey, PierreShell, usePierreWorkerPool, useRegisterEditorSurface } from './PierreImpl'
 import { isPierreFilePairWithinBudget } from './renderBudget'
 
 export interface EditorMarker {
@@ -58,6 +60,27 @@ function revealSpan(editor: Editor<undefined>, line: number, endLine?: number):
   }])
 }
 
+function offsetToEditorPosition(contents: string, offset: number): { line: number; character: number } {
+  const before = contents.slice(0, Math.max(0, Math.min(offset, contents.length)))
+  const lastNewline = before.lastIndexOf('\n')
+  return {
+    line: lastNewline < 0 ? 0 : before.split('\n').length - 1,
+    character: lastNewline < 0 ? before.length : before.length - lastNewline - 1,
+  }
+}
+
+function applyMarkers(editor: Editor<undefined>, markers: EditorMarker[] | undefined): void {
+  if (markers == null) return
+  editor.setMarkers(
+    markers.map(marker => ({
+      severity: marker.severity,
+      message: marker.message,
+      start: { line: marker.line - 1, character: 0 },
+      end: { line: marker.line - 1, character: Number.MAX_SAFE_INTEGER },
+    })),
+  )
+}
+
 export const PierreEditorImpl = forwardRef<PierreEditorHandle, {
   file: FileContents
   options?: BaseCodeOptions
@@ -77,6 +100,10 @@ export const PierreEditorImpl = forwardRef<PierreEditorHandle, {
   className?: string
 }>(function PierreEditorImpl({ file, options, onChange, onSave, markers, onCursorChange, diffBase, diffSplit, diffExpandUnchanged, className }, ref) {
   const dark = useIsDark()
+  const poolState = usePierreWorkerPool()
+  useRegisterEditorSurface()
+  const activePool = activeWorkerPool(poolState)
+  const pierreActive = activePool !== undefined
   const resolved = useMemo(
     () => pierreFileOptions({ themeType: pierreThemeType(dark), ...options }),
     [dark, options],
@@ -92,6 +119,56 @@ export const PierreEditorImpl = forwardRef<PierreEditorHandle, {
     [dark, options, diffSplit, diffExpandUnchanged],
   )
   const surfaceId = useId()
+  const recoveryStatusId = `${surfaceId}-recovery-status`
+  const containerRef = useRef<HTMLDivElement>(null)
+  const fallbackRef = useRef<HTMLTextAreaElement>(null)
+  const restoreFocusRef = useRef(false)
+  const fallbackSelectionRef = useRef<{ start: number; end: number; direction: 'forward' | 'backward' | 'none' } | null>(null)
+  const propContentsRef = useRef(file.contents)
+  const latestContentsRef = useRef(file.contents)
+  const remountDraftRef = useRef<string | null>(null)
+  const previousPierreActiveRef = useRef(pierreActive)
+  const [fallbackDraft, setFallbackDraft] = useState(file.contents)
+  const propChanged = propContentsRef.current !== file.contents
+  if (propChanged) {
+    propContentsRef.current = file.contents
+    latestContentsRef.current = file.contents
+    remountDraftRef.current = null
+    if (fallbackDraft !== file.contents) setFallbackDraft(file.contents)
+  }
+  const previousPierreActive = previousPierreActiveRef.current
+  const enteringFallback = previousPierreActive && !pierreActive
+  const leavingFallback = !previousPierreActive && pierreActive
+  if (enteringFallback && containerRef.current?.contains(document.activeElement)) {
+    restoreFocusRef.current = true
+  }
+  const focusedFallback = fallbackRef.current
+  if (leavingFallback && focusedFallback !== null && focusedFallback === document.activeElement) {
+    restoreFocusRef.current = true
+    fallbackSelectionRef.current = {
+      start: focusedFallback.selectionStart,
+      end: focusedFallback.selectionEnd,
+      direction: focusedFallback.selectionDirection ?? 'none',
+    }
+  }
+  previousPierreActiveRef.current = pierreActive
+  if (enteringFallback) {
+    remountDraftRef.current = latestContentsRef.current
+    if (fallbackDraft !== latestContentsRef.current) setFallbackDraft(latestContentsRef.current)
+  }
+  const recoveryContents = enteringFallback ? latestContentsRef.current : fallbackDraft
+  // The remount seed is frozen for the life of a Pierre generation: the buffer
+  // is the source of truth while an edit session is active, and a `file` prop
+  // that changed on every keystroke would clear Pierre's dirty render cache
+  // mid-edit. Later edits live in `latestContentsRef`, which the next
+  // recovery snapshot reads, so nothing typed after a remount is lost.
+  const editorContents = remountDraftRef.current ?? file.contents
+  const editorFile = useMemo<FileContents>(
+    () => (file.contents === editorContents
+      ? file
+      : { ...file, contents: editorContents, cacheKey: contentCacheKey(file.name, editorContents) }),
+    [file, editorContents],
+  )
   const baseFile = useMemo<FileContents | null>(
     () => (diffBase == null
       ? null
@@ -99,17 +176,30 @@ export const PierreEditorImpl = forwardRef<PierreEditorHandle, {
     [diffBase, file.name, surfaceId],
   )
   const renderLiveDiff = diffBase !== undefined
-    && isPierreFilePairWithinBudget(baseFile, file)
+    && isPierreFilePairWithinBudget(baseFile, editorFile)
   const editorRef = useRef<Editor<undefined> | null>(null)
   /** A jump requested before Pierre bound its editor, replayed on attach. */
   const pendingJumpRef = useRef<{ line: number; endLine?: number } | null>(null)
-  const containerRef = useRef<HTMLDivElement>(null)
   const onChangeRef = useRef(onChange)
   onChangeRef.current = onChange
   const onSaveRef = useRef(onSave)
   onSaveRef.current = onSave
   const onCursorRef = useRef(onCursorChange)
   onCursorRef.current = onCursorChange
+  const generationRef = useRef(poolState.generation)
+  generationRef.current = poolState.generation
+  const markersRef = useRef(markers)
+  markersRef.current = markers
+  const markerApplicationRef = useRef<{ generation: number; markers: EditorMarker[] | undefined } | null>(null)
+
+  useLayoutEffect(() => {
+    if (pierreActive) return
+    editorRef.current = null
+    if (restoreFocusRef.current) {
+      fallbackRef.current?.focus()
+      restoreFocusRef.current = false
+    }
+  }, [pierreActive, poolState.generation])
 
   const reportCursor = () => {
     const sel = editorRef.current?.getState()?.selections?.[0]
@@ -122,13 +212,38 @@ export const PierreEditorImpl = forwardRef<PierreEditorHandle, {
     () => ({
       onAttach(editor) {
         editorRef.current = editor
+        const generation = generationRef.current
+        const currentMarkers = markersRef.current
+        const applied = markerApplicationRef.current
+        if (
+          currentMarkers != null
+          && currentMarkers.length > 0
+          && !(applied?.generation === generation && applied.markers === currentMarkers)
+        ) {
+          applyMarkers(editor, currentMarkers)
+          markerApplicationRef.current = { generation, markers: currentMarkers }
+        }
+        const fallbackSelection = fallbackSelectionRef.current
+        if (fallbackSelection !== null) {
+          fallbackSelectionRef.current = null
+          editor.setSelections([{
+            start: offsetToEditorPosition(latestContentsRef.current, fallbackSelection.start),
+            end: offsetToEditorPosition(latestContentsRef.current, fallbackSelection.end),
+            direction: fallbackSelection.direction,
+          }])
+        }
         const pending = pendingJumpRef.current
         if (pending !== null) {
           pendingJumpRef.current = null
           revealSpan(editor, pending.line, pending.endLine)
         }
+        if (restoreFocusRef.current) {
+          restoreFocusRef.current = false
+          editor.focus()
+        }
       },
       onChange(changed) {
+        latestContentsRef.current = changed.contents
         onChangeRef.current(changed.contents)
         reportCursor()
       },
@@ -138,16 +253,12 @@ export const PierreEditorImpl = forwardRef<PierreEditorHandle, {
 
   useEffect(() => {
     const editor = editorRef.current
-    if (!editor || markers == null) return
-    editor.setMarkers(
-      markers.map(m => ({
-        severity: m.severity,
-        message: m.message,
-        start: { line: m.line - 1, character: 0 },
-        end: { line: m.line - 1, character: Number.MAX_SAFE_INTEGER },
-      })),
-    )
-  }, [markers])
+    if (!editor) return
+    const applied = markerApplicationRef.current
+    if (applied?.generation === poolState.generation && applied.markers === markers) return
+    applyMarkers(editor, markers)
+    markerApplicationRef.current = { generation: poolState.generation, markers }
+  }, [markers, poolState.generation])
 
   useImperativeHandle(ref, () => ({
     jumpToLine: (line: number, endLine?: number) => {
@@ -191,32 +302,87 @@ export const PierreEditorImpl = forwardRef<PierreEditorHandle, {
       onKeyUp={reportCursor}
       onMouseUp={reportCursor}
     >
-      <PierreShell>
-      <Virtualizer
-        config={PIERRE_VIRTUALIZER_CONFIG}
-        className={`pierre-surface h-full w-full overflow-auto ${className ?? ''}`}
-      >
-        <EditProvider createEditor={createEditor}>
-        {renderLiveDiff ? (
-          // Live-diff edit session: Pierre diffs the buffer against the
-          // baseline as you type. Inputs outside the renderer-thread budget
-          // keep the same editor behavior but omit live diff decoration.
-          // Keyed so flipping modes rebuilds the edit session rather than
-          // rebinding one editor across surface kinds.
-          <MultiFileDiff
-            key="diff"
-            oldFile={baseFile}
-            newFile={file}
-            edit
-            editorOptions={editorOptions}
-            options={resolvedDiff}
+      {activePool !== undefined ? (
+        <PierreShell pool={activePool} generation={poolState.generation}>
+        <Virtualizer
+          config={PIERRE_VIRTUALIZER_CONFIG}
+          className={`pierre-surface h-full w-full overflow-auto ${className ?? ''}`}
+        >
+          <EditProvider createEditor={createEditor}>
+          {renderLiveDiff ? (
+            // Live-diff edit session: Pierre diffs the buffer against the
+            // baseline as you type. Inputs outside the renderer-thread budget
+            // keep the same editor behavior but omit live diff decoration.
+            // Keyed so flipping modes rebuilds the edit session rather than
+            // rebinding one editor across surface kinds.
+            <MultiFileDiff
+              key="diff"
+              oldFile={baseFile}
+              newFile={editorFile}
+              edit
+              editorOptions={editorOptions}
+              options={resolvedDiff}
+            />
+          ) : (
+            <File key="file" file={editorFile} edit editorOptions={editorOptions} options={resolved} />
+          )}
+          </EditProvider>
+        </Virtualizer>
+        </PierreShell>
+      ) : (
+        <div className="grid h-full w-full grid-rows-[auto_minmax(0,1fr)]">
+          <textarea
+            ref={fallbackRef}
+            aria-label={file.name}
+            aria-describedby={recoveryStatusId}
+            className="pierre-editor-fallback row-start-2 h-full min-h-0 w-full resize-none overflow-auto bg-transparent px-3 py-2 text-[13px] font-mono leading-5 text-text"
+            spellCheck={false}
+            value={recoveryContents}
+            onChange={event => {
+              const contents = event.currentTarget.value
+              fallbackSelectionRef.current = {
+                start: event.currentTarget.selectionStart,
+                end: event.currentTarget.selectionEnd,
+                direction: event.currentTarget.selectionDirection ?? 'none',
+              }
+              latestContentsRef.current = contents
+              remountDraftRef.current = contents
+              setFallbackDraft(contents)
+              onChangeRef.current(contents)
+            }}
           />
-        ) : (
-          <File key="file" file={file} edit editorOptions={editorOptions} options={resolved} />
-        )}
-      </EditProvider>
-      </Virtualizer>
-      </PierreShell>
+          {poolState.phase === 'unavailable' ? (
+            <div id={recoveryStatusId} className="row-start-1 shrink-0 bg-bg-elevated">
+              {/* No hand-off: the recovery textarea may hold an unsaved draft,
+                  so an agent action must not replace or navigate away from it. */}
+              <ErrorNotice
+                variant="inline"
+                className="px-3 py-1 text-[11px]"
+                message={i18nT('components.pierreEditorImpl.highlighting_unavailable_reload')}
+              />
+            </div>
+          ) : poolState.phase === 'starting' ? (
+            // Cold start is not a failure: a quiet status line, not an alert.
+            <div
+              id={recoveryStatusId}
+              role="status"
+              className="pointer-events-none row-start-1 shrink-0 border-t border-border bg-bg-elevated px-3 py-1 text-[11px] text-muted"
+            >
+              {i18nT('components.pierreEditorImpl.highlighting_starting_editing_available')}
+            </div>
+          ) : (
+            <div id={recoveryStatusId} className="row-start-1 shrink-0 bg-bg-elevated">
+              {/* No hand-off: the recovery textarea may hold an unsaved draft,
+                  so an agent action must not replace or navigate away from it. */}
+              <ErrorNotice
+                variant="inline"
+                className="px-3 py-1 text-[11px]"
+                message={i18nT('components.pierreEditorImpl.highlighting_restarting_editing_available')}
+              />
+            </div>
+          )}
+        </div>
+      )}
     </div>
   )
 })
diff --git a/website/src/pierre/PierreImpl.tsx b/website/src/pierre/PierreImpl.tsx
index 4864b8af512..7ac198493b1 100644
--- a/website/src/pierre/PierreImpl.tsx
+++ b/website/src/pierre/PierreImpl.tsx
@@ -5,26 +5,34 @@
  * of them resolve their options through `./config` — the single place the
  * look/behavior of code and diff rendering is decided.
  */
-import { useId, useMemo } from 'react'
+import { createPortal } from 'react-dom'
+import { useCallback, useEffect, useId, useMemo, useRef, useSyncExternalStore } from 'react'
 import type { BaseCodeOptions, FileContents, SupportedLanguages } from '@pierre/diffs'
 import { EXTENSION_TO_FILE_FORMAT, parsePatchFiles, setCustomExtension } from '@pierre/diffs'
 import { File, FileDiff, MultiFileDiff, Virtualizer, WorkerPoolContext } from '@pierre/diffs/react'
-import { getOrCreateWorkerPoolSingleton } from '@pierre/diffs/worker'
+import { WorkerPoolManager, type WorkerRequest, type WorkerResponse } from '@pierre/diffs/worker'
 import { useIsDark } from '../hooks/useIsDark'
 import { usePlainDiff } from '../hooks/usePlainDiff'
-import { PlainCodeFallback } from './PlainCodeFallback'
+import ErrorNotice from '../components/ErrorNotice'
+import { i18nT } from '../i18n/t'
+import { PlainCodeFallback, PlainFilePairFallback } from './PlainCodeFallback'
 import {
   PIERRE_EXTENSION_OVERRIDES,
   PIERRE_REGEX_ENGINE,
   PIERRE_THEMES,
   PIERRE_VIRTUALIZER_CONFIG,
+  PIERRE_WORKER_COOLDOWN_MS,
+  PIERRE_WORKER_INITIALIZATION_TIMEOUT_MS,
   PIERRE_WORKER_POOL_SIZE,
+  PIERRE_WORKER_REQUEST_TIMEOUT_MS,
+  PIERRE_WORKER_RETRY_DELAYS_MS,
+  PIERRE_WORKER_STABLE_AFTER_MS,
   pierreDiffOptions,
   pierreFileOptions,
   pierreThemeType,
   type PierreDiffOptions,
 } from './config'
-import { markWorkerPoolBroken, useWorkerPoolBroken } from './workerHealth'
+import { WorkerPoolLifecycle, type WorkerPoolSnapshot } from './workerPoolLifecycle'
 
 // Registered once, at the only module that loads the library, so every surface
 // that resolves a language from a FILENAME picks the override up. Fence tags go
@@ -231,74 +239,233 @@ export function normalizePatchHunks(patch: string): string {
   return changed ? lines.join('\n') : patch
 }
 
-/** One highlight worker pool for the whole tab, built by the first surface that
- *  actually intends to highlight and never torn down. Deliberately NOT
- *  `WorkerPoolContextProvider`: that provider terminates the shared singleton
- *  when the LAST provider unmounts, and chat surfaces live in virtualized lists
- *  where every instance can scroll out at once — remounting blocks would then
- *  queue highlights into a dead pool and paint nothing.
- *
- *  On DEMAND rather than at module scope, because the pool is not cheap: every
- *  worker spawns eagerly at init and loads its own highlighter bundle plus the
- *  WASM regex engine (see `PIERRE_WORKER_POOL_SIZE`). A module-level call
- *  charged that to anyone who merely LOADED this chunk — including a surface
- *  that then decides it wants no highlighting at all, which is exactly what
- *  plain-diff mode produces. Resolved once and memoized (including the
- *  no-Worker environments, which memoize `undefined`), so the repeated
- *  render-phase calls below stay idempotent. */
-let workerPool: ReturnType<typeof getOrCreateWorkerPoolSingleton> | undefined
-let workerPoolResolved = false
+/** Wrap one Pierre worker with request watchdogs. Pierre assigns at most one
+ *  active request to a worker, but keying timers by request ID also makes late
+ *  responses harmless and keeps the protocol contract explicit. */
+export function createMonitoredWorker(reportFailure: (reason?: unknown) => void): Worker {
+  const worker = new Worker(new URL('@pierre/diffs/worker/worker-portable.js', import.meta.url), {
+    type: 'module',
+  })
+  const watchdogs = new Map<string, ReturnType<typeof setTimeout>>()
+  const clearWatchdog = (id: string) => {
+    const timer = watchdogs.get(id)
+    if (timer !== undefined) clearTimeout(timer)
+    watchdogs.delete(id)
+  }
+  const clearWatchdogs = () => {
+    for (const timer of watchdogs.values()) clearTimeout(timer)
+    watchdogs.clear()
+  }
+
+  worker.addEventListener('message', event => {
+    const response = event.data as Partial<WorkerResponse>
+    if (typeof response.id === 'string') clearWatchdog(response.id)
+  })
+  worker.addEventListener('error', event => {
+    clearWatchdogs()
+    reportFailure(event.message || event)
+  })
+  worker.addEventListener('messageerror', () => {
+    clearWatchdogs()
+    reportFailure('worker message could not be deserialized')
+  })
+
+  const postMessage = worker.postMessage.bind(worker)
+  worker.postMessage = ((...args: Parameters<Worker['postMessage']>) => {
+    const request = args[0] as Partial<WorkerRequest>
+    // The watchdog keys on Pierre's string request IDs. If an upgrade stops
+    // sending them the watchdog silently disarms; make that loud in dev.
+    // eslint-disable-next-line no-console -- dev-only contract check, see pierre.workerProtocol.test.ts
+    if (typeof request.id !== 'string' && import.meta.env.DEV) console.warn('Pierre worker request without a string id; the request watchdog cannot monitor it.', request)
+    if (typeof request.id === 'string') {
+      clearWatchdog(request.id)
+      const timeoutMs = request.type === 'initialize'
+        ? PIERRE_WORKER_INITIALIZATION_TIMEOUT_MS
+        : PIERRE_WORKER_REQUEST_TIMEOUT_MS
+      watchdogs.set(request.id, setTimeout(() => {
+        watchdogs.delete(request.id as string)
+        reportFailure(`worker request ${request.id} (${request.type ?? 'unknown'}) timed out`)
+      }, timeoutMs))
+    }
+    try {
+      Reflect.apply(postMessage, worker, args)
+    } catch (error) {
+      if (typeof request.id === 'string') clearWatchdog(request.id)
+      reportFailure(error)
+      throw error
+    }
+  }) as Worker['postMessage']
+
+  const terminate = worker.terminate.bind(worker)
+  worker.terminate = () => {
+    clearWatchdogs()
+    terminate()
+  }
+
+  return worker
+}
+
+
+/** Snapshot for consumers that never requested a pool (plain-diff mode) and
+ *  for environments without a `Worker` API: Pierre renders on the main thread,
+ *  as it always did before worker recovery existed. */
+const unsupportedWorkerPoolSnapshot: WorkerPoolSnapshot = Object.freeze({
+  phase: 'unsupported',
+  generation: 0,
+})
+const subscribeUnsupportedWorkerPool = () => () => {}
+const getUnsupportedWorkerPoolSnapshot = () => unsupportedWorkerPoolSnapshot
+
+/** The generations a surface may hand to Pierre: a starting or ready pool, or
+ *  `null` for main-thread rendering when this environment has no workers.
+ *  `undefined` means "render app-owned plain text instead". */
+export function activeWorkerPool(state: WorkerPoolSnapshot): WorkerPoolManager | null | undefined {
+  if (state.phase === 'ready' || state.phase === 'starting') return state.pool
+  if (state.phase === 'unsupported') return null
+  return undefined
+}
+
+const passiveNoticeClaimants = new Set<symbol>()
+const passiveNoticeListeners = new Set<() => void>()
+let passiveNoticeOwner: symbol | undefined
+/** The terminal phase never exits, so the one notice is dismissible and the
+ *  dismissal is tab-wide: no surface re-raises it until reload. */
+let passiveNoticeDismissed = false
+
+function dismissPassiveNotice() {
+  passiveNoticeDismissed = true
+  for (const notify of [...passiveNoticeListeners]) notify()
+}
+
+/** Mounted editor surfaces in this tab. While one exists the passive notice
+ *  stays silent: telling a reader on a read-only surface to reload would risk
+ *  a draft they cannot see, and the editor already shows its own save-first
+ *  notice where the draft lives. The global notice returns once every editor
+ *  has unmounted. */
+const editorSurfaceIds = new Set<symbol>()
+const editorSurfaceListeners = new Set<() => void>()
+
+function subscribeEditorSurfaces(listener: () => void): () => void {
+  editorSurfaceListeners.add(listener)
+  return () => { editorSurfaceListeners.delete(listener) }
+}
+
+export function useRegisterEditorSurface(): void {
+  const id = useRef(Symbol('pierre-editor-surface')).current
+  useEffect(() => {
+    editorSurfaceIds.add(id)
+    for (const notify of [...editorSurfaceListeners]) notify()
+    return () => {
+      editorSurfaceIds.delete(id)
+      for (const notify of [...editorSurfaceListeners]) notify()
+    }
+  }, [id])
+}
+
+function subscribePassiveNotice(id: symbol, listener: () => void): () => void {
+  passiveNoticeClaimants.add(id)
+  if (passiveNoticeOwner === undefined) passiveNoticeOwner = id
+  passiveNoticeListeners.add(listener)
+  for (const notify of [...passiveNoticeListeners]) notify()
+  return () => {
+    passiveNoticeClaimants.delete(id)
+    passiveNoticeListeners.delete(listener)
+    if (passiveNoticeOwner === id) passiveNoticeOwner = passiveNoticeClaimants.values().next().value
+    for (const notify of [...passiveNoticeListeners]) notify()
+  }
+}
+
+function PierreWorkerUnavailableNotice() {
+  const id = useRef(Symbol('pierre-worker-unavailable-notice')).current
+  const subscribe = useCallback(
+    (listener: () => void) => subscribePassiveNotice(id, listener),
+    [id],
+  )
+  const ownsNotice = useSyncExternalStore(
+    subscribe,
+    () => passiveNoticeOwner === id && !passiveNoticeDismissed,
+    () => false,
+  )
+  const editorMounted = useSyncExternalStore(
+    subscribeEditorSurfaces,
+    () => editorSurfaceIds.size > 0,
+    () => false,
+  )
+  if (!ownsNotice || editorMounted || typeof document === 'undefined') return null
+  return createPortal(
+    <ErrorNotice
+      askAgent
+      onDismiss={dismissPassiveNotice}
+      className="fixed bottom-safe-offset-4 right-safe-offset-4 z-[100] w-[min(32rem,calc(100vw-2rem))] shadow-lg"
+      message={i18nT('components.pierreEditorImpl.highlighting_unavailable_content_readable_reload')}
+    />,
+    document.body,
+  )
+}
 
-function highlightWorkerPool(): typeof workerPool {
-  if (workerPoolResolved) return workerPool
-  workerPoolResolved = true
-  if (typeof window === 'undefined' || typeof Worker === 'undefined') return undefined
-  workerPool = getOrCreateWorkerPoolSingleton({
-    poolOptions: {
-      poolSize: PIERRE_WORKER_POOL_SIZE,
-      // worker-portable is the self-contained bundle: the plain worker.js
-      // entry carries bare package imports, which resolve when Rollup
-      // bundles the worker for production but NOT when the vite dev server
-      // serves it — the worker then errors at load and every surface waits
-      // on a pool that never initializes.
-      // The listeners are the ONLY error detection this pool has: the
-      // manager's own handler logs and returns, leaving the request that was
-      // in flight pending forever (see ./workerHealth). Attached here
-      // because the factory is the one place we hold the Worker object.
-      workerFactory: () => {
-        const worker = new Worker(new URL('@pierre/diffs/worker/worker-portable.js', import.meta.url), {
-          type: 'module',
-        })
-        // `error` covers both a worker that throws and a worker module that
-        // fails to load; `messageerror` covers a reply that cannot be
-        // deserialized, which strands the same request just as silently.
-        worker.addEventListener('error', event => markWorkerPoolBroken(event.message || event))
-        worker.addEventListener('messageerror', () => markWorkerPoolBroken('worker message could not be deserialized'))
-        return worker
+/** One demand-created, replaceable pool for the whole tab. A failure first
+ *  unmounts every imperative Pierre renderer into app-owned plain text, then
+ *  terminates all workers and pending requests before constructing the next
+ *  generation. Keeping construction behind the first consumer avoids charging
+ *  chunk preloads and raw patch plain-mode surfaces for worker startup. */
+let workerPoolLifecycle: WorkerPoolLifecycle | undefined
+
+function getWorkerPoolLifecycle(): WorkerPoolLifecycle {
+  if (workerPoolLifecycle !== undefined) return workerPoolLifecycle
+  workerPoolLifecycle = new WorkerPoolLifecycle({
+  create: reportFailure => {
+    const pool = new WorkerPoolManager(
+      {
+        poolSize: PIERRE_WORKER_POOL_SIZE,
+        workerFactory: () => createMonitoredWorker(reportFailure),
       },
-    },
-    highlighterOptions: { theme: PIERRE_THEMES, preferredHighlighter: PIERRE_REGEX_ENGINE },
+      { theme: PIERRE_THEMES, preferredHighlighter: PIERRE_REGEX_ENGINE },
+    )
+    return {
+      pool,
+      ready: pool.initialize(),
+      terminate: () => pool.terminate(),
+    }
+  },
+  retryDelaysMs: PIERRE_WORKER_RETRY_DELAYS_MS,
+  cooldownMs: PIERRE_WORKER_COOLDOWN_MS,
+  stableAfterMs: PIERRE_WORKER_STABLE_AFTER_MS,
+  warn: reason => {
+    // eslint-disable-next-line no-console -- plain-text recovery is user-visible; retain the root cause for diagnosis
+    console.warn('Pierre highlight worker failed; showing plain text while the worker pool recovers.', reason)
+  },
   })
-  return workerPool
+  workerPoolLifecycle.start()
+  return workerPoolLifecycle
 }
 
-/** Hands every descendant the shared pool. Exported because the editor surface
- *  lives in a sibling module and needs the same one — without it Pierre falls
- *  back to `workerManager === undefined` and tokenizes on the main thread.
- *
- *  `disabled` selects that main-thread fallback ON PURPOSE, for a surface no
- *  worker can help: a pool already known broken, or a plain (uncoloured) diff
- *  whose sides tokenize as plain text. It also means the pool is never BUILT for
- *  such a surface — the saving, not just the bypass — so a tab that only ever
- *  shows plain diffs spawns no workers at all. */
-export function PierreShell({ children, disabled }: { children: React.ReactNode; disabled?: boolean }) {
-  return (
-    <WorkerPoolContext.Provider value={disabled ? undefined : highlightWorkerPool()}>
-      {children}
-    </WorkerPoolContext.Provider>
+/** `Worker`-less environments never construct a lifecycle: there is no pool to
+ *  recover, so they read the frozen `unsupported` snapshot and render Pierre on
+ *  the main thread as they always did. */
+const workersSupported = typeof window !== 'undefined' && typeof Worker !== 'undefined'
+
+export function usePierreWorkerPool(enabled = true): WorkerPoolSnapshot {
+  const lifecycle = enabled && workersSupported ? getWorkerPoolLifecycle() : undefined
+  return useSyncExternalStore(
+    lifecycle?.subscribe ?? subscribeUnsupportedWorkerPool,
+    lifecycle?.getSnapshot ?? getUnsupportedWorkerPoolSnapshot,
+    lifecycle?.getSnapshot ?? getUnsupportedWorkerPoolSnapshot,
   )
 }
 
+/** Hands descendants the current ready generation. The key is required because
+ *  Pierre captures the manager when its imperative renderer is constructed;
+ *  changing context alone does not rebind an already-mounted instance. A `null`
+ *  pool is the `Worker`-less environment: no manager in context, so Pierre
+ *  highlights on the main thread exactly as it did before recovery existed. */
+export function PierreShell({ pool, generation, children }: {
+  pool: WorkerPoolManager | null
+  generation: number
+  children: React.ReactNode
+}) {
+  return <WorkerPoolContext.Provider key={generation} value={pool ?? undefined}>{children}</WorkerPoolContext.Provider>
+}
+
 export function PierreCodeImpl({ file, options, className, langHint, scrollClassName }: {
   file: FileContents
   options?: BaseCodeOptions
@@ -315,7 +482,8 @@ export function PierreCodeImpl({ file, options, className, langHint, scrollClass
   scrollClassName?: string
 }) {
   const dark = useIsDark()
-  const poolBroken = useWorkerPoolBroken()
+  const poolState = usePierreWorkerPool()
+  const activePool = activeWorkerPool(poolState)
   // Instance identity for churn accounting: two independently mounted blocks —
   // even with identical fence names — must never share an identity, while this
   // one instance re-rendering with streamed content must keep its own.
@@ -330,13 +498,16 @@ export function PierreCodeImpl({ file, options, className, langHint, scrollClass
       ? withLang
       : { ...withLang, cacheKey: contentCacheKey(withLang.name, withLang.contents, surfaceId + ':file') }
   }, [file, langHint, surfaceId])
-  const code = <File className={className} file={resolvedFile} options={resolved} disableWorkerPool={poolBroken} />
-  // Not gated on the plain-diff preference: this is a whole-FILE surface, and
-  // "plain diffs" is a choice about diffs. Its highlighting is also the case
-  // workers earn their keep on, so switching them off here would move the
-  // grammar work onto the main thread rather than remove it.
+  if (activePool === undefined) {
+    const fallback = <>
+      <PlainCodeFallback text={resolvedFile.contents} />
+      {poolState.phase === 'unavailable' ? <PierreWorkerUnavailableNotice /> : null}
+    </>
+    return scrollClassName ? <div className={scrollClassName}>{fallback}</div> : fallback
+  }
+  const code = <File className={className} file={resolvedFile} options={resolved} />
   return (
-    <PierreShell disabled={poolBroken}>
+    <PierreShell pool={activePool} generation={poolState.generation}>
       {scrollClassName
         ? <Virtualizer config={PIERRE_VIRTUALIZER_CONFIG} className={scrollClassName}>{code}</Virtualizer>
         : code}
@@ -358,7 +529,8 @@ export function PierrePatchImpl({ patch, options, className, renderHeaderMetadat
     () => pierreDiffOptions({ themeType: pierreThemeType(dark), ...options }),
     [dark, options],
   )
-  const poolBroken = useWorkerPoolBroken()
+  const poolState = usePierreWorkerPool()
+  const activePool = activeWorkerPool(poolState)
   // Parse here rather than using <PatchDiff>: that component ASSERTS exactly
   // one complete file diff and throws otherwise, but chat patches stream
   // through partial frames (bare headers, unterminated hunks) and may carry
@@ -390,21 +562,25 @@ export function PierrePatchImpl({ patch, options, className, renderHeaderMetadat
   // future unparseable shape readable instead of blank.
   const noHunks = files.length > 0 && files.every(f => (f.hunks?.length ?? 0) === 0)
   const looksLikeChanges = /^[+-](?![+-][+-] )/m.test(patch)
-  if (files.length === 0 || (noHunks && looksLikeChanges)) return <PlainCodeFallback text={patch} />
-  // No plain-diff gate needed: `PierrePatch` returns the raw patch text before
-  // it ever requests this chunk in that mode, so reaching here means colour is
-  // on. That early return is the strongest form of the saving — the module, the
-  // pool and the workers are all skipped — and is why the gate below lives on
-  // the file-PAIR surface, which has no raw patch to fall back to.
+  if (files.length === 0 || (noHunks && looksLikeChanges)) {
+    return <PlainCodeFallback text={patch} />
+  }
+  if (activePool === undefined) {
+    // No header actions in the fallback (`max-two-buttons-per-row`); they
+    // return with Pierre's own header when a generation is ready.
+    return <>
+      <PlainCodeFallback text={patch} />
+      {poolState.phase === 'unavailable' ? <PierreWorkerUnavailableNotice /> : null}
+    </>
+  }
   return (
-    <PierreShell disabled={poolBroken}>
+    <PierreShell pool={activePool} generation={poolState.generation}>
       {files.map((fileDiff, i) => (
         <FileDiff
           key={`${fileDiff.name ?? ''}:${i}`}
           className={className}
           fileDiff={fileDiff}
           options={resolved}
-          disableWorkerPool={poolBroken}
           renderHeaderMetadata={i === 0 && renderHeaderMetadata ? renderHeaderMetadata : undefined}
           renderHeaderPrefix={i === 0 ? renderHeaderPrefix : undefined}
           renderHeaderFilenameSuffix={i === 0 ? renderHeaderFilenameSuffix : undefined}
@@ -414,10 +590,13 @@ export function PierrePatchImpl({ patch, options, className, renderHeaderMetadat
   )
 }
 
-export function PierreFilePairImpl({ oldFile, newFile, options, className, renderHeaderMetadata, renderHeaderPrefix, renderHeaderFilenameSuffix }: {  oldFile: FileContents | null
+export function PierreFilePairImpl({ oldFile, newFile, options, className, fallbackClassName, fallbackContentStyle, renderHeaderMetadata, renderHeaderPrefix, renderHeaderFilenameSuffix }: {
+  oldFile: FileContents | null
   newFile: FileContents | null
   options?: PierreDiffOptions
   className?: string
+  fallbackClassName?: string
+  fallbackContentStyle?: React.CSSProperties
   /** Injected into the file header's metadata slot (light DOM, so outer-tree
    *  styling and hover reveals apply). Rendered in the collapsed state too —
    *  a collapsed diff is header-only, which is what makes it a usable row. */
@@ -434,24 +613,10 @@ export function PierreFilePairImpl({ oldFile, newFile, options, className, rende
     () => pierreDiffOptions({ themeType: pierreThemeType(dark), ...options }),
     [dark, options],
   )
-  const poolBroken = useWorkerPoolBroken()
   const [plain] = usePlainDiff()
-  // Plain mode (Settings → Chat → Messages → Plain diffs) reaches this surface
-  // too, but it cannot arrive the way it does at `PierrePatch`: a file PAIR is
-  // handed two bodies and no patch, so the diff still has to be COMPUTED here —
-  // printing raw text would mean implementing a diff algorithm, which is not a
-  // rendering choice. What plain mode drops instead is the colour: both sides
-  // are declared `text`, Pierre's plaintext grammar, so the rows, gutters and ±
-  // markers all survive and only the tokenization goes away.
-  //
-  // Which is also why the workers go with it rather than merely being bypassed.
-  // Plain text has nothing to tokenize, so a worker would be spawned to do no
-  // work — and `disabled` here means the pool is never CONSTRUCTED, so a tab
-  // whose only Pierre surfaces are plain diffs pays for no workers at all. Note
-  // this is the opposite reasoning from `disableWorkerPool={poolBroken}`, which
-  // moves REAL grammar work to the main thread as a last resort.
-  const noWorkers = plain || poolBroken
   const plainLang: SupportedLanguages | undefined = plain ? 'text' : undefined
+  const poolState = usePierreWorkerPool(!plain)
+  const activePool = activeWorkerPool(poolState)
   // MultiFileDiff requires at least one populated side; both-null cannot
   // happen from our call sites (DiffPanel banners the identical case away and
   // new/deleted files carry one side), but the type demands the narrowing.
@@ -474,9 +639,39 @@ export function PierreFilePairImpl({ oldFile, newFile, options, className, rende
     : keyedOld
       ? { oldFile: keyedOld, newFile: null }
       : { oldFile: null, newFile: keyedNew as FileContents })
+  if (plain) {
+    return (
+      <MultiFileDiff
+        className={className}
+        {...input}
+        options={resolved}
+        renderHeaderMetadata={renderHeaderMetadata}
+        renderHeaderPrefix={renderHeaderPrefix}
+        renderHeaderFilenameSuffix={renderHeaderFilenameSuffix}
+      />
+    )
+  }
+  if (activePool === undefined) {
+    return (
+      <>
+        <PlainFilePairFallback
+          oldFile={keyedOld}
+          newFile={keyedNew}
+          options={resolved}
+          geometry="pierre-swap"
+          className={fallbackClassName}
+          contentStyle={fallbackContentStyle}
+          renderHeaderMetadata={renderHeaderMetadata}
+          renderHeaderPrefix={renderHeaderPrefix}
+          renderHeaderFilenameSuffix={renderHeaderFilenameSuffix}
+        />
+        {poolState.phase === 'unavailable' ? <PierreWorkerUnavailableNotice /> : null}
+      </>
+    )
+  }
   return (
-    <PierreShell disabled={noWorkers}>
-      <MultiFileDiff className={className} {...input} options={resolved} disableWorkerPool={noWorkers} renderHeaderMetadata={renderHeaderMetadata} renderHeaderPrefix={renderHeaderPrefix} renderHeaderFilenameSuffix={renderHeaderFilenameSuffix} />
+    <PierreShell pool={activePool} generation={poolState.generation}>
+      <MultiFileDiff className={className} {...input} options={resolved} renderHeaderMetadata={renderHeaderMetadata} renderHeaderPrefix={renderHeaderPrefix} renderHeaderFilenameSuffix={renderHeaderFilenameSuffix} />
     </PierreShell>
   )
 }
diff --git a/website/src/pierre/PlainCodeFallback.tsx b/website/src/pierre/PlainCodeFallback.tsx
index 32b9570d975..71aa096f476 100644
--- a/website/src/pierre/PlainCodeFallback.tsx
+++ b/website/src/pierre/PlainCodeFallback.tsx
@@ -10,31 +10,37 @@ import { useLanguageGeneration } from '../i18n/useLanguageGeneration'
 /** Plain-text stand-in used while the Pierre chunk loads and for patch text
  *  that does not (yet) parse — e.g. the partial frames of a streaming diff.
  *
- *  Pierre's own geometry, MEASURED from a rendered block (7 blocks, heights
- *  exactly 50 + 20×lines): 2px border, 32px header, 16px body padding, 20px per
- *  line. The stand-in has to match all of it, or the swap moves the reader.
+ *  Pierre's own geometry is 2px border, 32px header, 16px body padding, and
+ *  20px per line. `pierre-plain` wins the transcript's more-specific `<pre>`
+ *  rule so a fallback-to-Pierre swap does not move the reader.
  *
- *  `leading-5` and `py-2` say 20px and 8px — and inside a transcript they were
- *  BOTH LOSING: `.msg-content pre` (specificity 0,1,1) beats a single-class
- *  utility and sets `line-height:1.5` (19.5px at 13px) with `padding:10px 12px`.
- *  The stand-in therefore rendered 4px taller per surface than the thing it
- *  stands in for, and the reader was displaced by 12-36px per transcript row the
- *  moment the chunk resolved (measured in a browser: -4px on every
- *  `.pierre-surface`, three code blocks in one row = -36px). `pierre-plain` is
- *  the hook that wins that fight; the metrics live in index.css next to the rule
- *  they have to beat. Keep the two geometries equal or the reflow returns.
- *
- *  Also the FINAL render for patch surfaces when the plain-diff preference is
- *  on (see `usePlainDiff`), which is why it accepts the caller's `className`:
- *  in that mode it stands in for the Pierre element the class was written for.
- *  The geometry above still has to hold there — the preference can flip while a
- *  transcript is on screen, so this element replaces a Pierre surface in place.
+ *  This is also the final patch render when plain-diff mode is enabled, so it
+ *  preserves a caller class. Recovery and file-pair loading additionally use
+ *  the optional header; a collapsed pair renders the header row alone.
  */
-export function PlainCodeFallback({ text, className }: { text: string; className?: string }) {
+export function PlainCodeFallback({ text, className, contentStyle, header }: {
+  text: string
+  className?: string
+  contentStyle?: CSSProperties
+  header?: ReactNode
+}) {
   return (
-    <pre className={`pierre-plain m-0 px-3 py-2 overflow-x-auto text-[13px] font-mono leading-5 whitespace-pre${className ? ` ${className}` : ''}`}>
-      {text}
-    </pre>
+    <>
+      {header != null ? <PlainFallbackHeader>{header}</PlainFallbackHeader> : null}
+      <pre style={contentStyle} className={`pierre-plain m-0 px-3 py-2 overflow-x-auto text-[13px] font-mono leading-5 whitespace-pre${className ? ` ${className}` : ''}`}>
+        {text}
+      </pre>
+    </>
+  )
+}
+
+/** The header row shared by the fallbacks, sized to Pierre's own header so a
+ *  swap does not move the layout. A collapsed pair is this row alone. */
+function PlainFallbackHeader({ children }: { children: ReactNode }) {
+  return (
+    <div data-diffs-header="" className="flex min-h-9 items-center justify-end gap-1 border-b border-border px-2 py-1">
+      {children}
+    </div>
   )
 }
 
@@ -44,6 +50,8 @@ interface PlainFilePairFallbackProps {
   oldFile: FileContents | null
   newFile: FileContents | null
   options?: PierreDiffOptions
+  geometry?: 'simplified' | 'pierre-swap'
+  text?: string
   className?: string
   contentStyle?: CSSProperties
   renderHeaderMetadata?: () => ReactNode
@@ -66,6 +74,8 @@ export function PlainFilePairFallback({
   oldFile,
   newFile,
   options,
+  geometry = 'simplified',
+  text,
   className,
   contentStyle,
   renderHeaderMetadata,
@@ -116,6 +126,27 @@ export function PlainFilePairFallback({
   const collapsed = options?.collapsed === true
   const filePairLabel = span != null && !collapsed ? changeRegionLabel : simplifiedLabel
   const wraps = options?.overflow === 'wrap'
+
+  if (geometry === 'pierre-swap') {
+    const oldMarker = '-'.repeat(3)
+    const newMarker = '+'.repeat(3)
+    const fallbackText = text ?? (oldFile && newFile
+      ? `${oldMarker} ${oldFile.name}\n${oldFile.contents}\n${newMarker} ${newFile.name}\n${newFile.contents}`
+      : (newFile ?? oldFile)?.contents ?? '')
+    // Prefix, filename and suffix keep the header's geometry and click
+    // selectors; the action cluster (`renderHeaderMetadata`) is left to
+    // Pierre's real header — it can be three buttons, and a diff-added row of
+    // three is barred by `max-two-buttons-per-row`.
+    const header = options?.disableFileHeader === false ? (
+      <>
+        {renderHeaderPrefix?.()}
+        <span data-title="" className="min-w-0 flex-1 truncate">{filename}</span>
+        {renderHeaderFilenameSuffix?.()}
+      </>
+    ) : undefined
+    if (options?.collapsed === true) return header != null ? <PlainFallbackHeader>{header}</PlainFallbackHeader> : null
+    return <PlainCodeFallback text={fallbackText} className={className} contentStyle={contentStyle} header={header} />
+  }
   const sides = [
     oldFile == null ? null : { file: oldFile, lines: oldLines, marker: '−', key: 'old' as const, start: span?.oldStart, end: span?.oldEnd },
     newFile == null ? null : { file: newFile, lines: newLines, marker: '+', key: 'new' as const, start: span?.newStart, end: span?.newEnd },
diff --git a/website/src/pierre/config.ts b/website/src/pierre/config.ts
index 1d753a75730..34ce82688ab 100644
--- a/website/src/pierre/config.ts
+++ b/website/src/pierre/config.ts
@@ -110,10 +110,23 @@ export const PIERRE_WORKER_POOL_SIZE = 4
  * fully changed lines at ~20 ms on a normal host, leaving headroom under a
  * 100 ms long-task budget at 4x CPU slowdown; 1,000 lines already takes ~120 ms
  * before React rendering or highlighting. The UTF-16 code-unit ceiling is cheap
- * enough to run while editing and bounds wide JavaScript strings before a broken
- * worker pool can move Shiki onto that thread. */
+ * enough to run while editing and bounds unusually wide JavaScript strings. */
 export const PIERRE_FILE_PAIR_MAX_LINES_PER_SIDE = 400
 export const PIERRE_FILE_PAIR_MAX_TOTAL_CODE_UNITS = 128 * 1024
+
+/** Worker bootstrap loads WASM, themes, and languages and gets a wider budget
+ * than ordinary render requests so a slow cold host does not exhaust recovery. */
+export const PIERRE_WORKER_INITIALIZATION_TIMEOUT_MS = 120_000
+
+/** A worker receives one render request at a time. If it has not answered within
+ * this window, recycle the complete manager so sibling requests cannot queue. */
+export const PIERRE_WORKER_REQUEST_TIMEOUT_MS = 30_000
+
+/** Short retries cover transient crashes; repeated failures open a cooldown. */
+export const PIERRE_WORKER_RETRY_DELAYS_MS = [250, 1_000] as const
+export const PIERRE_WORKER_COOLDOWN_MS = 30_000
+export const PIERRE_WORKER_STABLE_AFTER_MS = 60_000
+
 /** Which regex engine the highlight workers tokenize with.
  *
  *  Pierre defaults to `shiki-js`, which runs TextMate grammar patterns through
diff --git a/website/src/pierre/index.tsx b/website/src/pierre/index.tsx
index de75b45483f..c0e8cc043f2 100644
--- a/website/src/pierre/index.tsx
+++ b/website/src/pierre/index.tsx
@@ -12,7 +12,7 @@
  * user has turned off highlighted diffs (see `usePlainDiff`), which is why the
  * fallback component is a real surface here rather than a loading state.
  */
-import { Suspense, forwardRef, lazy, memo, type CSSProperties, useContext, useEffect, useRef, useState } from 'react'
+import { Suspense, createContext, forwardRef, lazy, memo, type CSSProperties, useContext, useEffect, useRef, useState } from 'react'
 import type { BaseCodeOptions, FileContents } from '@pierre/diffs'
 import type { PierreDiffOptions } from './config'
 import type { EditorMarker, PierreEditorHandle } from './PierreEditorImpl'
@@ -171,6 +171,20 @@ function warmKeyOf(text: string): string {
   return `${text.length}:${(h >>> 0).toString(36)}`
 }
 
+/** Whether the nearest WarmSwap has revealed its children. `true` outside any
+ *  WarmSwap, so a bare surface keeps its ordinary Suspense fallback. */
+const WarmSwapRevealedContext = createContext(true)
+
+/** Suspense for the impl under a WarmSwap. While the WarmSwap still shows its
+ *  own fallback the inner fallback is `null`: a second copy of the text would
+ *  duplicate content for transcript search and its height would look like a
+ *  paint. Once revealed — by paint or by the deadline fail-safe — the fallback
+ *  is real, so a chunk that outlives the deadline shows plain text, not blank. */
+function StagedSuspense({ fallback, children }: { fallback: React.ReactNode; children: React.ReactNode }) {
+  const revealed = useContext(WarmSwapRevealedContext)
+  return <Suspense fallback={revealed ? fallback : null}>{children}</Suspense>
+}
+
 /**
  * Keeps a readable fallback ON SCREEN while the Pierre impl mounts and its
  * async highlight runs, swapping only once the impl has real painted height.
@@ -253,7 +267,7 @@ function WarmSwap({ fallback, children, warmKey, onVisible }: {
         className={painted ? undefined : 'absolute inset-0 overflow-hidden invisible'}
         aria-hidden={painted ? undefined : true}
       >
-        {children}
+        <WarmSwapRevealedContext.Provider value={painted}>{children}</WarmSwapRevealedContext.Provider>
       </div>
       {!painted && fallback}
     </div>
@@ -271,21 +285,26 @@ export const PierreCode = memo(function PierreCode({ file, options, className, l
    *  must then NOT scroll. */
   scrollClassName?: string
 }) {
-  const impl = (
-    <Suspense fallback={
-      /* The fallback carries the same scroll classes, so the pre-chunk text
-         scrolls in the same box and the layout does not shift when the chunk
-         resolves. */
-      <div className={scrollClassName}><PlainCodeFallback text={file.contents} /></div>
-    }>
-      <CodeImpl file={file} options={options} className={className} langHint={langHint} scrollClassName={scrollClassName} />
-    </Suspense>
+  // Whole-file surfaces own their scroll container and cannot be wrapped in
+  // an invisible measurement box, so they retain a direct Suspense fallback.
+  if (scrollClassName) {
+    return (
+      <Suspense fallback={<div className={scrollClassName}><PlainCodeFallback text={file.contents} /></div>}>
+        <CodeImpl file={file} options={options} className={className} langHint={langHint} scrollClassName={scrollClassName} />
+      </Suspense>
+    )
+  }
+  // WarmSwap owns the visible fallback while it stages; StagedSuspense keeps
+  // the hidden impl from duplicating that text, then supplies its own once the
+  // surface is revealed so a slow chunk never shows blank.
+  const fallback = <PlainCodeFallback text={file.contents} />
+  return (
+    <WarmSwap warmKey={warmKeyOf(file.contents)} fallback={fallback}>
+      <StagedSuspense fallback={fallback}>
+        <CodeImpl file={file} options={options} className={className} langHint={langHint} />
+      </StagedSuspense>
+    </WarmSwap>
   )
-  // Whole-file surfaces (scrollClassName) own their scroll container and are
-  // windowed by Pierre itself; wrapping them in an invisible box would break
-  // that measurement, so only snippet surfaces warm-swap.
-  if (scrollClassName) return impl
-  return <WarmSwap warmKey={warmKeyOf(file.contents)} fallback={<PlainCodeFallback text={file.contents} />}>{impl}</WarmSwap>
 })
 
 export const PierrePatch = memo(function PierrePatch({ patch, options, className, renderHeaderMetadata }: {
@@ -312,12 +331,16 @@ export const PierrePatch = memo(function PierrePatch({ patch, options, className
   // print raw and the diff still has to be computed inside the chunk. It drops
   // the colour and the workers instead — see `PierreFilePairImpl`.
   const [plain] = usePlainDiff()
+  // The fallback carries no header actions: the caller's cluster can be three
+  // buttons, and a diff-added row of three is barred (`max-two-buttons-per-row`).
+  // Pierre's own header carries them, exactly as on main.
   if (plain) return <PlainCodeFallback text={patch} className={className} />
+  const fallback = <PlainCodeFallback text={patch} />
   return (
-    <WarmSwap warmKey={warmKeyOf(patch)} fallback={<PlainCodeFallback text={patch} />}>
-      <Suspense fallback={<PlainCodeFallback text={patch} />}>
+    <WarmSwap warmKey={warmKeyOf(patch)} fallback={fallback}>
+      <StagedSuspense fallback={fallback}>
         <PatchImpl patch={patch} options={options} className={className} renderHeaderMetadata={renderHeaderMetadata} />
-      </Suspense>
+      </StagedSuspense>
     </WarmSwap>
   )
 })
@@ -460,23 +483,34 @@ export const PierreFilePair = memo(function PierreFilePair({ oldFile, newFile, o
   }
 
   const fallbackNode = (
-    <PlainCodeFallback
-      text={fallbackText ?? (newFile ?? oldFile)?.contents ?? ''}
+    <PlainFilePairFallback
+      oldFile={oldFile}
+      newFile={newFile}
+      options={options}
+      geometry="pierre-swap"
+      text={fallbackText}
       className={fallbackClassName}
+      renderHeaderMetadata={renderHeaderMetadata}
+      renderHeaderPrefix={renderHeaderPrefix}
+      renderHeaderFilenameSuffix={renderHeaderFilenameSuffix}
     />
   )
+  // Collapsed pairs render outside WarmSwap, where StagedSuspense is always
+  // revealed and behaves as a plain Suspense with the fallback.
   const impl = (
-    <Suspense fallback={fallbackNode}>
+    <StagedSuspense fallback={fallbackNode}>
       <FilePairImpl
         oldFile={oldFile}
         newFile={newFile}
         options={options}
         className={className}
+        fallbackClassName={fallbackClassName}
+        fallbackContentStyle={fallbackContentStyle}
         renderHeaderMetadata={renderHeaderMetadata}
         renderHeaderPrefix={renderHeaderPrefix}
         renderHeaderFilenameSuffix={renderHeaderFilenameSuffix}
       />
-    </Suspense>
+    </StagedSuspense>
   )
 
   // A collapsed pair renders ONLY its header (~32px) — under the paint
diff --git a/website/src/pierre/workerHealth.ts b/website/src/pierre/workerHealth.ts
deleted file mode 100644
index 71af4187739..00000000000
--- a/website/src/pierre/workerHealth.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-/**
- * Health signal for the shared Shiki highlight worker pool.
- *
- * `@pierre/diffs`' WorkerPoolManager handles a worker `error` event by logging
- * it and nothing else — the pending highlight request is never rejected, the
- * worker is never respawned, and no request carries a timeout. A worker that
- * dies (or a worker module that fails to LOAD, which also fires `error` on the
- * Worker object) therefore leaves every queued highlight pending forever, and
- * a Pierre surface that is waiting on one paints no rows at all. In chat that
- * shows up as a code block rendered down to its language header with an empty
- * body — the text is still in the DOM-free `code` prop, so Copy works while
- * nothing is visible.
- *
- * We own the `workerFactory`, so we own error detection: the factory reports
- * here, and every mounted surface re-renders with `disableWorkerPool`, which
- * makes Pierre tokenize on the main thread instead. Slower on a huge file, but
- * it paints — and it recovers the already-empty blocks rather than only the
- * next one, because the re-render re-initializes their `<File>` instances.
- *
- * One-way on purpose: a pool that has dropped a worker mid-session is not
- * observably healthy again (the manager keeps no per-worker readiness we can
- * read), so flipping back would risk a second silent blank. A reload restores
- * the worker path.
- */
-import { useSyncExternalStore } from 'react'
-
-let broken = false
-const listeners = new Set<() => void>()
-
-export function isWorkerPoolBroken(): boolean {
-  return broken
-}
-
-/** Record that the highlight worker pool can no longer be trusted. Idempotent:
- *  a pool of N workers can fire N error events for one root cause, and only the
- *  first needs to warn or notify. */
-export function markWorkerPoolBroken(reason?: unknown): void {
-  if (broken) return
-  broken = true
-  // Deliberately loud: the pre-existing behavior of this failure was a silently
-  // blank code block, which is the thing that made it hard to diagnose.
-  // eslint-disable-next-line no-console -- failure diagnostic; the fallback below is the user-visible part
-  console.warn(
-    'Pierre highlight worker failed; falling back to main-thread tokenization for code and diff surfaces.',
-    reason,
-  )
-  for (const listener of listeners) listener()
-}
-
-function subscribe(onChange: () => void): () => void {
-  listeners.add(onChange)
-  return () => {
-    listeners.delete(onChange)
-  }
-}
-
-/** Subscribe a Pierre surface to the pool's health. Returns the value to pass
- *  as `disableWorkerPool`. */
-export function useWorkerPoolBroken(): boolean {
-  return useSyncExternalStore(subscribe, isWorkerPoolBroken, isWorkerPoolBroken)
-}
diff --git a/website/src/pierre/workerPoolLifecycle.ts b/website/src/pierre/workerPoolLifecycle.ts
new file mode 100644
index 00000000000..3094f2409c0
--- /dev/null
+++ b/website/src/pierre/workerPoolLifecycle.ts
@@ -0,0 +1,159 @@
+import type { WorkerPoolManager } from '@pierre/diffs/worker'
+
+/** `unsupported`: this environment has no `Worker` API, so Pierre renders on
+ *  the main thread exactly as before this lifecycle existed — there is no pool
+ *  to recover. `unavailable`: workers exist but every recovery attempt failed,
+ *  so surfaces stay in app-owned plain text until reload. */
+export type WorkerPoolPhase = 'unsupported' | 'unavailable' | 'starting' | 'ready' | 'recovering'
+
+export interface WorkerPoolSnapshot {
+  phase: WorkerPoolPhase
+  generation: number
+  pool?: WorkerPoolManager
+}
+
+export interface WorkerPoolHandle {
+  pool: WorkerPoolManager
+  ready: Promise<void>
+  terminate: () => void
+}
+
+export interface WorkerPoolLifecycleOptions {
+  create: (reportFailure: (reason?: unknown) => void) => WorkerPoolHandle
+  retryDelaysMs: readonly number[]
+  cooldownMs: number
+  stableAfterMs: number
+  warn?: (reason?: unknown) => void
+}
+
+/**
+ * Owns one replaceable Pierre worker pool.
+ *
+ * A generation is retired as one unit: subscribers first switch to app-owned
+ * plain text, then every worker and pending request in the old manager is
+ * terminated. The manager's initialization promise is the readable readiness
+ * boundary the old per-worker sticky latch lacked, so replacements publish
+ * `ready` only after the complete generation initializes. That readable boundary
+ * is why recovery owns replaceable manager generations instead of restoring the
+ * simpler sticky `disableWorkerPool` latch, which cannot rebind mounted renderers.
+ * Late events carry
+ * their generation and cannot retire a newer pool. Repeated startup failures use short retries followed by a cooldown so
+ * a broken worker bundle cannot churn indefinitely.
+ */
+export class WorkerPoolLifecycle {
+  private readonly listeners = new Set<() => void>()
+  private snapshot: WorkerPoolSnapshot
+  private handle: WorkerPoolHandle | undefined
+  private timer: ReturnType<typeof setTimeout> | undefined
+  private stabilityTimer: ReturnType<typeof setTimeout> | undefined
+  private consecutiveFailures = 0
+  private warned = false
+  private attemptingGeneration: number | undefined
+
+  constructor(private readonly options: WorkerPoolLifecycleOptions) {
+    this.snapshot = { phase: 'starting', generation: 0 }
+  }
+
+  getSnapshot = (): WorkerPoolSnapshot => this.snapshot
+
+  subscribe = (listener: () => void): (() => void) => {
+    this.listeners.add(listener)
+    return () => { this.listeners.delete(listener) }
+  }
+
+  start(): void {
+    if (this.handle || this.timer) return
+    this.beginAttempt()
+  }
+
+  reportFailure(generation: number, reason?: unknown): void {
+    if (generation !== this.snapshot.generation) return
+    const attemptActive = this.attemptingGeneration === generation
+    if (this.snapshot.phase !== 'ready' && !attemptActive) return
+    this.attemptingGeneration = undefined
+    if (this.stabilityTimer !== undefined) {
+      clearTimeout(this.stabilityTimer)
+      this.stabilityTimer = undefined
+    }
+
+    this.consecutiveFailures += 1
+    const retryIndex = this.consecutiveFailures - 1
+    const inCooldown = retryIndex === this.options.retryDelaysMs.length
+    const exhausted = retryIndex > this.options.retryDelaysMs.length
+
+    if (!this.warned) {
+      this.warned = true
+      this.options.warn?.(reason)
+    }
+    this.publish({
+      phase: exhausted ? 'unavailable' : 'recovering',
+      generation,
+    })
+
+    // Publishing first makes mounted imperative Pierre instances unmount into
+    // readable plain text before termination rejects their pending work. React
+    // commits an external-store update in a microtask, so the terminate waits
+    // for a macrotask boundary: every microtask queued by `publish` — whatever
+    // order React enqueued it in — has run before the old workers are gone.
+    const handle = this.handle
+    this.handle = undefined
+    setTimeout(() => handle?.terminate(), 0)
+
+    // One half-open attempt follows the cooldown. If it also fails, remain in
+    // app-owned plain text until reload instead of spawning workers forever.
+    if (exhausted) return
+    const delayMs = inCooldown
+      ? this.options.cooldownMs
+      : this.options.retryDelaysMs[retryIndex]
+    this.timer = setTimeout(() => {
+      this.timer = undefined
+      if (generation === this.snapshot.generation) this.beginAttempt()
+    }, delayMs)
+  }
+
+  private beginAttempt(): void {
+    const generation = this.snapshot.generation + 1
+    this.attemptingGeneration = generation
+    this.publish({ phase: generation === 1 ? 'starting' : 'recovering', generation })
+
+    let handle: WorkerPoolHandle
+    let failedDuringCreate = false
+    try {
+      handle = this.options.create(reason => {
+        failedDuringCreate = true
+        this.reportFailure(generation, reason)
+      })
+    } catch (error) {
+      this.reportFailure(generation, error)
+      return
+    }
+    if (failedDuringCreate || generation !== this.snapshot.generation) {
+      handle.terminate()
+      return
+    }
+    this.handle = handle
+    if (generation === 1) this.publish({ phase: 'starting', generation, pool: handle.pool })
+
+    void handle.ready.then(() => {
+      if (generation !== this.snapshot.generation || this.handle !== handle) return
+      this.attemptingGeneration = undefined
+      this.publish({ phase: 'ready', generation, pool: handle.pool })
+      if (this.consecutiveFailures > 0) {
+        this.stabilityTimer = setTimeout(() => {
+          this.stabilityTimer = undefined
+          if (generation === this.snapshot.generation && this.snapshot.phase === 'ready') {
+            this.consecutiveFailures = 0
+            this.warned = false
+          }
+        }, this.options.stableAfterMs)
+      }
+    }).catch(error => {
+      this.reportFailure(generation, error)
+    })
+  }
+
+  private publish(snapshot: WorkerPoolSnapshot): void {
+    this.snapshot = snapshot
+    for (const listener of [...this.listeners]) listener()
+  }
+}
diff --git a/website/src/test/PierreEditorImpl.test.tsx b/website/src/test/PierreEditorImpl.test.tsx
index 12ef8697701..f173feb56e4 100644
--- a/website/src/test/PierreEditorImpl.test.tsx
+++ b/website/src/test/PierreEditorImpl.test.tsx
@@ -68,6 +68,13 @@ const pierre = vi.hoisted(() => {
     FakeEditor,
     factory: { current: null as null | ((o: Record<string, unknown>) => FakeEditor) },
     surfaces: [] as { kind: 'file' | 'diff'; props: Record<string, unknown> }[],
+    poolState: {
+      current: { phase: 'ready', generation: 1, pool: {} } as {
+        phase: 'ready' | 'recovering' | 'starting' | 'cooldown' | 'unavailable'
+        generation: number
+        pool?: object
+      },
+    },
   }
 })
 
@@ -108,7 +115,20 @@ vi.mock('@pierre/diffs/react', async () => {
   }
 })
 
-import { PierreEditorImpl, type PierreEditorHandle } from '../pierre/PierreEditorImpl'
+vi.mock('../pierre/PierreImpl', async () => {
+  const { activeWorkerPool, contentCacheKey } = await vi.importActual<typeof import('../pierre/PierreImpl')>('../pierre/PierreImpl')
+  return {
+    activeWorkerPool,
+    contentCacheKey,
+    PierreShell: ({ children, generation }: { children?: ReactNode; generation: number }) => (
+      <div key={generation}>{children}</div>
+    ),
+    usePierreWorkerPool: () => pierre.poolState.current,
+    useRegisterEditorSurface: () => {},
+  }
+})
+
+import { PierreEditorImpl, type EditorMarker, type PierreEditorHandle } from '../pierre/PierreEditorImpl'
 import { contentCacheKey } from '../pierre/PierreImpl'
 
 const FILE: FileContents = {
@@ -172,6 +192,7 @@ beforeEach(() => {
   pierre.surfaces.length = 0
   pierre.editors.length = 0
   pierre.factory.current = null
+  pierre.poolState.current = { phase: 'ready', generation: 1, pool: {} }
   document.documentElement.removeAttribute('data-theme')
 })
 
@@ -303,6 +324,161 @@ describe('PierreEditorImpl surface selection', () => {
     expect(pierre.surfaces.length).toBeGreaterThan(2)
     expect(lastSurface().props.editorOptions).toBe(first)
   })
+
+  it('keeps active Pierre file props stable for ref-backed callers', () => {
+    mount()
+    const surfaceCount = pierre.surfaces.length
+    const renderedFile = lastSurface().props.file
+    const editor = attachEditor()
+    const announceChange = editor.options.onChange as (file: FileContents) => void
+
+    act(() => announceChange({ ...FILE, contents: 'const localOnly = true\n' }))
+
+    expect(pierre.surfaces).toHaveLength(surfaceCount)
+    expect(lastSurface().props.file).toBe(renderedFile)
+  })
+})
+
+
+  it('preserves the latest in-memory draft across worker recovery and later edits', () => {
+    const mounted = mount()
+    const editor = attachEditor()
+    const announceChange = editor.options.onChange as (file: FileContents) => void
+
+    act(() => announceChange({ ...FILE, contents: 'const unsaved = true\n' }))
+    pierre.poolState.current = { phase: 'recovering', generation: 1 }
+    mounted.rerender()
+    expect(mounted.view.container).toHaveTextContent('const unsaved = true')
+
+    pierre.poolState.current = { phase: 'ready', generation: 2, pool: {} }
+    mounted.rerender()
+    const remountedFile = lastSurface().props.file as FileContents
+    expect(remountedFile.contents).toBe('const unsaved = true\n')
+
+    // Typing in the replacement editor must not rewrite Pierre's `file` input
+    // on every keystroke (the buffer owns the text mid-edit, as on main) …
+    const replacement = attachEditor()
+    const announceReplacementChange = replacement.options.onChange as (file: FileContents) => void
+    act(() => announceReplacementChange({ ...FILE, contents: 'const afterRecovery = true\n' }))
+    mounted.rerender()
+    expect(lastSurface().props.file).toBe(remountedFile)
+
+    // … yet a second failure still carries those edits into the fallback and
+    // back into the next generation.
+    pierre.poolState.current = { phase: 'recovering', generation: 2 }
+    mounted.rerender()
+    expect(mounted.view.getByRole('textbox')).toHaveValue('const afterRecovery = true\n')
+    pierre.poolState.current = { phase: 'ready', generation: 3, pool: {} }
+    mounted.rerender()
+    expect((lastSurface().props.file as FileContents).contents).toBe('const afterRecovery = true\n')
+  })
+
+  it('renders Pierre on the main thread when the environment has no Worker API', () => {
+    pierre.poolState.current = { phase: 'unsupported', generation: 0 }
+    const mounted = mount()
+    expect(mounted.view.queryByRole('textbox')).toBeNull()
+    expect(mounted.view.queryByRole('alert')).toBeNull()
+    expect(lastSurface().kind).toBe('file')
+  })
+
+
+it('keeps the app-owned recovery editor editable without main-thread highlighting', () => {
+  const mounted = mount()
+  pierre.poolState.current = { phase: 'recovering', generation: 1 }
+  mounted.rerender()
+
+  const fallback = mounted.view.getByRole('textbox', { name: FILE.name })
+  fireEvent.change(fallback, { target: { value: 'const firstRecoveryEdit = true\n' } })
+  expect(fallback).toHaveValue('const firstRecoveryEdit = true\n')
+  fireEvent.change(fallback, { target: { value: 'const secondRecoveryEdit = true\n' } })
+  expect(fallback).toHaveValue('const secondRecoveryEdit = true\n')
+  expect(mounted.onChange).toHaveBeenLastCalledWith('const secondRecoveryEdit = true\n')
+
+  pierre.poolState.current = { phase: 'ready', generation: 2, pool: {} }
+  mounted.rerender()
+  expect((lastSurface().props.file as FileContents).contents).toBe('const secondRecoveryEdit = true\n')
+})
+it('keeps long recovery text vertically scrollable', () => {
+  const mounted = mount({ file: { ...FILE, contents: Array.from({ length: 200 }, (_, i) => `line ${i}`).join('\n') } })
+  pierre.poolState.current = { phase: 'recovering', generation: 1 }
+  mounted.rerender()
+
+  const fallback = mounted.view.container.querySelector('.pierre-editor-fallback')
+  expect(fallback).not.toBeNull()
+  expect(fallback?.className).toContain('h-full')
+  expect(fallback?.className).toContain('overflow-auto')
+})
+
+it('transfers focus through recovery and back to the replacement editor', () => {
+  const mounted = mount()
+  const surface = mounted.view.getByTestId('pierre-file')
+  surface.tabIndex = 0
+  surface.focus()
+  expect(surface).toHaveFocus()
+
+  pierre.poolState.current = { phase: 'recovering', generation: 1 }
+  mounted.rerender()
+  const fallback = mounted.view.getByRole('textbox', { name: FILE.name }) as HTMLTextAreaElement
+  expect(fallback).toHaveFocus()
+  fallback.setSelectionRange(6, 11, 'forward')
+
+  pierre.poolState.current = { phase: 'ready', generation: 2, pool: {} }
+  mounted.rerender()
+  const replacement = attachEditor()
+  expect(replacement.of('focus')).toHaveLength(1)
+  expect(replacement.of('setSelections')).toContainEqual({
+    method: 'setSelections',
+    args: [[{
+      start: { line: 0, character: 6 },
+      end: { line: 0, character: 11 },
+      direction: 'forward',
+    }]],
+  })
+})
+
+it('does not steal focus when the user leaves the recovery editor', () => {
+  const mounted = mount()
+  const surface = mounted.view.getByTestId('pierre-file')
+  surface.tabIndex = 0
+  surface.focus()
+
+  pierre.poolState.current = { phase: 'recovering', generation: 1 }
+  mounted.rerender()
+  expect(mounted.view.getByRole('textbox', { name: FILE.name })).toHaveFocus()
+
+  const other = document.createElement('button')
+  document.body.append(other)
+  other.focus()
+  expect(other).toHaveFocus()
+
+  pierre.poolState.current = { phase: 'ready', generation: 2, pool: {} }
+  mounted.rerender()
+  const replacement = attachEditor()
+  expect(replacement.of('focus')).toHaveLength(0)
+  other.remove()
+})
+
+it('explains temporary recovery and terminal reload guidance in the UI', () => {
+  const mounted = mount()
+  pierre.poolState.current = { phase: 'recovering', generation: 1 }
+  mounted.rerender()
+  // Recovery originates in a worker failure, so it goes through ErrorNotice
+  // (errors-use-error-notice); only the cold start is a quiet status line.
+  expect(mounted.view.queryByRole('status')).toBeNull()
+  expect(mounted.view.getByRole('alert')).toHaveTextContent('Syntax highlighting is restarting. Editing remains available.')
+
+  pierre.poolState.current = { phase: 'unavailable', generation: 2 }
+  mounted.rerender()
+  expect(mounted.view.getByRole('alert')).toHaveTextContent('Syntax highlighting is unavailable. Save or copy your draft, then reload to restore syntax highlighting; editing remains available.')
+})
+
+it('mounts Pierre optimistically while the first generation initializes', () => {
+  pierre.poolState.current = { phase: 'starting', generation: 1, pool: {} }
+  const mounted = mount()
+
+  expect(mounted.view.getByTestId('pierre-file')).toBeInTheDocument()
+  expect(mounted.view.queryByRole('status')).toBeNull()
+  expect(mounted.view.queryByRole('textbox', { name: FILE.name })).toBeNull()
 })
 
 describe('PierreEditorImpl marker mapping', () => {
@@ -352,6 +528,50 @@ describe('PierreEditorImpl marker mapping', () => {
     expect(sent[1].args[0]).toEqual([])
   })
 
+
+
+  it('applies diagnostics when a cold-starting pool first becomes ready', () => {
+    const markers: EditorMarker[] = [{ severity: 'warning', message: 'cold start', line: 1 }]
+    pierre.poolState.current = { phase: 'starting', generation: 1 }
+    const mounted = mount({ markers })
+    expect(mounted.view.container.textContent).toContain(FILE.contents.trim())
+    expect(mounted.view.getByRole('status')).toHaveTextContent('Syntax highlighting is starting. Editing remains available.')
+
+    pierre.poolState.current = { phase: 'ready', generation: 1, pool: {} }
+    mounted.rerender()
+    const editor = attachEditor()
+    expect(editor.of('setMarkers')).toHaveLength(1)
+    expect(editor.of('setMarkers')[0].args[0]).toEqual([
+      {
+        severity: 'warning',
+        message: 'cold start',
+        start: { line: 0, character: 0 },
+        end: { line: 0, character: Number.MAX_SAFE_INTEGER },
+      },
+    ])
+  })
+  it('reapplies unchanged diagnostics after the worker generation remounts', () => {
+    const markers: EditorMarker[] = [{ severity: 'error', message: 'still broken', line: 2 }]
+    const mounted = mount({ markers })
+    const firstEditor = attachEditor()
+
+    pierre.poolState.current = { phase: 'recovering', generation: 1 }
+    mounted.rerender()
+    pierre.poolState.current = { phase: 'ready', generation: 2, pool: {} }
+    mounted.rerender()
+    const replacementEditor = attachEditor()
+
+    expect(replacementEditor).not.toBe(firstEditor)
+    expect(replacementEditor.of('setMarkers')).toHaveLength(1)
+    expect(replacementEditor.of('setMarkers')[0].args[0]).toEqual([
+      {
+        severity: 'error',
+        message: 'still broken',
+        start: { line: 1, character: 0 },
+        end: { line: 1, character: Number.MAX_SAFE_INTEGER },
+      },
+    ])
+  })
   it('never touches the marker gutter while the prop is absent', () => {
     // A surface with no diagnostics contract must not wipe markers some other
     // owner set; `undefined` and `[]` are different requests.
diff --git a/website/src/test/PierreImpl.workerPool.test.tsx b/website/src/test/PierreImpl.workerPool.test.tsx
index c01548e1fb7..f2965dc8f5c 100644
--- a/website/src/test/PierreImpl.workerPool.test.tsx
+++ b/website/src/test/PierreImpl.workerPool.test.tsx
@@ -1,56 +1,60 @@
-/**
- * The highlight worker pool's ENGINE choice and its ON-DEMAND construction,
- * pinned.
- *
- * Two independent guards live here because they fail the same silent way — a
- * regression costs performance or stability, never a visible error.
- *
- * The pool is built by the first surface that intends to highlight, NOT at module
- * scope, because every worker spawns eagerly at init and loads its own
- * highlighter bundle plus the WASM regex engine. Moving the call back to module
- * scope would charge that to anyone who merely loaded the chunk, and would undo
- * plain-diff mode's saving entirely: the surfaces that want no colour opt out via
- * `disabled`, and opting out only means anything while the pool is lazy.
- *
- * `PierreImpl` builds the one worker pool the whole tab shares, and the engine
- * it asks for is the difference between a runaway grammar match being bounded
- * and killing the renderer process. Pierre's own default (`shiki-js`) runs
- * TextMate patterns on V8's RegExp with no per-match ceiling; six renderer
- * deaths on 2026-08-30 were V8 cage OOMs raised from `tokenizeLine2` ->
- * `findNextMatchSync` -> `EmulatedRegExp.exec` with a JS heap of 8-32 MB out of
- * 4192 MB. `shiki-wasm` is the reference oniguruma build and aborts a
- * pathological match at its compiled-in retry limit instead.
- *
- * The option is easy to lose and impossible to notice losing: it lands in
- * `highlighterOptions`, NOT `poolOptions`, and Pierre silently defaults an
- * absent value back to `shiki-js`. Nothing else in the suite reads it, so this
- * file is the guard. Deleting the option from `PierreImpl` fails the first
- * assertion; moving it to `poolOptions` fails the second.
- */
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-import { render } from '@testing-library/react'
+// @vitest-environment happy-dom
+import { act, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ReactNode } from 'react'
 
-const pool = vi.hoisted(() => ({
-  calls: [] as { poolOptions: Record<string, unknown>; highlighterOptions: Record<string, unknown> }[],
+const state = vi.hoisted(() => ({
+  poolCalls: [] as Array<{ poolOptions: Record<string, unknown>; highlighterOptions: Record<string, unknown> }>,
+  managers: [] as Array<{ workers: FakeWorker[]; terminate: ReturnType<typeof vi.fn> }>,
+  componentProps: [] as Array<Record<string, unknown>>,
 }))
 
+class FakeWorker {
+  listeners = new Map<string, Set<(event: unknown) => void>>()
+  sent: unknown[] = []
+  terminated = false
+
+  addEventListener(type: string, listener: (event: unknown) => void) {
+    const listeners = this.listeners.get(type) ?? new Set()
+    listeners.add(listener)
+    this.listeners.set(type, listeners)
+  }
+
+  postMessage(message: unknown) {
+    this.sent.push(message)
+  }
+
+  terminate() {
+    this.terminated = true
+  }
+
+  emit(type: string, event: unknown) {
+    for (const listener of this.listeners.get(type) ?? []) listener(event)
+  }
+}
+
 vi.mock('@pierre/diffs/worker', () => ({
-  getOrCreateWorkerPoolSingleton: (args: {
-    poolOptions: Record<string, unknown>
-    highlighterOptions: Record<string, unknown>
-  }) => {
-    pool.calls.push(args)
-    return { isWorkingPool: () => true }
+  WorkerPoolManager: class {
+    workers: FakeWorker[]
+    terminate = vi.fn(() => {
+      for (const worker of this.workers) worker.terminate()
+    })
+
+    constructor(poolOptions: { poolSize: number; workerFactory: () => FakeWorker }, highlighterOptions: Record<string, unknown>) {
+      state.poolCalls.push({ poolOptions, highlighterOptions })
+      this.workers = Array.from({ length: poolOptions.poolSize }, () => poolOptions.workerFactory())
+      state.managers.push(this)
+    }
+
+    initialize() {
+      return Promise.resolve()
+    }
   },
 }))
 
-// The library itself is never exercised here — only the options the wrapper
-// hands its pool — so these doubles carry just enough shape to let the module
-// evaluate under happy-dom.
 vi.mock('@pierre/diffs', () => ({
   EXTENSION_TO_FILE_FORMAT: {},
-  parsePatchFiles: () => [],
+  parsePatchFiles: () => [{ files: [{ name: 'file.ts', hunks: [{}] }] }],
   setCustomExtension: () => {},
 }))
 
@@ -60,51 +64,309 @@ const diffProps = vi.hoisted(() => ({ last: undefined as Record<string, unknown>
 
 vi.mock('@pierre/diffs/react', async () => {
   const { createContext } = await import('react')
+  const record = (kind: string, props: Record<string, unknown>) => {
+    state.componentProps.push(props)
+    return <div data-testid={kind}>{kind}</div>
+  }
   return {
-    File: () => null,
-    FileDiff: () => null,
+    File: (props: Record<string, unknown>) => record('worker-file', props),
+    FileDiff: (props: Record<string, unknown>) => record('worker-patch', props),
     MultiFileDiff: (props: Record<string, unknown>) => {
       diffProps.last = props
-      return null
+      return record('worker-pair', props)
     },
     Virtualizer: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
     WorkerPoolContext: createContext<unknown>(undefined),
   }
 })
 
-/** A fresh copy of the module, whose lazily-built pool has not been resolved yet
- *  (`vi.resetModules` in beforeEach clears the memo). */
-const loadPierre = () => import('../pierre/PierreImpl')
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+  vi.resetModules()
+  vi.stubGlobal('Worker', FakeWorker)
+  state.poolCalls.length = 0
+  state.managers.length = 0
+  state.componentProps.length = 0
+  diffProps.last = undefined
+  localStorage.clear()
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+  vi.useRealTimers()
+})
+
+async function loadPierre() {
+  const module = await import('../pierre/PierreImpl')
+  await Promise.resolve()
+  return module
+}
 
 const FILE = { name: 'app.ts', contents: 'const a = 1\n' }
 
-describe('Pierre highlight worker pool', () => {
-  beforeEach(() => {
-    pool.calls.length = 0
-    diffProps.last = undefined
-    localStorage.clear()
-    vi.resetModules()
-    // The pool is only constructed when a Worker constructor exists — without
-    // this the module takes its SSR branch and makes no call to assert on.
-    vi.stubGlobal('Worker', class {})
+async function startPool() {
+  const module = await loadPierre()
+  let view!: ReturnType<typeof render>
+  await act(async () => {
+    view = render(<module.PierreCodeImpl file={FILE} />)
+    await Promise.resolve()
+    await Promise.resolve()
+  })
+  return { module, view }
+}
+
+describe('Pierre highlight worker pool recovery', () => {
+  it('keeps the bounded WASM engine in highlighterOptions', async () => {
+    await startPool()
+    expect(state.poolCalls).toHaveLength(1)
+    expect(state.poolCalls[0].highlighterOptions.preferredHighlighter).toBe('shiki-wasm')
+    expect(state.poolCalls[0].poolOptions).not.toHaveProperty('preferredHighlighter')
+  })
+
+  it('renders Pierre on the main thread when the Worker API is absent', async () => {
+    vi.stubGlobal('Worker', undefined)
+    const module = await loadPierre()
+    const view = render(<module.PierreCodeImpl file={FILE} />)
+    await act(async () => { await Promise.resolve() })
+
+    expect(state.poolCalls).toHaveLength(0)
+    expect(view.getByTestId('worker-file')).toBeInTheDocument()
+    expect(view.queryByRole('alert')).toBeNull()
+    expect(view.queryByText(FILE.contents.trim(), { selector: 'pre' })).toBeNull()
+  })
+
+  it('stays silent while an editor surface is mounted and returns once it unmounts', async () => {
+    const { module, view } = await startPool()
+    // What `PierreEditorImpl` does on mount, without its Pierre edit imports.
+    function EditorSurface() {
+      module.useRegisterEditorSurface()
+      return <textarea aria-label="draft" />
+    }
+    view.rerender(<>
+      <module.PierreCodeImpl file={FILE} />
+      <EditorSurface />
+    </>)
+    await act(async () => {
+      state.managers[0].workers[0].emit('error', { message: 'one' })
+      await vi.advanceTimersByTimeAsync(250)
+      state.managers[1].workers[0].emit('error', { message: 'two' })
+      await vi.advanceTimersByTimeAsync(1_000)
+      state.managers[2].workers[0].emit('error', { message: 'three' })
+      await vi.advanceTimersByTimeAsync(30_000)
+      state.managers[3].workers[0].emit('error', { message: 'half-open failed' })
+      await Promise.resolve()
+    })
+    // The editor shows its own save-first notice where the draft lives; a
+    // tab-wide "reload" instruction would risk a draft the reader cannot see.
+    expect(view.queryByRole('alert')).toBeNull()
+    expect(view.queryByRole('button', { name: 'Ask the agent' })).toBeNull()
+
+    view.rerender(<module.PierreCodeImpl file={FILE} />)
+    expect(view.getByRole('alert')).toHaveClass('fixed')
+    expect(view.getByRole('button', { name: 'Ask the agent' })).toBeInTheDocument()
+  })
+
+  it('shows one terminal hand-off across passive surfaces', async () => {
+    const { module, view } = await startPool()
+    view.rerender(<>
+      <module.PierreCodeImpl file={FILE} />
+      <module.PierreCodeImpl file={{ ...FILE, name: 'second.ts' }} />
+    </>)
+
+    await act(async () => {
+      state.managers[0].workers[0].emit('error', { message: 'one' })
+      await vi.advanceTimersByTimeAsync(250)
+      state.managers[1].workers[0].emit('error', { message: 'two' })
+      await vi.advanceTimersByTimeAsync(1_000)
+      state.managers[2].workers[0].emit('error', { message: 'three' })
+      await vi.advanceTimersByTimeAsync(30_000)
+      state.managers[3].workers[0].emit('error', { message: 'half-open failed' })
+      await Promise.resolve()
+    })
+
+    expect(view.getAllByRole('alert')).toHaveLength(1)
+    expect(view.getByRole('alert')).toHaveClass('fixed')
+    expect(view.getByRole('alert')).toHaveTextContent(
+      'Syntax highlighting is unavailable until you reload. Content remains readable.',
+    )
+    expect(view.getByRole('button', { name: 'Ask the agent' })).toBeInTheDocument()
+
+    // Terminal is forever, so the notice is dismissible — once, for every
+    // surface in the tab, including ones mounted afterwards.
+    await act(async () => {
+      view.getByRole('button', { name: 'Dismiss' }).click()
+    })
+    expect(view.queryByRole('alert')).toBeNull()
+    view.rerender(<>
+      <module.PierreCodeImpl file={FILE} />
+      <module.PierreCodeImpl file={{ ...FILE, name: 'second.ts' }} />
+      <module.PierreCodeImpl file={{ ...FILE, name: 'third.ts' }} />
+    </>)
+    expect(view.queryByRole('alert')).toBeNull()
+  })
+
+  it('switches mounted surfaces to complete plain text, terminates every worker, and remounts a replacement', async () => {
+    const { PierreCodeImpl, PierrePatchImpl, PierreFilePairImpl } = await loadPierre()
+    let view!: ReturnType<typeof render>
+    await act(async () => {
+      view = render(<>
+        <PierreCodeImpl file={{ name: 'code.ts', contents: 'CODE_FIRST\nCODE_LAST', lang: 'typescript' }} />
+        <PierrePatchImpl patch={'--- a/file.ts\n+++ b/file.ts\n@@ -1 +1 @@\n-OLD_PATCH\n+NEW_PATCH'} />
+        <PierreFilePairImpl
+          oldFile={{ name: 'old.ts', contents: 'OLD_FIRST\nOLD_LAST' }}
+          newFile={{ name: 'new.ts', contents: 'NEW_FIRST\nNEW_LAST' }}
+          fallbackClassName="archived-bound"
+          fallbackContentStyle={{ maxHeight: '120px' }}
+        />
+      </>)
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    expect(view.getByTestId('worker-file')).toBeInTheDocument()
+    expect(view.getByTestId('worker-patch')).toBeInTheDocument()
+    expect(view.getByTestId('worker-pair')).toBeInTheDocument()
+
+    await act(async () => {
+      state.managers[0].workers[0].emit('error', { message: 'boom' })
+      await Promise.resolve()
+    })
+    // Surfaces leave Pierre on the publish; workers die one macrotask later.
+    expect(state.managers[0].terminate).not.toHaveBeenCalled()
+    await act(async () => { await vi.advanceTimersByTimeAsync(0) })
+    expect(view.queryByTestId('worker-file')).not.toBeInTheDocument()
+    expect(view.queryByTestId('worker-patch')).not.toBeInTheDocument()
+    expect(view.queryByTestId('worker-pair')).not.toBeInTheDocument()
+    expect(view.container).toHaveTextContent('CODE_FIRST')
+    expect(view.container).toHaveTextContent('CODE_LAST')
+    expect(view.container).toHaveTextContent('OLD_PATCH')
+    expect(view.container).toHaveTextContent('NEW_PATCH')
+    expect(view.container).toHaveTextContent('OLD_FIRST')
+    expect(view.container).toHaveTextContent('OLD_LAST')
+    expect(view.container).toHaveTextContent('NEW_FIRST')
+    expect(view.container).toHaveTextContent('NEW_LAST')
+    expect(view.container.querySelector('pre.archived-bound')).toHaveStyle({ maxHeight: '120px' })
+    expect(state.managers[0].workers.every(worker => worker.terminated)).toBe(true)
+
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(250)
+      await Promise.resolve()
+    })
+    expect(state.managers).toHaveLength(2)
+    expect(view.getByTestId('worker-file')).toBeInTheDocument()
+    expect(view.getByTestId('worker-patch')).toBeInTheDocument()
+    expect(view.getByTestId('worker-pair')).toBeInTheDocument()
+    expect(state.componentProps.every(props => !Object.hasOwn(props, 'disableWorkerPool'))).toBe(true)
+  })
+
+
+  it('keeps collapsed rows header-only, preserves filename click selectors, and honors disabled headers', async () => {
+    const { PierreFilePairImpl } = await loadPierre()
+    const oldFile = { name: 'file.ts', contents: 'OLD_CONTENT' }
+    const newFile = { name: 'file.ts', contents: 'NEW_CONTENT' }
+    const view = render(
+      <PierreFilePairImpl oldFile={oldFile} newFile={newFile} options={{ collapsed: true, disableFileHeader: false }} />,
+    )
+
+    await act(async () => {
+      state.managers[0].workers[0].emit('error', { message: 'boom' })
+      await Promise.resolve()
+    })
+    const title = view.container.querySelector('[data-title]')
+    expect(title).not.toBeNull()
+    expect(title?.closest('[data-diffs-header]')).not.toBeNull()
+    expect(view.container).not.toHaveTextContent('OLD_CONTENT')
+    expect(view.container).not.toHaveTextContent('NEW_CONTENT')
+
+    view.rerender(
+      <PierreFilePairImpl oldFile={oldFile} newFile={newFile} options={{ collapsed: false, disableFileHeader: true }} />,
+    )
+    expect(view.container.querySelector('[data-diffs-header]')).toBeNull()
+    expect(view.container).toHaveTextContent('OLD_CONTENT')
+    expect(view.container).toHaveTextContent('NEW_CONTENT')
+
+    view.rerender(<PierreFilePairImpl oldFile={oldFile} newFile={newFile} />)
+    expect(view.container.querySelector('[data-diffs-header]')).toBeNull()
+    expect(view.container).toHaveTextContent('OLD_CONTENT')
+    expect(view.container).toHaveTextContent('NEW_CONTENT')
+  })
+
+  it('keeps header actions out of fallbacks (max-two-buttons-per-row)', async () => {
+    const { PierrePatchImpl, PierreFilePairImpl } = await loadPierre()
+    const actions = () => <><button>Open</button><button>Layout</button><button>Copy</button></>
+    const view = render(<>
+      <PierrePatchImpl patch={'diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-a\n+b\n'} renderHeaderMetadata={actions} />
+      <PierreFilePairImpl
+        oldFile={{ name: 'x.ts', contents: 'OLD' }}
+        newFile={{ name: 'x.ts', contents: 'NEW' }}
+        options={{ disableFileHeader: false }}
+        renderHeaderMetadata={actions}
+      />
+    </>)
+    await act(async () => {
+      state.managers[0].workers[0].emit('error', { message: 'boom' })
+      await Promise.resolve()
+    })
+    expect(view.queryByTestId('worker-patch')).toBeNull()
+    expect(view.queryByTestId('worker-pair')).toBeNull()
+    expect(view.container.querySelector('[data-title]')).not.toBeNull()
+    expect(view.queryAllByRole('button')).toHaveLength(0)
   })
 
-  it('asks for the WASM oniguruma engine, whose pathological matches are bounded', async () => {
-    const { PierreShell } = await loadPierre()
-    render(<PierreShell>surface</PierreShell>)
+  it('does not recycle the pool for a request-local protocol error', async () => {
+    await startPool()
+    state.managers[0].workers[0].emit('message', {
+      data: { type: 'error', id: 'render-request', error: 'unsupported grammar input' },
+    })
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(state.managers).toHaveLength(1)
+    expect(state.managers[0].terminate).not.toHaveBeenCalled()
+  })
+  it('gives worker initialization a wider timeout budget', async () => {
+    await startPool()
+    const worker = state.managers[0].workers[0]
+    worker.postMessage({ type: 'initialize', id: 'slow-initialize' })
 
-    expect(pool.calls).toHaveLength(1)
-    expect(pool.calls[0].highlighterOptions.preferredHighlighter).toBe('shiki-wasm')
+    await vi.advanceTimersByTimeAsync(119_999)
+    expect(state.managers[0].terminate).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(1)
+    // The watchdog schedules termination one macrotask later; fake timers stamp
+    // a timer created inside a tick at now + 1.
+    await vi.advanceTimersByTimeAsync(1)
+    expect(state.managers[0].terminate).toHaveBeenCalledOnce()
   })
 
-  it('passes the engine in highlighterOptions, the only argument Pierre reads it from', async () => {
-    const { PierreShell } = await loadPierre()
-    render(<PierreShell>surface</PierreShell>)
 
-    // WorkerPoolManager takes the engine off its SECOND argument; a value on
-    // poolOptions is silently ignored and the default `shiki-js` stands.
-    expect(pool.calls[0].poolOptions).not.toHaveProperty('preferredHighlighter')
-    expect(Object.keys(pool.calls[0].highlighterOptions)).toContain('preferredHighlighter')
+  it('recycles the pool when a worker request hangs', async () => {
+    await startPool()
+    const worker = state.managers[0].workers[0]
+    worker.postMessage({ type: 'file', id: 'hung-request' })
+
+    await vi.advanceTimersByTimeAsync(29_999)
+    expect(state.managers[0].terminate).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(1)
+    // The watchdog schedules termination one macrotask later; fake timers stamp
+    // a timer created inside a tick at now + 1.
+    await vi.advanceTimersByTimeAsync(1)
+    expect(state.managers[0].terminate).toHaveBeenCalledOnce()
+    await vi.advanceTimersByTimeAsync(250)
+    expect(state.managers).toHaveLength(2)
+  })
+
+  it('ignores a stale worker failure after replacement', async () => {
+    await startPool()
+    const staleWorker = state.managers[0].workers[0]
+    staleWorker.emit('messageerror', {})
+    await Promise.resolve()
+    await vi.advanceTimersByTimeAsync(250)
+    await Promise.resolve()
+    expect(state.managers).toHaveLength(2)
+
+    staleWorker.emit('error', { message: 'late old error' })
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(state.managers).toHaveLength(2)
+    expect(state.managers[1].terminate).not.toHaveBeenCalled()
   })
 
   it('builds nothing merely by loading the module', async () => {
@@ -114,40 +376,33 @@ describe('Pierre highlight worker pool', () => {
     // until something asks.
     await loadPierre()
 
-    expect(pool.calls).toHaveLength(0)
+    expect(state.poolCalls).toHaveLength(0)
   })
 
   it('builds ONE pool however many surfaces mount', async () => {
-    // The whole tab shares it, and the memo is what keeps a virtualized list of
-    // chat diffs from spawning a pool per block.
-    const { PierreShell } = await loadPierre()
-    render(<PierreShell>a</PierreShell>)
-    render(<PierreShell>b</PierreShell>)
-
-    expect(pool.calls).toHaveLength(1)
-  })
-
-  it('builds nothing for a shell that opted out', async () => {
-    // `disabled` is the plain-diff and broken-pool path. It has to PREVENT
-    // construction, not just withhold the context value — otherwise the workers
-    // spawn and idle, which is the cost the preference exists to remove.
-    const { PierreShell } = await loadPierre()
-    render(<PierreShell disabled>surface</PierreShell>)
+    const { PierreCodeImpl } = await loadPierre()
+    await act(async () => {
+      render(<PierreCodeImpl file={FILE} />)
+      render(<PierreCodeImpl file={{ ...FILE, name: 'other.ts' }} />)
+      await Promise.resolve()
+      await Promise.resolve()
+    })
 
-    expect(pool.calls).toHaveLength(0)
+    expect(state.poolCalls).toHaveLength(1)
   })
 
   describe('plain-diff mode on the file-pair surface', () => {
-    it('spawns no workers and declares both sides plain text', async () => {
+    it('uses the text grammar without bypassing the worker lifecycle', async () => {
       localStorage.setItem('mc-diff-plain', '1')
       const { PierreFilePairImpl } = await loadPierre()
-      render(<PierreFilePairImpl oldFile={FILE} newFile={{ ...FILE, contents: 'const a = 2\n' }} />)
+      await act(async () => {
+        render(<PierreFilePairImpl oldFile={FILE} newFile={{ ...FILE, contents: 'const a = 2\n' }} />)
+        await Promise.resolve()
+        await Promise.resolve()
+      })
 
-      // The saving: no pool, so no worker ever spawns for this surface.
-      expect(pool.calls).toHaveLength(0)
-      // And nothing for one to do anyway — `text` is Pierre's plaintext grammar,
-      // which is what removes the colour while keeping rows and gutters.
-      expect(diffProps.last?.disableWorkerPool).toBe(true)
+      expect(state.poolCalls).toHaveLength(0)
+      expect(diffProps.last).not.toHaveProperty('disableWorkerPool')
       expect((diffProps.last?.oldFile as { lang?: string }).lang).toBe('text')
       expect((diffProps.last?.newFile as { lang?: string }).lang).toBe('text')
     })
@@ -155,11 +410,20 @@ describe('Pierre highlight worker pool', () => {
     it('keys the cache by mode, so a live toggle cannot serve the other render’s tokens', async () => {
       localStorage.setItem('mc-diff-plain', '1')
       const { PierreFilePairImpl } = await loadPierre()
-      render(<PierreFilePairImpl oldFile={FILE} newFile={FILE} />)
+      let plainView!: ReturnType<typeof render>
+      await act(async () => {
+        plainView = render(<PierreFilePairImpl oldFile={FILE} newFile={FILE} />)
+        await Promise.resolve()
+      })
       const plainKey = (diffProps.last?.newFile as { cacheKey?: string }).cacheKey
 
+      plainView.unmount()
       localStorage.clear()
-      render(<PierreFilePairImpl oldFile={FILE} newFile={FILE} />)
+      await act(async () => {
+        render(<PierreFilePairImpl oldFile={FILE} newFile={FILE} />)
+        await Promise.resolve()
+        await Promise.resolve()
+      })
       const colouredKey = (diffProps.last?.newFile as { cacheKey?: string }).cacheKey
 
       // Pierre caches tokens by cacheKey; identical keys would paint the plain
@@ -169,10 +433,14 @@ describe('Pierre highlight worker pool', () => {
 
     it('highlights with the shared pool when the preference is unset', async () => {
       const { PierreFilePairImpl } = await loadPierre()
-      render(<PierreFilePairImpl oldFile={FILE} newFile={{ ...FILE, contents: 'const a = 2\n' }} />)
+      await act(async () => {
+        render(<PierreFilePairImpl oldFile={FILE} newFile={{ ...FILE, contents: 'const a = 2\n' }} />)
+        await Promise.resolve()
+        await Promise.resolve()
+      })
 
-      expect(pool.calls).toHaveLength(1)
-      expect(diffProps.last?.disableWorkerPool).toBe(false)
+      expect(state.poolCalls).toHaveLength(1)
+      expect(diffProps.last).not.toHaveProperty('disableWorkerPool')
       expect((diffProps.last?.newFile as { lang?: string }).lang).toBeUndefined()
     })
   })
diff --git a/website/src/test/pierre.poolRebind.test.tsx b/website/src/test/pierre.poolRebind.test.tsx
new file mode 100644
index 00000000000..3e383a40f43
--- /dev/null
+++ b/website/src/test/pierre.poolRebind.test.tsx
@@ -0,0 +1,73 @@
+// @vitest-environment happy-dom
+/** Real-library canary for the premise behind generation-keyed remounts.
+ *
+ *  `@pierre/diffs/react` hands the `WorkerPoolContext` value to the core
+ *  `File` instance ONCE, when the ref callback constructs it. Changing the
+ *  context value afterwards re-renders the component but never re-supplies
+ *  the manager, so a mounted surface keeps talking to a retired pool unless
+ *  its `<File>` is remounted — which is what `PierreShell`'s `key={generation}`
+ *  does. If a `@pierre/diffs` upgrade starts rebinding on context change this
+ *  test fails and the keying can be reconsidered.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, render } from '@testing-library/react'
+import { File as CoreFile } from '@pierre/diffs'
+import { File, WorkerPoolContext } from '@pierre/diffs/react'
+import type { WorkerPoolManager } from '@pierre/diffs/worker'
+
+/** The slice of a manager the core `File` touches at construction. */
+function fakeManager(): WorkerPoolManager {
+  return {
+    subscribeToThemeChanges() {},
+    unsubscribeToThemeChanges() {},
+    isWorkingPool: () => false,
+    isInitialized: () => true,
+    getFileRenderOptions: () => ({}),
+  } as unknown as WorkerPoolManager
+}
+
+const FILE = { name: 'a.ts', contents: 'const a = 1\n' }
+
+describe('@pierre/diffs File binding to the worker pool context', () => {
+  afterEach(() => {
+    cleanup()
+    vi.restoreAllMocks()
+  })
+
+  it('captures the manager at construction and ignores later context values', () => {
+    const instances: CoreFile[] = []
+    const hydrate = vi.spyOn(CoreFile.prototype, 'hydrate').mockImplementation(function (this: CoreFile) {
+      instances.push(this)
+    })
+    vi.spyOn(CoreFile.prototype, 'render').mockImplementation(() => undefined)
+    vi.spyOn(CoreFile.prototype, 'cleanUp').mockImplementation(() => undefined)
+
+    const first = fakeManager()
+    const second = fakeManager()
+    const view = render(
+      <WorkerPoolContext.Provider value={first}>
+        <File file={FILE} />
+      </WorkerPoolContext.Provider>,
+    )
+    expect(hydrate).toHaveBeenCalledTimes(1)
+    expect((instances[0] as unknown as { workerManager: unknown }).workerManager).toBe(first)
+
+    view.rerender(
+      <WorkerPoolContext.Provider value={second}>
+        <File file={FILE} />
+      </WorkerPoolContext.Provider>,
+    )
+    // Same instance, still bound to the retired manager: context alone does
+    // not rebind. Only a remount (new key) constructs a `File` against `second`.
+    expect(hydrate).toHaveBeenCalledTimes(1)
+    expect((instances[0] as unknown as { workerManager: unknown }).workerManager).toBe(first)
+
+    view.rerender(
+      <WorkerPoolContext.Provider value={second}>
+        <File key="next-generation" file={FILE} />
+      </WorkerPoolContext.Provider>,
+    )
+    expect(hydrate).toHaveBeenCalledTimes(2)
+    expect((instances[1] as unknown as { workerManager: unknown }).workerManager).toBe(second)
+  })
+})
diff --git a/website/src/test/pierre.warmSwap.slowChunk.test.tsx b/website/src/test/pierre.warmSwap.slowChunk.test.tsx
new file mode 100644
index 00000000000..035ee41393f
--- /dev/null
+++ b/website/src/test/pierre.warmSwap.slowChunk.test.tsx
@@ -0,0 +1,72 @@
+/** WarmSwap with a Pierre chunk that outlives the swap deadline.
+ *
+ *  The staged impl suspends to `null` while WarmSwap still shows its own
+ *  fallback (no duplicated text, no false paint). Once the deadline fail-safe
+ *  reveals the surface, the inner Suspense must supply a real fallback — a
+ *  slow network chunk shows readable plain text, never a blank block.
+ */
+import { act, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { PierreCode, PierreFilePair, PierrePatch } from '../pierre'
+
+// A chunk load slower than the deadline: every impl suspends forever, which is
+// exactly what React sees while a lazy chunk is still in flight. Modelled with
+// suspending components rather than a never-resolving mock factory so the
+// behavior does not depend on how the module runner treats a pending factory.
+vi.mock('../pierre/PierreImpl', () => {
+  const pending = new Promise<never>(() => {})
+  const StillLoading = () => { throw pending }
+  return { PierreCodeImpl: StillLoading, PierrePatchImpl: StillLoading, PierreFilePairImpl: StillLoading }
+})
+
+const PATCH = 'diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-a\n+b\n'
+
+describe('WarmSwap with a chunk slower than the deadline', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+    vi.unstubAllGlobals()
+    vi.useRealTimers()
+  })
+
+  async function revealByDeadline(ui: React.ReactElement) {
+    class InertRO {
+      observe() {}
+      unobserve() {}
+      disconnect() {}
+    }
+    vi.stubGlobal('ResizeObserver', InertRO)
+    vi.useFakeTimers()
+    const spy = vi.spyOn(HTMLElement.prototype, 'scrollHeight', 'get').mockReturnValue(0)
+    const view = render(ui)
+    // Staging: exactly one visible copy of the text, none inside the hidden box.
+    expect(view.container.querySelectorAll('pre')).toHaveLength(1)
+    expect(view.container.querySelectorAll('[aria-hidden="true"] pre')).toHaveLength(0)
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(2600)
+    })
+    spy.mockRestore()
+    return view
+  }
+
+  it('keeps plain code text visible after the deadline reveals an unresolved chunk', async () => {
+    const view = await revealByDeadline(<PierreCode file={{ name: 'a.ts', contents: 'const visible = 1\n' }} />)
+    expect(view.container.querySelectorAll('[aria-hidden="true"]')).toHaveLength(0)
+    expect(screen.getByText('const visible = 1')).toBeVisible()
+  })
+
+  it('keeps plain patch text visible after the deadline reveals an unresolved chunk', async () => {
+    const view = await revealByDeadline(<PierrePatch patch={PATCH} />)
+    expect(view.container.querySelectorAll('[aria-hidden="true"]')).toHaveLength(0)
+    expect(view.container.textContent).toContain('+b')
+  })
+
+  it('keeps both file-pair sides visible after the deadline reveals an unresolved chunk', async () => {
+    const view = await revealByDeadline(
+      <PierreFilePair oldFile={{ name: 'a.ts', contents: 'OLD_SIDE\n' }} newFile={{ name: 'a.ts', contents: 'NEW_SIDE\n' }} />,
+    )
+    expect(view.container.querySelectorAll('[aria-hidden="true"]')).toHaveLength(0)
+    expect(view.container.textContent).toContain('OLD_SIDE')
+    expect(view.container.textContent).toContain('NEW_SIDE')
+  })
+})
diff --git a/website/src/test/pierre.warmSwap.test.tsx b/website/src/test/pierre.warmSwap.test.tsx
index 72ad8c02260..0000ee893be 100644
--- a/website/src/test/pierre.warmSwap.test.tsx
+++ b/website/src/test/pierre.warmSwap.test.tsx
@@ -51,6 +51,12 @@ describe('WarmSwap', () => {
     expect(screen.queryByTestId('impl')).toBeNull()
   })
 
+  it('does not duplicate fallback text inside hidden staging', () => {
+    const view = render(<PierrePatch patch={PATCH} />)
+    expect(view.container.querySelectorAll('pre')).toHaveLength(1)
+    expect(view.container.querySelectorAll('[aria-hidden="true"] pre')).toHaveLength(0)
+  })
+
   it('notifies FilePair when WarmSwap reveals the implementation', async () => {
     let roCallback: (() => void) | null = null
     class StubRO {
diff --git a/website/src/test/pierre.workerHealth.test.tsx b/website/src/test/pierre.workerHealth.test.tsx
deleted file mode 100644
index 703337b1ef4..00000000000
--- a/website/src/test/pierre.workerHealth.test.tsx
+++ /dev/null
@@ -1,62 +0,0 @@
-// @vitest-environment happy-dom
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-import { render } from '@testing-library/react'
-import { act } from 'react'
-
-// The highlight worker pool has no failure path of its own: @pierre/diffs logs
-// a worker `error` and returns, so the request in flight is never rejected and
-// the surface waiting on it paints nothing at all — a code block reduced to its
-// language header with an empty body. This store is the detection we add at the
-// one place we hold the Worker object, and `disableWorkerPool` is what every
-// mounted surface switches to once it fires.
-
-beforeEach(() => {
-  // Module-level state: each test needs its own copy of the store.
-  vi.resetModules()
-})
-
-describe('pierre worker pool health', () => {
-  it('starts healthy', async () => {
-    const { isWorkerPoolBroken } = await import('../pierre/workerHealth')
-    expect(isWorkerPoolBroken()).toBe(false)
-  })
-
-  it('latches broken and warns exactly once across repeated reports', async () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const { isWorkerPoolBroken, markWorkerPoolBroken } = await import('../pierre/workerHealth')
-    markWorkerPoolBroken('boom')
-    markWorkerPoolBroken('boom again from a sibling worker')
-    expect(isWorkerPoolBroken()).toBe(true)
-    // One root cause can kill every worker in the pool; only the first report
-    // is news.
-    expect(warn).toHaveBeenCalledTimes(1)
-    warn.mockRestore()
-  })
-
-  it('re-renders a subscribed surface when the pool breaks', async () => {
-    const { markWorkerPoolBroken, useWorkerPoolBroken } = await import('../pierre/workerHealth')
-    const seen: boolean[] = []
-    function Probe() {
-      const broken = useWorkerPoolBroken()
-      seen.push(broken)
-      return <span data-testid="probe">{String(broken)}</span>
-    }
-    const { getByTestId } = render(<Probe />)
-    expect(getByTestId('probe').textContent).toBe('false')
-    act(() => { markWorkerPoolBroken('worker died') })
-    expect(getByTestId('probe').textContent).toBe('true')
-    expect(seen).toContain(true)
-  })
-
-  it('drops its listener on unmount so a later report does not touch a dead tree', async () => {
-    const { markWorkerPoolBroken, useWorkerPoolBroken } = await import('../pierre/workerHealth')
-    function Probe() {
-      useWorkerPoolBroken()
-      return null
-    }
-    const { unmount } = render(<Probe />)
-    unmount()
-    // Would throw on an update to an unmounted component if the listener leaked.
-    expect(() => act(() => { markWorkerPoolBroken('after unmount') })).not.toThrow()
-  })
-})
diff --git a/website/src/test/pierre.workerProtocol.test.ts b/website/src/test/pierre.workerProtocol.test.ts
new file mode 100644
index 00000000000..00f90094443
--- /dev/null
+++ b/website/src/test/pierre.workerProtocol.test.ts
@@ -0,0 +1,114 @@
+// @vitest-environment happy-dom
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { WorkerPoolManager } from '@pierre/diffs/worker'
+import { createMonitoredWorker } from '../pierre/PierreImpl'
+import {
+  PIERRE_REGEX_ENGINE,
+  PIERRE_THEMES,
+  PIERRE_WORKER_INITIALIZATION_TIMEOUT_MS,
+} from '../pierre/config'
+
+const protocol = { workers: [] as ProtocolWorker[] }
+
+class ProtocolWorker {
+  listeners = new Map<string, Set<(event: { data: unknown }) => void>>()
+  posted: Array<{ type?: string; id?: string }> = []
+  terminated = false
+
+  constructor() { protocol.workers.push(this) }
+
+  addEventListener(type: string, listener: (event: { data: unknown }) => void) {
+    const listeners = this.listeners.get(type) ?? new Set()
+    listeners.add(listener)
+    this.listeners.set(type, listeners)
+  }
+
+  postMessage(request: { type?: string; id?: string }) {
+    this.posted.push(request)
+    queueMicrotask(() => {
+      const data = request.type === 'file'
+        ? { type: 'error', id: request.id, error: 'behavioral canary response' }
+        : {
+            type: 'success',
+            requestType: request.type,
+            id: request.id,
+            sentAt: Date.now(),
+          }
+      for (const listener of this.listeners.get('message') ?? []) listener({ data })
+    })
+  }
+
+  terminate() { this.terminated = true }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  vi.stubGlobal('Worker', ProtocolWorker)
+  protocol.workers.length = 0
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+  vi.useRealTimers()
+})
+
+describe('Pierre worker protocol watchdog contract', () => {
+  it('clears initialization and render watchdogs from matching real-manager response IDs', async () => {
+    const reportFailure = vi.fn()
+    const manager = new WorkerPoolManager(
+      {
+        poolSize: 1,
+        workerFactory: () => createMonitoredWorker(reportFailure),
+      },
+      { theme: PIERRE_THEMES, preferredHighlighter: PIERRE_REGEX_ENGINE },
+    )
+    const initialization = manager.initialize([])
+    await vi.runAllTicks()
+    await initialization
+
+    const internal = manager as unknown as {
+      workers: unknown[]
+      executeTask: (worker: unknown, task: Record<string, unknown>) => void
+    }
+    const id = 'render-canary-request'
+    internal.executeTask(internal.workers[0], {
+      type: 'file',
+      id,
+      request: {
+        type: 'file',
+        id,
+        file: {
+          name: 'render-canary.ts',
+          contents: 'const renderCanary = true\n',
+          lang: 'typescript',
+          cacheKey: 'render-canary',
+        },
+      },
+      instances: new Set([{
+        __id: 'render-canary-instance',
+        onHighlightSuccess: vi.fn(),
+        onHighlightError: vi.fn(),
+      }]),
+      primeCache: false,
+      highlightKey: 'file:render-canary',
+      callbacks: new Set(),
+      renderOptionsVersion: 0,
+      requestStart: Date.now(),
+    })
+    await vi.runAllTicks()
+
+    const posted = protocol.workers.flatMap(worker => worker.posted)
+    expect(posted).toEqual(expect.arrayContaining([
+      expect.objectContaining({ type: 'initialize', id: expect.any(String) }),
+      expect.objectContaining({ type: 'file', id }),
+    ]))
+
+    await vi.advanceTimersByTimeAsync(PIERRE_WORKER_INITIALIZATION_TIMEOUT_MS + 250)
+    expect(reportFailure).not.toHaveBeenCalled()
+    expect(protocol.workers).toHaveLength(1)
+    expect(protocol.workers[0].terminated).toBe(false)
+    manager.terminate()
+  })
+})
diff --git a/website/src/test/workerPoolLifecycle.test.tsx b/website/src/test/workerPoolLifecycle.test.tsx
new file mode 100644
index 00000000000..eabd5342565
--- /dev/null
+++ b/website/src/test/workerPoolLifecycle.test.tsx
@@ -0,0 +1,178 @@
+// @vitest-environment happy-dom
+import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest'
+import type { WorkerPoolManager } from '@pierre/diffs/worker'
+import { WorkerPoolLifecycle, type WorkerPoolHandle } from '../pierre/workerPoolLifecycle'
+
+
+function deferred() {
+  let resolve!: () => void
+  let reject!: (error: unknown) => void
+  const promise = new Promise<void>((res, rej) => {
+    resolve = res
+    reject = rej
+  })
+  return { promise, resolve, reject }
+}
+
+function harness() {
+  const attempts: Array<{
+    generation: number
+    reportFailure: (reason?: unknown) => void
+    ready: ReturnType<typeof deferred>
+    terminate: ReturnType<typeof vi.fn>
+  }> = []
+  const warn = vi.fn()
+  const lifecycle = new WorkerPoolLifecycle({
+    retryDelaysMs: [250, 1_000],
+    cooldownMs: 30_000,
+    stableAfterMs: 60_000,
+    warn,
+    create: (reportFailure): WorkerPoolHandle => {
+      const generation = attempts.length + 1
+      const ready = deferred()
+      const terminate = vi.fn()
+      attempts.push({ generation, reportFailure, ready, terminate })
+      return {
+        pool: { id: generation } as unknown as WorkerPoolManager,
+        ready: ready.promise,
+        terminate,
+      }
+    },
+  })
+  return { lifecycle, attempts, warn }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('Pierre worker pool lifecycle', () => {
+  it('publishes ready only after initialization completes', async () => {
+    const { lifecycle, attempts } = harness()
+    lifecycle.start()
+    expect(lifecycle.getSnapshot()).toEqual({ phase: 'starting', generation: 1, pool: { id: 1 } })
+
+    attempts[0].ready.resolve()
+    await Promise.resolve()
+    expect(lifecycle.getSnapshot()).toEqual({ phase: 'ready', generation: 1, pool: { id: 1 } })
+  })
+
+  it('publishes plain-text recovery before terminating and replacing a failed pool', async () => {
+    const { lifecycle, attempts } = harness()
+    const phases: string[] = []
+    lifecycle.subscribe(() => phases.push(lifecycle.getSnapshot().phase))
+    lifecycle.start()
+    attempts[0].ready.resolve()
+    await Promise.resolve()
+
+    attempts[0].reportFailure('boom')
+    expect(lifecycle.getSnapshot()).toEqual({ phase: 'recovering', generation: 1 })
+    expect(attempts[0].terminate).not.toHaveBeenCalled()
+    // Subscribers commit in microtasks; termination must outlast all of them.
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(attempts[0].terminate).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(attempts[0].terminate).toHaveBeenCalledOnce()
+
+    expect(attempts).toHaveLength(1)
+    await vi.advanceTimersByTimeAsync(249)
+    expect(attempts).toHaveLength(1)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(attempts).toHaveLength(2)
+    expect(lifecycle.getSnapshot()).toEqual({ phase: 'recovering', generation: 2 })
+    expect(phases).toContain('recovering')
+  })
+
+  it('ignores late failures from a retired generation', async () => {
+    const { lifecycle, attempts } = harness()
+    lifecycle.start()
+    attempts[0].ready.resolve()
+    await Promise.resolve()
+    attempts[0].reportFailure('first')
+    await vi.advanceTimersByTimeAsync(250)
+    attempts[1].ready.resolve()
+    await Promise.resolve()
+
+    attempts[0].reportFailure('late')
+    expect(lifecycle.getSnapshot()).toEqual({ phase: 'ready', generation: 2, pool: { id: 2 } })
+    expect(attempts[1].terminate).not.toHaveBeenCalled()
+  })
+
+  it('bounds repeated initialization failures with a cooldown', async () => {
+    const { lifecycle, attempts } = harness()
+    lifecycle.start()
+    attempts[0].reportFailure(new Error('one'))
+    await vi.advanceTimersByTimeAsync(250)
+    attempts[1].reportFailure(new Error('two'))
+    await vi.advanceTimersByTimeAsync(1_000)
+    attempts[2].reportFailure(new Error('three'))
+
+    expect(lifecycle.getSnapshot()).toEqual({ phase: 'recovering', generation: 3 })
+    expect(attempts).toHaveLength(3)
+    await vi.advanceTimersByTimeAsync(29_999)
+    expect(attempts).toHaveLength(3)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(attempts).toHaveLength(4)
+    attempts[3].reportFailure(new Error('half-open failed'))
+    expect(lifecycle.getSnapshot()).toEqual({ phase: 'unavailable', generation: 4 })
+    await vi.advanceTimersByTimeAsync(60_000)
+    expect(attempts).toHaveLength(4)
+  })
+
+
+  it('preserves the failure budget until a replacement remains stable', async () => {
+    const { lifecycle, attempts } = harness()
+    lifecycle.start()
+    attempts[0].ready.resolve()
+    await Promise.resolve()
+
+    attempts[0].reportFailure('first')
+    await vi.advanceTimersByTimeAsync(250)
+    attempts[1].ready.resolve()
+    await Promise.resolve()
+
+    attempts[1].reportFailure('same failure after replacement')
+    await vi.advanceTimersByTimeAsync(999)
+    expect(attempts).toHaveLength(2)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(attempts).toHaveLength(3)
+  })
+
+  it('warns once through retries and cooldown, then resets after stability', async () => {
+    const { lifecycle, attempts, warn } = harness()
+    lifecycle.start()
+    attempts[0].reportFailure('one')
+    await vi.advanceTimersByTimeAsync(250)
+    attempts[1].reportFailure('two')
+    await vi.advanceTimersByTimeAsync(1_000)
+    attempts[2].reportFailure('three')
+    expect(warn).toHaveBeenCalledTimes(1)
+
+    await vi.advanceTimersByTimeAsync(30_000)
+    attempts[3].ready.resolve()
+    await Promise.resolve()
+    await vi.advanceTimersByTimeAsync(60_000)
+    attempts[3].reportFailure('new episode')
+    expect(warn).toHaveBeenCalledTimes(2)
+  })
+
+  it('publishes to subscribers and removes listeners on unsubscribe', async () => {
+    const { lifecycle, attempts } = harness()
+    const phases: string[] = []
+    const unsubscribe = lifecycle.subscribe(() => phases.push(lifecycle.getSnapshot().phase))
+    lifecycle.start()
+    attempts[0].ready.resolve()
+    await Promise.resolve()
+    expect(phases).toEqual(['starting', 'starting', 'ready'])
+
+    unsubscribe()
+    attempts[0].reportFailure('after unsubscribe')
+    expect(phases).toEqual(['starting', 'starting', 'ready'])
+  })
+
+})