diff --git a/electron/src/renderer/src/components/FloatingToolbar.tsx b/electron/src/renderer/src/components/FloatingToolbar.tsx
index eb31c795..15d10075 100644
--- a/electron/src/renderer/src/components/FloatingToolbar.tsx
+++ b/electron/src/renderer/src/components/FloatingToolbar.tsx
@@ -76,7 +76,10 @@ if (typeof document !== 'undefined' && !document.getElementById(STYLE_ID)) {
     '@keyframes spyde-pop-up{from{opacity:0;transform:translate(-50%,6px)}to{opacity:1;transform:translate(-50%,0)}}' +
     '.spyde-tb-btn{background:none;border:none;color:#cdd6f4;cursor:pointer;width:30px;height:30px;' +
     'border-radius:6px;display:flex;align-items:center;justify-content:center;transition:background 90ms}' +
-    '.spyde-tb-btn:hover{background:rgba(137,180,250,0.18)}'
+    '.spyde-tb-btn:hover:not(:disabled){background:rgba(137,180,250,0.18)}' +
+    // A disabled button still matches :hover, so without this the locked
+    // buttons keep lighting up under the cursor and read as clickable.
+    '.spyde-tb-btn:disabled{cursor:not-allowed}'
   document.head.appendChild(s)
 }
 
@@ -220,6 +223,11 @@ export function FloatingToolbar({
   if (!shown.length) return null
 
   const click = (a: ToolbarAction) => {
+    // Locked window (a progressive batch is still filling this tree): the
+    // button is rendered `disabled` so this should be unreachable, and the
+    // backend refuses the action regardless — belt and braces against a stale
+    // config, since the cost of getting it wrong is a node on a half-built tree.
+    if (a.disabled) return
     if (live.has(a.name)) {
       sendAction('set_action_active', { name: a.name, active: false }, windowId)
       setOpenName(null)
@@ -303,10 +311,25 @@ export function FloatingToolbar({
         return (
           <button
             key={a.name}
-            title={a.name}
+            title={a.disabled
+              ? `${a.name} — unavailable: ${a.disabled_reason ?? 'this window is still computing'}`
+              : a.name}
             data-testid={`action-btn-${a.name}`}
             className="spyde-tb-btn"
-            style={{ ...(active ? styles.btnActive : {}), position: 'relative' }}
+            disabled={!!a.disabled}
+            style={{
+              ...(active ? styles.btnActive : {}),
+              position: 'relative',
+              // Dimmed + not-allowed rather than hidden: the action comes BACK
+              // when the batch finishes, and a button that vanishes and returns
+              // reads as a glitch (the requires_vectors gates hide because those
+              // actions genuinely do not apply to the data; this one is "not
+              // yet"). Both cues, because opacity alone on a dark theme is easy
+              // to miss.
+              ...(a.disabled
+                ? { opacity: 0.3, cursor: 'not-allowed', filter: 'grayscale(1)' }
+                : {}),
+            }}
             onClick={() => click(a)}
           >
             {a.icon && a.icon.endsWith('.svg')
diff --git a/electron/src/renderer/src/kernel/SpyDEContext.tsx b/electron/src/renderer/src/kernel/SpyDEContext.tsx
index 8ce378f2..7b71bd01 100644
--- a/electron/src/renderer/src/kernel/SpyDEContext.tsx
+++ b/electron/src/renderer/src/kernel/SpyDEContext.tsx
@@ -48,6 +48,12 @@ export interface ToolbarAction {
   toggle: boolean
   parameters: Record<string, ParamSpec>
   subfunctions?: SubAction[]
+  /** Set while this window's tree is locked by a progressive compute (a
+   *  find-vectors batch filling it). The button renders unavailable instead of
+   *  looking clickable and erroring; `disabled_reason` is its tooltip. The
+   *  backend refuses the action anyway — this is the visible half of that. */
+  disabled?: boolean
+  disabled_reason?: string
 }
 
 export interface SpyDEWindow {
diff --git a/electron/tests/_harness.cjs b/electron/tests/_harness.cjs
index d5272072..c345c88d 100644
--- a/electron/tests/_harness.cjs
+++ b/electron/tests/_harness.cjs
@@ -399,6 +399,15 @@ async function countColorPixels(page, kind) {
  * DELTA. A press anywhere else does nothing at all, silently — which is how a
  * spec can "pass" a navigate-and-observe assertion while the navigator never
  * moved and the picture only changed for unrelated reasons.
+ *
+ * Also returns the guide lines' own EXTENT (`x0,x1,y0,y1`, same iframe-relative
+ * CSS px, right/bottom exclusive): the crosshair spans the drawn image exactly,
+ * so that rectangle IS the navigator image's on-screen rect and
+ * `(x1-x0)/navWidth` is its px per nav column. That is the only honest way for
+ * a spec to convert a nav-index
+ * target into a pointer delta — the alternative, writing the widget from the
+ * backend and grabbing where it lands, desynchronises the renderer's own widget
+ * state and the press silently misses (see `_test_aim_ready_position`).
  */
 async function crosshairAt(win) {
   const ifel = await win.locator('iframe').first().elementHandle()
@@ -426,12 +435,19 @@ async function crosshairAt(win) {
       let bx = 0, by = 0
       for (let x = 1; x < c.width; x++) if (cols[x] > cols[bx]) bx = x
       for (let y = 1; y < c.height; y++) if (rows[y] > rows[by]) by = y
+      // The lines' full extent = the drawn image rect (see the doc note).
+      let gx0 = -1, gx1 = -1, gy0 = -1, gy1 = -1
+      for (let x = 0; x < c.width; x++) if (cols[x]) { if (gx0 < 0) gx0 = x; gx1 = x }
+      for (let y = 0; y < c.height; y++) if (rows[y]) { if (gy0 < 0) gy0 = y; gy1 = y }
       // Canvas backing store px → CSS px (devicePixelRatio makes them differ).
       const rect = c.getBoundingClientRect()
+      const sx = rect.width / c.width, sy = rect.height / c.height
       best = {
-        x: rect.left + (bx + 0.5) * (rect.width / c.width),
-        y: rect.top + (by + 0.5) * (rect.height / c.height),
+        x: rect.left + (bx + 0.5) * sx,
+        y: rect.top + (by + 0.5) * sy,
         green: total,
+        x0: rect.left + gx0 * sx, x1: rect.left + (gx1 + 1) * sx,
+        y0: rect.top + gy0 * sy, y1: rect.top + (gy1 + 1) * sy,
       }
     }
     return best
@@ -443,19 +459,32 @@ async function crosshairAt(win) {
  * `onStep(i)` after each move has had `settleMs` to paint. `dx`/`dy` are the
  * per-step offsets in page px.
  *
+ * `seekDx`/`seekDy` are an optional FIRST move made inside the same pointer-down,
+ * before the stepped walk, for a spec that must start the walk somewhere other
+ * than where the crosshair happens to sit. Doing it as part of the drag — rather
+ * than parking the crosshair from the backend first — is deliberate: the grab
+ * must hit-test against the renderer's own widget state, and a backend-side
+ * widget write is not guaranteed to be that state (a press on the redrawn
+ * crosshair delivered no pointer event at all; see `_test_aim_ready_position`).
+ *
  * Returns `{ start, end, moved }` (iframe-relative positions + the distance the
  * crosshair actually travelled) so the caller can ASSERT it moved — without
  * that guard a navigate-and-observe spec cannot tell a working navigator from a
  * press that missed.
  */
 async function dragCrosshair(page, win, { dx = -26, dy = 0, steps = 5,
+                                          seekDx = 0, seekDy = 0,
                                           settleMs = 450, onStep } = {}) {
   const box = await win.locator('iframe').first().boundingBox()
   const start = await crosshairAt(win)
   if (!box || !start) return { start: null, end: null, moved: 0 }
-  const gx = box.x + start.x, gy = box.y + start.y
-  await page.mouse.move(gx, gy)
+  const gx = box.x + start.x + seekDx, gy = box.y + start.y + seekDy
+  await page.mouse.move(box.x + start.x, box.y + start.y)
   await page.mouse.down()
+  if (seekDx || seekDy) {
+    await page.mouse.move(gx, gy, { steps: 6 })
+    await page.waitForTimeout(settleMs)
+  }
   for (let i = 1; i <= steps; i++) {
     await page.mouse.move(gx + dx * i, gy + dy * i, { steps: 3 })
     await page.waitForTimeout(settleMs)
diff --git a/electron/tests/progressive_signal_preview.spec.ts b/electron/tests/progressive_signal_preview.spec.ts
index 850b11ea..0d397d17 100644
--- a/electron/tests/progressive_signal_preview.spec.ts
+++ b/electron/tests/progressive_signal_preview.spec.ts
@@ -33,6 +33,7 @@ import { mkdirSync } from 'fs'
 import { join } from 'path'
 const {
   launchApp, backendAction, waitForSubwindowCount, sigWindow, dragCrosshair,
+  crosshairAt,
 } = require('./_harness.cjs')
 
 const SHOTS = join(__dirname, '..', 'progressive_signal_shots')
@@ -97,6 +98,15 @@ const logLines = (needle: string): string[] =>
 
 const finalized = () => logLines('[fv-batch] finalized').length > 0
 
+/**
+ * Has SPYDE_TEST_HOLD parked the batch? Part (a) samples the fill and part (b)
+ * needs it PARKED, so (a) must stop the moment the park lands: a parked batch
+ * produces no new blocks, so (a)'s "capture each repaint" loop would otherwise
+ * spin out its full budget against a frozen picture — and burn the hold's own
+ * MAX_HOLD_S (120 s) doing it, so (b) ran after the park had already expired.
+ */
+const parked = () => logLines('[test-hold] fv-batch parked').length > 0
+
 /**
  * `(N/M positions ready)` pairs from the AUTO-SAMPLE paint line — behaviour (a).
  *
@@ -129,10 +139,52 @@ function servedCount(): number {
   return m ? parseInt(m[1], 10) : 0
 }
 
+/**
+ * How many navigator-driven reads the preview has DECLINED (position not yet
+ * computed → the last good frame stays up), from the cumulative count on the
+ * backend's `navigator read declined` line.
+ *
+ * The diagnostic counterpart of `servedCount`: served and declined move
+ * together on the backend (`ProgressiveSignalPreview` counts every read one
+ * way or the other), so when a drag serves nothing this tells apart "the
+ * reads ran but were over uncomputed data" (declined moves) from "no read
+ * reached the preview at all" (neither moves — a wedged dispatcher or a grab
+ * that missed). The line is throttled (~2 s) but carries the CUMULATIVE
+ * count, and a multi-second all-declined drag always emits at least one.
+ */
+function declinedCount(): number {
+  const lines = logLines('navigator read declined')
+  if (!lines.length) return 0
+  const m = /(\d+) declined/.exec(lines[lines.length - 1])
+  return m ? parseInt(m[1], 10) : 0
+}
+
 // The crosshair drag itself lives in the harness (`dragCrosshair`): an
 // anyplotlib crosshair is GRABBED, not clicked to, so a press at an arbitrary
 // point moves nothing — see the helper's own note.
 
+/**
+ * The backend's `[test-aim] walk target …` line → where to walk, in NAV INDEX
+ * deltas from wherever the crosshair currently is.
+ *
+ * The backend picks the target (only it can see the ready mask) but does NOT
+ * move anything — the drag below does, with the mouse, from the crosshair the
+ * renderer actually drew. See `_test_aim_ready_position` for why the earlier
+ * "park it from the backend, then grab it" version could not work.
+ */
+function walkTarget(): { dix: number; diy: number; readyLeft: number;
+                         navW: number; navH: number } | null {
+  const line = logLines('[test-aim] walk target').pop()
+  if (!line) return null
+  const m = /dix=(-?\d+) diy=(-?\d+), (\d+) ready columns to the left; nav (\d+)x(\d+)/
+    .exec(line)
+  if (!m) return null
+  return {
+    dix: parseInt(m[1], 10), diy: parseInt(m[2], 10), readyLeft: parseInt(m[3], 10),
+    navW: parseInt(m[4], 10), navH: parseInt(m[5], 10),
+  }
+}
+
 test('the vectors signal plot fills in while the batch is still running', async () => {
   const { page } = ctx
 
@@ -182,6 +234,10 @@ test('the vectors signal plot fills in while the batch is still running', async
   for (let i = 0; i < 400 && !finalized(); i++) {
     const sig = await figureSignature(vecSig)
     const prog = previewProgress()
+    // Stop as soon as the hold parks the batch: no more blocks land, so no more
+    // repaints can be captured, and every further iteration spends the hold's
+    // own 120 s budget that part (b) below needs (see `parked`).
+    if (parked() && prog.length) break
     // Only start capturing once the PREVIEW has painted at least once —
     // before that the plot can still repaint for unrelated reasons (chrome,
     // the hover toolbar) and those frames say nothing about the fill.
@@ -239,17 +295,8 @@ test('the vectors signal plot fills in while the batch is still running', async
   const vecNav = results
     .filter({ has: page.getByTestId('window-breadcrumb').filter({ hasText: /^N-/ }) })
     .last()
-  // AIM AT THE COMPUTED BAND. `_slice_for_navigator` only serves a position
-  // `is_ready()` reports as computed, and the batch fills in NAV ORDER — so the
-  // ready region is the TOP rows of the count map. The crosshair starts at the
-  // CENTRE, and this walked left from there: at the ~880/13312 (6.6%) that was
-  // ready by this point it was dragging over uncomputed data by construction,
-  // and served 0 frames on CI and locally alike. Nothing to do with the drag.
-  //
-  // So: wait until a usable fraction has landed, then move the crosshair up
-  // into that band before measuring. The claim under test is "dragging over an
-  // ALREADY-COMPUTED region serves that region's frames", which needs the drag
-  // to actually be over one.
+  // The claim under test is "dragging over an ALREADY-COMPUTED region serves
+  // that region's frames", which needs the drag to actually be over one.
   // The batch is PARKED at ~35% by SPYDE_TEST_HOLD (see beforeAll and
   // backend/test_hold.py), so from here to the release below the partially
   // computed state is a fact rather than a race. Two earlier attempts at this
@@ -259,21 +306,64 @@ test('the vectors signal plot fills in while the batch is still running', async
   // to a batch that had already finished (`batch still running: false`).
   await ctx.backend.waitForLog('[test-hold] fv-batch parked', 240_000)
 
-  // Aim into the COMPUTED band. The batch fills in nav order, so ~35% ready is
-  // the top ~35% of rows; the crosshair starts at the CENTRE, and walking left
-  // from there dragged over uncomputed data by construction — which is why
-  // `served` stayed 0 no matter how the drag was tuned.
-  const navBox = await vecNav.locator('iframe').first().boundingBox()
-  await dragCrosshair(page, vecNav, {
-    dx: 0, dy: -Math.round((navBox?.height ?? 300) * 0.35), steps: 1,
-  })
+  // AIM FROM THE BACKEND'S OWN READY MASK — never from a fill-direction guess.
+  // An earlier version dragged the crosshair UP into "the top rows", assuming
+  // the batch fills row-major. It does not: dispatch_chunks submits in
+  // column-BANDED order (_band_key: 2-row bands, left→right), the sped_ag
+  // chunk grid is uneven (2×5 — the bottom-row chunks are 2.2× smaller and
+  // finish first), and completion order is scheduler-jittered across the
+  // primed in-flight window. So the parked ready set differs run to run, and
+  // the up-then-left walk sometimes crossed NO computed chunk at all: served
+  // stayed 0 and five identical DP signatures followed — the designed
+  // last-good-frame behaviour for uncomputed positions, not a serving bug
+  // (that CI failure is what `declinedCount` now makes diagnosable).
+  //
+  // `test_aim_ready_position` REPORTS a target from the live preview's ready
+  // mask (the ground truth its slice function serves from) as a nav-index
+  // DELTA from the crosshair's current position, near the right end of the
+  // longest computed run so the leftward walk stays over computed data. It
+  // moves nothing: a previous version parked the crosshair from the backend
+  // and the press on the redrawn crosshair delivered NO pointer event at all
+  // (zero nav-dispatcher submits — the renderer's widget state and the
+  // backend's had come apart), which read as a serving bug and was not one.
+  // The whole drag below is mouse-driven from the crosshair the renderer
+  // actually drew, which is the path vectors_dp_follows_nav.spec.ts already
+  // proves works on this same window.
+  //
+  // FOCUS-RAISE FIRST (the z-order trap): the first pointerdown on an
+  // unfocused subwindow raises it and is NOT delivered to the iframe widget —
+  // so a walk whose press doubles as the focus click grabs nothing and the
+  // crosshair never moves (observed: the hover readout walked to [0, 43]
+  // while the crosshair stayed parked).
+  await vecNav.getByTestId('subwindow-title').click()
+  await backendAction(page, 'test_aim_ready_position')
+  await ctx.backend.waitForLog('[test-aim] walk target', 30_000)
+  const target = walkTarget()
+  expect(target, 'the backend did not report a ready walk target').not.toBeNull()
+
+  // Nav index → page px, from the crosshair guide lines' own extent (they span
+  // the drawn image exactly, so that rect IS the navigator image on screen).
+  const geom = await crosshairAt(vecNav)
+  expect(geom, 'no crosshair found on the vectors navigator').not.toBeNull()
+  const pxPerCol = (geom!.x1 - geom!.x0) / target!.navW
+  const pxPerRow = (geom!.y1 - geom!.y0) / target!.navH
+  // Walk LEFT over the computed run, in 5 steps that each move at least a
+  // couple of nav columns (a sub-pixel step would repaint nothing).
+  const steps = 5
+  const colsPerStep = Math.max(
+    2, Math.floor(Math.min(target!.readyLeft - 2, 80) / steps))
+  const dxPx = -Math.max(3, Math.round(colsPerStep * pxPerCol))
+  // eslint-disable-next-line no-console
+  console.log('walk target:', JSON.stringify(target), 'px/col', pxPerCol.toFixed(2),
+              'px/row', pxPerRow.toFixed(2), 'step px', dxPx)
 
-  // Walk LEFT from there: the result window's right edge sits under the Plot
-  // Control dock, and a press that lands on the dock drives nothing.
   const servedBefore = servedCount()
+  const declinedBefore = declinedCount()
   const dragSigs: number[] = []
   const walk = await dragCrosshair(page, vecNav, {
-    dx: -26, steps: 5,
+    dx: dxPx, steps,
+    seekDx: Math.round(target!.dix * pxPerCol),
+    seekDy: Math.round(target!.diy * pxPerRow),
     onStep: async (i: number) => {
       dragSigs.push((await figureSignature(vecSig)).sum)
       await page.screenshot({ path: join(SHOTS, `8${i}-drag-step-${i}.png`) })
@@ -282,22 +372,55 @@ test('the vectors signal plot fills in while the batch is still running', async
 
   const stillRunning = !finalized()
   const servedAfter = servedCount()
+  const declinedAfter = declinedCount()
   await page.screenshot({ path: join(SHOTS, '90-drag-over-computed.png') })
   // eslint-disable-next-line no-console
   console.log('drag over computed region: crosshair moved', walk.moved, 'px',
               'signatures', JSON.stringify(dragSigs),
               'served', servedBefore, '→', servedAfter,
+              'declined', declinedBefore, '→', declinedAfter,
               'batch still running:', stillRunning)
+  if (servedAfter - servedBefore <= 0) {
+    // A zero-served drag has several distinct causes (reads declined, reads
+    // never ran, the preview torn down, the hold expired mid-test) that only
+    // the backend's own narration can tell apart — dump it before asserting.
+    // eslint-disable-next-line no-console
+    console.log('zero-served diagnostics:', JSON.stringify({
+      hold: logLines('[test-hold]').slice(-4),
+      aim: logLines('[test-aim]').slice(-3),
+      live: logLines('[live-signal]').slice(-8),
+      batch: logLines('[fv-batch]').slice(-4),
+    }, null, 1))
+  }
 
   // The guard the previous version of this spec lacked: if the crosshair never
-  // moved, everything below is measuring landing blocks, not the drag.
+  // moved, everything below is measuring landing blocks, not the drag. Scored
+  // against the walk this run actually asked for (the step size is derived from
+  // the reported ready run, so a fixed threshold would be arbitrary) — and half
+  // of it, not all, because the crosshair legitimately clamps at the image edge.
+  const askedPx = Math.hypot(
+    Math.round(target!.dix * pxPerCol) + dxPx * steps,
+    Math.round(target!.diy * pxPerRow))
   expect(walk.moved,
-    'the navigator crosshair never moved, so nothing about reading an '
-    + 'already-computed position was exercised').toBeGreaterThan(20)
+    `the navigator crosshair barely moved (${walk.moved.toFixed(1)} px of the `
+    + `${askedPx.toFixed(1)} px asked for), so nothing about reading an `
+    + 'already-computed position was exercised').toBeGreaterThan(askedPx / 2)
+  // Two failure modes, told apart BEFORE the real assertion: the backend
+  // counts every navigator read one way or the other (served or declined), so
+  // neither moving means the reads never reached the preview at all (a wedged
+  // dispatcher, a grab that missed) — a different bug from an aim that landed
+  // over uncomputed data (declined moves, served does not).
+  expect(
+    (servedAfter - servedBefore) + (declinedAfter - declinedBefore),
+    'no navigator read reached the live preview during the drag at all — the '
+    + 'read path was never exercised (this is NOT an aim/ready-region problem)',
+  ).toBeGreaterThan(0)
   // The backend answering navigator reads from its ready mask IS behaviour (b).
   expect(servedAfter - servedBefore,
-    'dragging the navigator over the computed region did not serve a single '
-    + 'frame from the already-computed vectors').toBeGreaterThan(0)
+    'dragging the navigator over the aimed READY region did not serve a single '
+    + `frame (declined ${declinedBefore} → ${declinedAfter}: the reads ran but `
+    + 'landed on uncomputed positions — the ready-mask aim failed)',
+  ).toBeGreaterThan(0)
   expect(new Set(dragSigs).size,
     `the diffraction pattern did not follow the navigator over the computed
      region (identical frames at every position): ${JSON.stringify(dragSigs)}`,
@@ -306,12 +429,135 @@ test('the vectors signal plot fills in while the batch is still running', async
     'the drag happened after the batch finished, so it proves nothing about '
     + 'reading a partially-computed result').toBeTruthy()
 
+  // ── (c) LETTING GO over an uncomputed position paints nothing ─────────────
+  // The other half of "the panel is the user's": a release where the batch has
+  // not reached must leave their last good frame up. Two things fire on it —
+  // the selector's settle re-fire (a FORCED read at the resting position) and
+  // whatever blocks land meanwhile — and neither may repaint. The batch is
+  // still PARKED here, so this isolates the release itself; the blocks-landing
+  // half is pinned by test_progressive_signal_preview.py (the sampler is off
+  // once `interaction_hooks` has latched ownership).
+  const farRight = Math.round(geom!.x1 - 4)
+  const navBox = (await vecNav.locator('iframe').first().boundingBox())!
+  const held = await crosshairAt(vecNav)
+  await page.mouse.move(navBox.x + held!.x, navBox.y + held!.y)
+  await page.mouse.down()
+  await page.mouse.move(navBox.x + farRight, navBox.y + held!.y, { steps: 8 })
+  // Long enough for the last SERVED frame of the jump to have painted (the
+  // paint is decoupled onto the newest-wins painter thread) — otherwise the
+  // baseline is a frame that was still in flight and the check below reads its
+  // late arrival as a repaint caused by the release.
+  await page.waitForTimeout(1200)
+  // Without this the whole check is vacuous: a press that missed the crosshair
+  // leaves the DP unchanged for the trivial reason that nothing navigated.
+  const landed = await crosshairAt(vecNav)
+  expect(Math.abs(landed!.x - held!.x),
+    'the crosshair did not move for the release check, so nothing about '
+    + 'letting go over an uncomputed position was exercised').toBeGreaterThan(10)
+  const beforeRelease = await figureSignature(vecSig)
+  await page.mouse.up()
+  const afterRelease: number[] = []
+  for (let i = 0; i < 8; i++) {           // ~2.4 s, well past the settle re-fire
+    await page.waitForTimeout(300)
+    afterRelease.push((await figureSignature(vecSig)).sum)
+  }
+  await page.screenshot({ path: join(SHOTS, '93-after-release-uncomputed.png') })
+  // eslint-disable-next-line no-console
+  console.log('release over uncomputed: before', beforeRelease.sum,
+              'after', JSON.stringify(afterRelease),
+              'ownership lines:', JSON.stringify(
+                logLines("panel is the user's").map((l: string) =>
+                  /navigator (\w+)/.exec(l)?.[1])))
+  // The claim above is only isolated while the batch is PARKED — once blocks
+  // land again a repaint at the user's own position is legitimate (the
+  // parked-position refresh). Fail with THAT diagnosis rather than a confusing
+  // pixel mismatch if the hold's own 120 s budget ran out first.
+  expect(logLines('[test-hold] fv-batch timed out').length
+         + logLines('[test-hold] fv-batch released').length,
+    'the hold expired before the release check, so blocks were landing again '
+    + 'and this measures the fill, not the release').toBe(0)
+  expect(new Set([beforeRelease.sum, ...afterRelease]).size,
+    'the vectors DP repainted after the crosshair was released over a position '
+    + 'the batch has not computed — the last good frame must stay up '
+    + `(${beforeRelease.sum} → ${JSON.stringify(afterRelease)})`).toBe(1)
+  // "grabbed", specifically: ownership must come from the POINTER EVENT
+  // (`BaseSelector.interaction_hooks`), not from a read that happened to arrive
+  // at a new index. Only the pointer path is set the instant the crosshair is
+  // touched, which is what makes a drag entirely over uncomputed data — where
+  // every read declines — end the auto-sampler at all. ("driven to …" is the
+  // read-based backstop and would also appear here; matching only "grabbed"
+  // proves the hook is wired to the selector the user actually drags.)
+  expect(logLines('navigator grabbed').length,
+    'the preview never took ownership from the pointer event, so the '
+    + 'auto-sampler is still live and a landing block can repaint the panel out '
+    + 'from under the user'
+  ).toBeGreaterThan(0)
+
+  // ── (d) the window is CLOSED for business while it fills ──────────────────
+  // The tree is locked for the duration of the batch (no actions, no new
+  // nodes), which is what makes the preview's install-once link snapshot valid.
+  // The backend refuses a click either way, but a button that looks clickable
+  // and then errors is a worse app than one that shows it is unavailable — so
+  // the toolbar config carries `disabled` while locked. The toolbar is
+  // reveal-on-hover, hence the hover before looking.
+  await vecSig.getByTestId('subwindow-title').click()
+  await vecSig.getByTestId('subwindow-titlebar').hover()
+  const lockedBtn = vecSig.getByTestId(/^action-btn-/).first()
+  await expect(lockedBtn).toBeVisible({ timeout: 10_000 })
+  await page.screenshot({ path: join(SHOTS, '95-toolbar-greyed-while-filling.png') })
+  const lockedButtons = await vecSig.getByTestId(/^action-btn-/).all()
+  const lockedNames: string[] = []
+  for (const btn of lockedButtons) {
+    lockedNames.push((await btn.getAttribute('data-testid'))!
+      .replace('action-btn-', ''))
+    await expect(btn, 'a toolbar button stayed enabled on a window whose '
+      + 'find-vectors batch is still filling it').toBeDisabled()
+  }
+  // eslint-disable-next-line no-console
+  console.log('toolbar while locked:', JSON.stringify(lockedNames))
+  // The VECTOR actions belong here too — greyed, not absent. `requires_vectors`
+  // gates on the container `_finalize` attaches, which on THIS window means
+  // "still computing", not "wrong data"; hiding made them pop into existence
+  // when the batch finished (measured: 4 buttons during the fill, 7 after).
+  for (const name of ['Strain Mapping', 'Vector Orientation Mapping',
+                      'Vector Virtual Imaging']) {
+    expect(lockedNames,
+      `${name} was HIDDEN on the window its own find-vectors batch is filling `
+      + '— a requires_vectors action must be shown-and-greyed while the tree is '
+      + 'locked, so it un-greys instead of popping in').toContain(name)
+  }
+
   // Let the batch finish before the app closes (closing mid-batch wedges the
   // hidden backend's stdin tick — see find_vectors_workflow.spec.ts).
   // Let the parked batch run to completion — without this the finalize wait
   // below would sit until the hold's own MAX_HOLD_S timeout.
   await backendAction(page, 'test_hold_release', { name: 'fv-batch' })
   await ctx.backend.waitForLog('[fv-batch] finalized', 420_000)
+
+  // …and the lock RELEASES: the SAME buttons come back live once the vectors
+  // attach. The same SET, not merely the same first button — finishing the
+  // batch must change `disabled` and nothing else, or the toolbar reshuffles
+  // under the cursor at the moment the run ends.
+  await vecSig.getByTestId('subwindow-titlebar').hover()
+  await expect(vecSig.getByTestId(/^action-btn-/).first(),
+    'the toolbar stayed greyed after the batch finished — the lock was not '
+    + 'released, or its release did not re-send the toolbar config',
+  ).toBeEnabled({ timeout: 30_000 })
+  await page.screenshot({ path: join(SHOTS, '96-toolbar-restored.png') })
+  const finalButtons = await vecSig.getByTestId(/^action-btn-/).all()
+  const finalNames: string[] = []
+  for (const btn of finalButtons) {
+    finalNames.push((await btn.getAttribute('data-testid'))!
+      .replace('action-btn-', ''))
+    await expect(btn, 'a toolbar button stayed disabled after the vectors '
+      + 'attached').toBeEnabled()
+  }
+  // eslint-disable-next-line no-console
+  console.log('toolbar after finalize:', JSON.stringify(finalNames))
+  expect(finalNames.slice().sort(),
+    'the toolbar gained or lost buttons when the batch finished — the vector '
+    + 'actions must be present-and-greyed throughout and simply un-grey',
+  ).toEqual(lockedNames.slice().sort())
   await expect.poll(() => figureSignature(vecSig).then((s) => s.bright), {
     timeout: 30_000, message: 'the finalized vectors window is blank',
   }).toBeGreaterThan(0)
diff --git a/spyde/actions/README.md b/spyde/actions/README.md
index 8630e169..4b6ecc43 100644
--- a/spyde/actions/README.md
+++ b/spyde/actions/README.md
@@ -99,7 +99,34 @@ click ──► toolbar gate (plot_control_toolbar filters)
 **The basis set** ([`lifecycle.py`](lifecycle.py)) — use these, never re-roll:
 `run_on_worker`, `bump_generation`/`is_current`, `resolve_vectors`,
 `wait_for_vectors`, `replace_tree_attr`, `paint_signal_plots`,
-`progress_emitter`, `live_fill_poller`.
+`progress_emitter`, `live_fill_poller`, `lock_tree`/`unlock_tree`/
+`refuse_if_locked`.
+
+**A progressively-filled result tree is LOCKED while its batch runs**
+(`lock_tree(tree, "<action>")` where the window opens; `unlock_tree` where the
+result attaches AND in the run's teardown, so a cancelled run cannot strand
+it). No actions and no new nodes on that tree until it finishes — the toolbar
+invoker, the staged dispatch and `BaseSignalTree.add_node` /
+`add_transformation` all call `refuse_if_locked`, which errors at the user
+rather than no-op'ing silently. Any NEW path that adds a node or runs an
+action must call it too. The toolbar shows it: every action descriptor
+carries `disabled` + `disabled_reason` while locked (DISABLED, not hidden —
+hiding says "does not apply to this data", where the lock says "not yet"),
+and lock/unlock re-send the config for every plot of the tree so the buttons
+grey at the START of the fill and restore at the end. The lock also relaxes
+one gate: `requires_vectors` actions are SHOWN (and disabled) while locked
+instead of filtered out, because on the window a Find-Vectors batch is filling
+that gate is answering "the container attaches at `_finalize`", not "wrong
+data" — hiding made them pop into existence when the run ended. The backend
+refusal stays as the backstop. Read-only re-emits and
+teardown verbs
+(`*_query`/`*_close`/`*_stop`/`*_cancel`) are exempt — `registry.
+is_lock_exempt`: the renderer fires `overlay_query` itself on focus changes,
+and a lock that can trap a caret open is worse than no lock. The lock is not
+housekeeping: it is why
+`live_signal`'s install-once snapshot of the navigator→signal links is valid
+by construction, and therefore why the Live-Display nav read needs no
+per-read re-check.
 
 **The two tree-spawning doors** ([`commit.py`](commit.py)):
 `open_result_tree` (window opens early, blank, progressively filled — FV count
diff --git a/spyde/actions/find_vectors_action.py b/spyde/actions/find_vectors_action.py
index 61f75d27..d3db858d 100644
--- a/spyde/actions/find_vectors_action.py
+++ b/spyde/actions/find_vectors_action.py
@@ -244,6 +244,14 @@ def _paint(arr):
         sig_hw=(int(am.signal_axes[1].size), int(am.signal_axes[0].size)),
         kernel_radius_px=float(p.get("kernel_radius", 5)),
     )
+    # LOCK the result tree for the duration of the batch: no actions, no new
+    # nodes. That constraint is what makes the preview's install-once snapshot
+    # valid by construction — the set of navigator→signal links it just captured
+    # cannot change while the tree is locked, so the interactive fill needs no
+    # re-check on the nav read path. Released in _finalize (where the vectors
+    # attach) and again in the teardown below.
+    from spyde.actions.lifecycle import lock_tree, unlock_tree
+    lock_tree(new_tree, "Find Diffraction Vectors")
     preview = attach_signal_preview(
         session, new_tree, render=live_frames.render,
         nav_shape=nav_shape_full, name="fv-signal",
@@ -323,6 +331,11 @@ def _work():
             if preview is not None:
                 preview.close()
             live_frames.clear()
+            # Release the compute lock unconditionally. _finalize already did on
+            # the success path; this is the one that matters when the batch was
+            # cancelled or raised — a stranded lock would leave the window
+            # refusing every action for the rest of the session.
+            unlock_tree(new_tree)
             new_tree._fv_batch_running = False
             src_tree._fv_batch_running = False
             # Reset the workers' RSS accounting after the batch churn — see
@@ -456,8 +469,13 @@ def _finalize(tree, vecs) -> None:
         tree.root._clear_cache_dask_data()
     except Exception as e:
         log.debug("clearing stale cached dask array failed: %s", e)
-    from spyde.actions.lifecycle import attach_container
+    from spyde.actions.lifecycle import attach_container, unlock_tree
     attach_container(tree, vecs, name="diffraction_vectors")
+    # The result has landed, so the window is a whole dataset again: release the
+    # compute lock HERE, alongside the attach it guards (a batch that fails or is
+    # cancelled never reaches this line, which is why _start_batch's teardown
+    # unlocks too — lifecycle.unlock_tree is idempotent).
+    unlock_tree(tree)
 
     # Paint the count map onto the SPATIAL (2-D) navigator plot. For a 5-D stack
     # the navigator is multi-level; _first_nav_plot may return the OUTER (1-D
diff --git a/spyde/actions/lifecycle.py b/spyde/actions/lifecycle.py
index cdce3593..2afd7b8a 100644
--- a/spyde/actions/lifecycle.py
+++ b/spyde/actions/lifecycle.py
@@ -279,6 +279,105 @@ def seg_batch_running(session) -> bool:
     return False
 
 
+# ── the result-tree compute lock ──────────────────────────────────────────────
+
+#: Attribute a progressive action sets on its result tree while its batch runs.
+#: Per-run state lives on the TREE (ownership map, ``actions/README.md`` §3), so
+#: ``BaseSignalTree.close()`` takes it down with everything else.
+TREE_LOCK_ATTR = "_compute_lock"
+
+
+def refresh_toolbars(tree) -> None:
+    """Re-send the toolbar config for EVERY plot of *tree* (signal + navigator).
+
+    Both plot kinds, deliberately: the navigator's own actions (Add Selector,
+    FFT, Line Profile) act on the same tree and Add Selector would add the very
+    navigator→signal link the lock exists to freeze, so greying only the signal
+    window would leave the one button that breaks the invariant live.
+
+    Safe from any thread — it only emits (CLAUDE.md: ``ipc.emit*`` is
+    thread-safe), which is what lets the batch worker call it at finalize.
+    """
+    plots = list(getattr(tree, "signal_plots", []) or [])
+    npm = getattr(tree, "navigator_plot_manager", None)
+    for plot_list in (getattr(npm, "plots", {}) or {}).values():
+        plots.extend(plot_list or [])
+    for plot in plots:
+        try:
+            state = getattr(plot, "plot_state", None)
+            if state is not None and hasattr(state, "_send_toolbar_config"):
+                state._send_toolbar_config()
+        except Exception as e:
+            log.debug("re-sending toolbar config failed: %s", e)
+
+
+def lock_tree(tree, label: str) -> None:
+    """Lock *tree* while a progressive compute fills it.
+
+    A progressively-filled result window is only half-built: its root is a
+    placeholder, its result object (``diffraction_vectors``…) attaches at
+    finalize, and its navigator→signal link is temporarily owned by the live
+    preview (``live_signal.ProgressiveSignalPreview``). Adding a node or running
+    an action on it mid-fill therefore acts on a signal that is about to be
+    replaced.
+
+    Locking is also what makes the preview's install-once correct BY
+    CONSTRUCTION: with the tree closed to new nodes and actions for the duration
+    of the batch, the set of navigator→signal links cannot change after
+    ``install()`` snapshots it — so the interactive-fill path needs no re-check,
+    and in particular the Live-Display nav read (CLAUDE.md §3) gets no per-read
+    branch.
+
+    Taking the lock RE-SENDS the toolbar config, so the buttons grey out at the
+    START of the fill rather than only at the end — the whole point is that a
+    user never clicks something that will refuse them.
+    """
+    if tree is None or getattr(tree, TREE_LOCK_ATTR, None) == str(label):
+        return
+    setattr(tree, TREE_LOCK_ATTR, str(label))
+    refresh_toolbars(tree)
+
+
+def unlock_tree(tree) -> None:
+    """Release :func:`lock_tree` and restore the toolbar.
+
+    Idempotent — safe on an unlocked tree, which is what lets the batch clear it
+    both where the result attaches and again in its teardown (a cancelled or
+    failed run must never strand a locked tree). The toolbar re-send happens
+    only on the transition, so the second call costs nothing.
+    """
+    if tree is None or getattr(tree, TREE_LOCK_ATTR, None) is None:
+        return
+    setattr(tree, TREE_LOCK_ATTR, None)
+    refresh_toolbars(tree)
+
+
+def tree_lock(tree) -> str | None:
+    """The label of the compute holding *tree*, or ``None`` when it is free."""
+    return getattr(tree, TREE_LOCK_ATTR, None) or None
+
+
+def refuse_if_locked(tree, what: str) -> bool:
+    """THE gate. Returns True — and tells the user why — when *tree* is locked.
+
+    Every path that would add a node to a tree or run an action on one calls
+    this and bails on True: the toolbar-action invoker, the staged-wizard
+    dispatch, and ``BaseSignalTree.add_node`` / ``add_transformation``. One
+    helper, not scattered checks, so a new entry point either calls it or is
+    visibly missing it.
+
+    Refusal is a user-facing error, never a silent no-op: a button that does
+    nothing reads as a broken app.
+    """
+    label = tree_lock(tree)
+    if not label:
+        return False
+    from spyde.backend.ipc import emit_error
+    emit_error(f"{what} is unavailable while '{label}' is still computing into "
+               f"this window — wait for it to finish.")
+    return True
+
+
 # ── overlays / painting ───────────────────────────────────────────────────────
 
 def replace_tree_attr(tree, attr: str, factory: Callable[[], Any] | None):
diff --git a/spyde/actions/live_signal.py b/spyde/actions/live_signal.py
index 86a07ab7..a71b824b 100644
--- a/spyde/actions/live_signal.py
+++ b/spyde/actions/live_signal.py
@@ -21,6 +21,33 @@
       the last good frame stays up (no flash) exactly like the expensive-tier nav
       read (CLAUDE.md Live-Display §3).
 
+**(b) BEATS (a), permanently.** The first time the user TOUCHES this window's
+navigator, ``_user_owns`` latches and the auto-sample flash stops for the rest of
+the run — the signal panel belongs to them from then on. It is not a timed hold:
+a hold resumes the flash the moment the user pauses to look at what they
+navigated to, which is exactly when it must not. The navigator count map keeps
+filling visibly either way; only the sample paint stops.
+
+**The latch reads the POINTER EVENT, not the read.** It rides
+``BaseSelector.interaction_hooks``, fired by the widget handlers before anything
+is queued, so it is set the instant the crosshair is grabbed — whatever the read
+then does. Inferring it from the reads instead ("a read arrived at a new index,
+so the user must have dragged") has holes that all surface as the same symptom:
+a landing block repainting the panel just as the user lets go. ``_run_update``
+short-circuits a repeat position, so a grab that ends where it began produces no
+changed index at all; a drag entirely over not-yet-computed data produces only
+declines; and the dispatcher coalesces, so intermediate positions never reach the
+preview. The changed-index check is KEPT below as a backstop for a crosshair
+moved without a pointer event (a programmatic set, a linked selector) — it can
+only latch later than the hook, never instead of it.
+
+**Install-once is valid because the tree is LOCKED.** ``install()`` snapshots the
+navigator→signal links ONCE. That is sound only because the progressive action
+locks its result tree for the duration of the batch (``lifecycle.lock_tree``): no
+actions, no new nodes, hence no new links. The alternative — re-checking on every
+navigator read — would put a branch on the Live-Display hot path for a case that
+cannot happen.
+
 The action supplies only ``render(index) -> ndarray | None``; readiness tracking,
 sampling, throttling, the thread marshal and the handover to the final display
 live here so every progressive action gets identical behaviour.
@@ -53,10 +80,6 @@
 #: blocks per second; painting each one is pure transport churn).
 SAMPLE_MIN_INTERVAL = 0.45
 
-#: Seconds after a navigator-driven read during which auto-sampling stays quiet,
-#: so a landing block cannot yank the frame out from under a user who is dragging.
-USER_HOLD = 2.0
-
 #: Minimum seconds between two INFO narration lines (the paints are faster).
 LOG_MIN_INTERVAL = 2.0
 
@@ -81,6 +104,22 @@ def _block_sample_index(nav_slices: Sequence[slice]) -> tuple[int, ...]:
     return tuple(int(rng.integers(lo, max(lo + 1, hi))) for lo, hi in bounds)
 
 
+def _hook_targets(selector) -> list:
+    """Every object whose pointer events count as "the user touched *selector*".
+
+    Normally just the selector. A ``CompositeSelector`` (the 5-D navigator's
+    crosshair + rectangle pair) is the exception: it owns no widget of its own
+    and delegates unknown attributes to whichever sub-selector is ACTIVE, so a
+    hook registered through it would reach exactly one of the two — and would
+    silently stop being reachable the moment the user toggled Integrate. Each
+    sub-selector has its own widget and its own hook list, so register on both.
+    """
+    subs = [getattr(selector, name, None)
+            for name in ("_crosshair_selector", "_rect_selector")]
+    subs = [s for s in subs if s is not None]
+    return subs or [selector]
+
+
 class ProgressiveSignalPreview:
     """Live signal-plot preview for one progressively-filled result tree.
 
@@ -95,13 +134,12 @@ class ProgressiveSignalPreview:
     def __init__(self, session, tree, *, render: Callable[[tuple], Any],
                  nav_shape: Sequence[int],
                  sample_interval: float = SAMPLE_MIN_INTERVAL,
-                 user_hold: float = USER_HOLD, name: str = "live-signal"):
+                 name: str = "live-signal"):
         self.session = session
         self.tree = tree
         self.render = render
         self.nav_shape = tuple(int(s) for s in nav_shape)
         self.sample_interval = float(sample_interval)
-        self.user_hold = float(user_hold)
         self.name = name
 
         self.n_positions = int(np.prod(self.nav_shape))
@@ -109,9 +147,31 @@ def __init__(self, session, tree, *, render: Callable[[tuple], Any],
         self._lock = threading.Lock()
         self._closed = False
         self._last_paint = 0.0
-        self._last_user = 0.0
+        #: LATCH: set the first time the user TOUCHES this window's navigator,
+        #: and never cleared. From then on the signal panel is theirs — a
+        #: landing block may no longer paint a sample frame over what they are
+        #: looking at, and letting go over a position the batch has not reached
+        #: leaves their last good frame up rather than a sample of somewhere
+        #: else. The navigator COUNT MAP keeps filling regardless; only the
+        #: auto-sample "flash" stops. (This was a 2-second hold, which meant the
+        #: flash resumed and stole the panel back the moment the user paused.)
+        self._user_owns = False
+        #: The last nav index a navigator read asked for, so a genuine MOVE can
+        #: be told from a re-fire at the SAME position. Our own re-fires (the
+        #: parked-position refresh, the selector's settle timer) are forced
+        #: updates at an unchanged index and must NOT latch — otherwise the
+        #: first block landing under a resting crosshair would end auto-sampling
+        #: without the user having touched anything. BACKSTOP only: the pointer
+        #: hook (`_on_user_interaction`) is the primary latch.
+        self._last_index: tuple[int, ...] | None = None
+        # ONE bound method per preview, for the same identity reason as
+        # `slice_fn` below — install() appends it to each selector's
+        # `interaction_hooks` and close() must be able to remove that exact
+        # object again.
+        self.interaction_hook = self._on_user_interaction
         self._last_log = 0.0
         self._last_serve_log = 0.0
+        self._last_decline_log = 0.0
         self._installed: list[tuple[Any, Any, Any]] = []
         # ONE bound method, kept for the lifetime of the preview: `self._slice_fn`
         # builds a fresh bound object on every attribute access, so the identity
@@ -183,8 +243,8 @@ def _maybe_paint(self, index: tuple[int, ...]) -> None:
         now = time.monotonic()
         if now - self._last_paint < self.sample_interval:
             return
-        if now - self._last_user < self.user_hold:
-            return          # the user is driving the navigator — stay out of it
+        if self._user_owns:
+            return          # the user drove the navigator — the panel is theirs
         frame = None
         try:
             frame = self.render(index)
@@ -277,6 +337,62 @@ def _refresh_parked_position(self, nav_slices: Sequence[slice]) -> bool:
                 log.debug("[%s] re-firing parked selector failed: %s", self.name, e)
         return hit
 
+    def _decline(self, index, now: float):
+        """Count + narrate a navigator read the preview could NOT answer.
+
+        Narrated at INFO (throttled like the serve line, first one always) so a
+        drag that serves NOTHING is distinguishable in the log from a drag that
+        never reached the backend at all — the e2e spec's served-count went 0→0
+        once and the log could not say whether the reads were declined (drag
+        over uncomputed data) or never ran. The index says WHERE the drag
+        actually read; the cumulative counts make the line parseable the same
+        way as the serve line."""
+        self.reads_declined += 1
+        if self.reads_declined == 1 or now - self._last_decline_log >= LOG_MIN_INTERVAL:
+            self._last_decline_log = now
+            log.info("[live-signal] %s: navigator read declined at %s — position "
+                     "not yet computed (%d/%d positions ready, %d served / "
+                     "%d declined)", self.name, index, self.ready_count,
+                     self.n_positions, self.frames_served, self.reads_declined)
+        return None
+
+    def _take_ownership(self, why: str) -> None:
+        """Hand the signal panel to the user, permanently. Idempotent."""
+        if self._user_owns:
+            return
+        self._user_owns = True
+        log.info("[live-signal] %s: navigator %s — the signal panel is the "
+                 "user's for the rest of this run (auto-sampling stops; the "
+                 "count map keeps filling)", self.name, why)
+
+    def _on_user_interaction(self, selector) -> None:
+        """THE latch — a pointer event on a navigator this preview is installed
+        on (``BaseSelector.interaction_hooks``).
+
+        Fires on the event thread before the read is even queued, so ownership
+        is decided by the TOUCH and not by what the read returns. That is the
+        whole point: a drag over data the batch has not reached yet returns
+        nothing at all, and if ownership waited for a served frame the sampler
+        would still be live when the user let go and the next landing block
+        would repaint the panel out from under them.
+        """
+        self._take_ownership("grabbed")
+
+    def _note_read_position(self, index) -> None:
+        """Backstop latch: a navigator read arrived at a NEW position.
+
+        Covers a crosshair moved WITHOUT a pointer event (a programmatic set, a
+        linked selector driving this one). Our own re-fires — the parked-position
+        refresh, the selector's settle timer — are forced reads at an UNCHANGED
+        index and must not latch, or the first block landing under a resting
+        crosshair would end auto-sampling with nobody having touched anything.
+        """
+        if index is None:
+            return
+        if self._last_index is not None and index != self._last_index:
+            self._take_ownership(f"driven to {index}")
+        self._last_index = index
+
     def _slice_fn(self, selector, child, indices):
         """Render an already-computed position on demand.
 
@@ -285,18 +401,16 @@ def _slice_fn(self, selector, child, indices):
         as "nothing to paint" — the last good frame stays up.
         """
         now = time.monotonic()
-        self._last_user = now
         if self._closed:
             return None
         try:
             index = self._resolve_index(indices)
+            self._note_read_position(index)
             if index is None or not self.is_ready(index):
-                self.reads_declined += 1
-                return None
+                return self._decline(index, now)
             frame = self.render(index)
             if frame is None:
-                self.reads_declined += 1
-                return None
+                return self._decline(index, now)
             self.frames_served += 1
             # Narrate the READ path separately from the auto-sample paint above:
             # this line is the only direct evidence that dragging the navigator
@@ -333,6 +447,29 @@ def install(self) -> bool:
                 self._installed.append((sel, child, sel.children[child]))
                 sel.children[child] = self.slice_fn
                 child.needs_auto_level = True
+                # Latch on the TOUCH. Guarded because a selector with two
+                # signal children would otherwise get the hook twice.
+                for target in _hook_targets(sel):
+                    if self.interaction_hook not in target.interaction_hooks:
+                        target.interaction_hooks.append(self.interaction_hook)
+            # Seed the BACKSTOP latch's reference position from where the
+            # crosshair ALREADY sits, so a programmatic move is recognised as a
+            # move (with no seed the first read only establishes the baseline and
+            # the backstop would trail one position behind).
+            if self._last_index is None:
+                try:
+                    self._last_index = self._resolve_index(sel.current_indices)
+                except Exception as e:
+                    log.debug("[%s] seeding the latch position failed: %s",
+                              self.name, e)
+        if self._installed:
+            # WHICH links were captured is the first thing to check when a drag
+            # over computed data shows nothing, and the count alone answers it:
+            # 0 links means the swap missed the window entirely. (attach_signal_
+            # preview narrates the legitimate 0 case — a navigator-less IPF
+            # window — at DEBUG.)
+            log.info("[live-signal] %s: installed on %d navigator→signal link(s)",
+                     self.name, len(self._installed))
         return bool(self._installed)
 
     # ── teardown ─────────────────────────────────────────────────────────────
@@ -354,6 +491,16 @@ def close(self) -> None:
                     sel.children[child] = prev
             except Exception as e:
                 log.debug("[%s] restoring slice fn failed: %s", self.name, e)
+            try:
+                # Unconditionally, unlike the slice function above: the hook is
+                # ours alone, so leaving it behind would keep a dead preview
+                # attached to a live selector for the session.
+                for target in _hook_targets(sel):
+                    if self.interaction_hook in target.interaction_hooks:
+                        target.interaction_hooks.remove(self.interaction_hook)
+            except Exception as e:
+                log.debug("[%s] removing interaction hook failed: %s",
+                          self.name, e)
         self._installed = []
         if getattr(self.tree, "_live_signal_preview", None) is self:
             self.tree._live_signal_preview = None
diff --git a/spyde/actions/registry.py b/spyde/actions/registry.py
index c7aaa97e..ec21cbb9 100644
--- a/spyde/actions/registry.py
+++ b/spyde/actions/registry.py
@@ -214,6 +214,27 @@
 }
 
 
+# Staged verbs that must run even on a tree LOCKED by a progressive compute
+# (lifecycle.refuse_if_locked). Two kinds, and both matter:
+#
+#   * READ-ONLY re-emits (`*_query`). The renderer fires these ITSELF — the Plot
+#     Control dock sends `overlay_query` whenever the active window changes — so
+#     refusing one puts an error in the status bar that the user never asked for
+#     ("'overlay_query' is unavailable while 'Find Diffraction Vectors' is still
+#     computing…", observed on every progressive fill) and leaves the dock's
+#     layer state stale. A query cannot add a node or a navigator→signal link,
+#     which is all the lock exists to prevent.
+#   * TEARDOWN (`*_close`, `*_stop`, `*_cancel`). A caret must always be able to
+#     shut, and a running movie/export must always be cancellable; a lock that
+#     can trap a wizard open is worse than no lock.
+_ALWAYS_ALLOWED_SUFFIXES = ("_query", "_close", "_stop", "_cancel")
+
+
+def is_lock_exempt(name: str) -> bool:
+    """Does this staged action run even while its tree is locked? See above."""
+    return str(name).endswith(_ALWAYS_ALLOWED_SUFFIXES)
+
+
 def resolve_staged(name: str) -> Callable | None:
     """Lazily import and return the handler for a staged action name."""
     dotted = STAGED_HANDLERS.get(name)
diff --git a/spyde/backend/_session_actions.py b/spyde/backend/_session_actions.py
index 4a26a395..fc752e78 100644
--- a/spyde/backend/_session_actions.py
+++ b/spyde/backend/_session_actions.py
@@ -39,7 +39,7 @@
     "load_test_data_eels", "load_test_data_eds", "load_test_data_ebsd",
     "load_test_data_line", "load_test_data_movie", "load_test_data_5d",
     "load_test_data_particles",
-    "test_nav_drag",
+    "test_nav_drag", "test_aim_ready_position",
     "test_region_scrub", "test_add_second_navigator",
     "load_test_vectors", "run_test_orientation", "dump_dask_state",
 })
@@ -153,6 +153,12 @@ def dispatch_action(self, msg: dict) -> None:
             self._load_test_data_particles(payload)
         elif action == "test_add_second_navigator":
             self._test_add_second_navigator()
+        elif action == "test_aim_ready_position":
+            # REPORT where a crosshair walk over already-computed data should go
+            # on a progressive result window (from the live preview's ready
+            # mask) — see _session_testharness. Read-only and synchronous: it
+            # logs a target and moves nothing.
+            self._test_aim_ready_position()
         elif action == "test_nav_drag":
             # Run on a BACKGROUND thread: the drag loop sleeps/polls, and if it ran
             # on the main asyncio thread it would block loop.call_soon_threadsafe —
@@ -185,6 +191,17 @@ def dispatch_action(self, msg: dict) -> None:
             # e.g. {component: "eyy"} silently resolved to nothing.
             if "window_id" not in payload and window_id is not None:
                 payload = {**payload, "window_id": window_id}
+            # Dispatch path 2 of 2 through the result-tree compute lock (the
+            # toolbar invoker below is path 1): a staged wizard opened on a
+            # window whose batch is still filling it would tune/run against a
+            # placeholder root. Same helper, so neither path can drift.
+            # Read-only re-emits and teardown verbs are exempt — see
+            # registry.is_lock_exempt.
+            from spyde.actions.lifecycle import refuse_if_locked
+            from spyde.actions.registry import is_lock_exempt
+            if not is_lock_exempt(action) and refuse_if_locked(
+                    getattr(plot, "signal_tree", None), f"'{action}'"):
+                return
             resolve_staged(action)(self, plot, payload)
         elif action == "run_test_orientation":
             # Test-only: run Orientation Mapping with a built-in phase (no CIF
@@ -322,6 +339,14 @@ def _dispatch_toolbar_action(self, plot, name: str, params: dict) -> None:
             emit_error("Toolbar action: no active plot or action name")
             return
 
+        # Dispatch path 1 of 2 through the result-tree compute lock (the staged
+        # dispatch in dispatch_action is path 2). While a progressive batch is
+        # filling this tree it owns the window: the root is a placeholder and the
+        # navigator→signal link belongs to the live preview.
+        from spyde.actions.lifecycle import refuse_if_locked
+        if refuse_if_locked(getattr(plot, "signal_tree", None), f"'{name}'"):
+            return
+
         # Actions whose modules still carry the Qt/interactive implementation and
         # haven't been ported to the host-agnostic template yet. Clicking them
         # gives a clear message instead of a confusing Qt-without-QApplication
diff --git a/spyde/backend/_session_testharness.py b/spyde/backend/_session_testharness.py
index 7d9afc20..c9376803 100644
--- a/spyde/backend/_session_testharness.py
+++ b/spyde/backend/_session_testharness.py
@@ -24,6 +24,42 @@
 log = logging.getLogger(__name__)
 
 
+def _ready_walk_target(mask: np.ndarray):
+    """The nav position a leftward crosshair walk should START from, given a
+    boolean ready mask: ``(iy, ix, ready_left)`` near the right end of the
+    longest contiguous ready run in any row, or ``None`` when nothing is ready.
+
+    Starting near a run's right end means a walk of up to ``ready_left``
+    columns to the LEFT reads only computed positions — which is what
+    ``_test_aim_ready_position`` promises the e2e spec. The start is backed off
+    a quarter-run from the run's true right end, so the walk begins inside the
+    computed region rather than on its boundary (where one pixel of rounding in
+    the spec's index→screen conversion lands it on uncomputed data).
+    Leading (stack) nav dims are collapsed at index 0: the aim describes the
+    SPATIAL crosshair only.
+    """
+    m = np.asarray(mask, dtype=bool)
+    if m.ndim > 2:
+        m = m[(0,) * (m.ndim - 2)]
+    if m.ndim == 1:
+        m = m[None, :]
+    if not m.any():
+        return None
+    best = None       # (run_len, iy, stop)
+    for iy in range(m.shape[0]):
+        row = m[iy]
+        # Run-length encode: boundaries where the value changes.
+        edges = np.flatnonzero(np.diff(np.concatenate(([0], row.astype(np.int8),
+                                                       [0]))))
+        for start, stop in zip(edges[::2], edges[1::2]):
+            run = int(stop - start)
+            if best is None or run > best[0]:
+                best = (run, iy, int(stop))
+    run, iy, stop = best
+    back = run // 4
+    return iy, stop - 1 - back, run - back
+
+
 class TestHarnessMixin:
     def _dump_dask_state(self, only: str | None = None) -> None:
         """Log a compact snapshot of the dask cluster's state at WARNING level
@@ -563,6 +599,85 @@ def _test_add_second_navigator(self) -> None:
             log.exception("test_add_second_navigator failed")
             emit_error(f"test_add_second_navigator failed: {e}")
 
+    def _test_aim_ready_position(self) -> None:
+        """Test-only: REPORT where a crosshair walk over already-computed data
+        should go on a PROGRESSIVE result window — it does not move anything.
+
+        Narrates one line the e2e spec parses::
+
+            [test-aim] walk target iy=44 ix=98 from iy=32 ix=104
+                       (dix=-6 diy=12, 99 ready columns to the left;
+                        nav 208x64; 7152/13312 positions ready)
+
+        Why the spec cannot pick the target itself: the progressive fill's
+        *geometry* is not knowable from outside. ``dispatch_chunks`` submits
+        chunks in column-BANDED order (``_band_key``: 2-row bands, left→right),
+        the chunk grid is uneven (sped_ag: 2×5, the bottom-row chunks 2.2×
+        smaller and so faster), and completion order is scheduler-jittered
+        across the primed in-flight window — so "the ready region is the top
+        rows" (what the spec used to assume and drag towards) is wrong in every
+        regime, and the exact ready set at a ``SPYDE_TEST_HOLD`` park differs
+        run to run. The preview's ``_ready`` mask IS the ground truth its slice
+        function serves from; aiming from anything else is a guess.
+
+        **Why it REPORTS instead of moving the crosshair.** The first version
+        wrote the widget server-side (``w.set(cx=…, cy=…)``) and left the spec
+        to grab the moved crosshair. Measured result: the renderer drew the
+        crosshair at the new position, the Playwright press landed exactly on
+        it, and NO pointer event reached the backend — zero
+        ``update_data`` submits for that selector, so the preview served
+        nothing and the spec failed claiming a routing bug that did not exist.
+        The crosshair then snapped back to its pre-aim position (the drag's
+        measured travel was exactly the aim's own displacement, reversed). A
+        backend-side widget write and the renderer's own widget state had come
+        apart, so the press hit-tested against a position the renderer no
+        longer agreed with.
+
+        Reporting keeps the two in step by construction: the spec grabs the
+        crosshair where the RENDERER draws it and moves it with the mouse, which
+        is the path a user takes and the path
+        ``vectors_dp_follows_nav.spec.ts`` already proves works on this same
+        window. Everything here is expressed as a DELTA from the crosshair's
+        current position for the same reason — the spec converts nav indices to
+        screen pixels from the drawn image rect, and never needs an absolute
+        screen origin.
+        """
+        try:
+            tree = next((t for t in reversed(self.signal_trees)
+                         if getattr(t, "_live_signal_preview", None) is not None),
+                        None)
+            preview = getattr(tree, "_live_signal_preview", None)
+            if preview is None:
+                log.warning("[test-aim] no live signal preview on any tree")
+                return
+            with preview._lock:
+                mask = preview._ready.copy()
+            target = _ready_walk_target(mask)
+            if target is None:
+                log.warning("[test-aim] preview has no computed positions yet")
+                return
+            iy, ix, run = target
+
+            mgr = tree.navigator_plot_manager
+            pw = next(iter(mgr.navigation_selectors.keys()))
+            sel = mgr.navigation_selectors[pw][0]
+            # Where the crosshair is NOW, in the same (iy, ix) frame as the
+            # ready mask. `current_indices` is the selector's own committed
+            # position ([[ix, iy]] for a 2-D crosshair) and therefore agrees
+            # with the widget the renderer is drawing.
+            cur = np.asarray(sel.current_indices)
+            if cur.ndim >= 2:
+                cur = cur[0]
+            ix0, iy0 = int(cur[-2]), int(cur[-1])
+            nav_h, nav_w = preview.nav_shape[-2], preview.nav_shape[-1]
+            log.info("[test-aim] walk target iy=%d ix=%d from iy=%d ix=%d "
+                     "(dix=%d diy=%d, %d ready columns to the left; nav %dx%d; "
+                     "%d/%d positions ready)",
+                     iy, ix, iy0, ix0, ix - ix0, iy - iy0, run, nav_w, nav_h,
+                     preview.ready_count, preview.n_positions)
+        except Exception as e:
+            log.exception("[test-aim] failed: %s", e)
+
     def _test_nav_drag(self, targets: list) -> None:
         """Test-only: drive the navigator crosshair through a list of (x, y) nav
         cells server-side and report, per move, whether the SIGNAL plot's painted
diff --git a/spyde/drawing/selectors/base_selector.py b/spyde/drawing/selectors/base_selector.py
index 6e8834e0..a9e1f998 100644
--- a/spyde/drawing/selectors/base_selector.py
+++ b/spyde/drawing/selectors/base_selector.py
@@ -205,6 +205,23 @@ def __init__(
         # break navigation.
         self.index_hooks: list = []
 
+        # Hooks fired when the USER touches this selector — one per pointer
+        # event, on the event thread, BEFORE anything is read. Each is called
+        # ``hook(selector)``; exceptions are swallowed.
+        #
+        # Deliberately NOT index_hooks: those fire after a read, from EVERY
+        # update including the internal forced re-fires (the settle timer, a
+        # contrast repaint, a progressive preview refreshing the parked
+        # position), so they cannot answer "did a human do this?". Anything that
+        # must hand control to the user on first touch needs that question
+        # answered exactly, and answering it by inference — "the nav index
+        # changed, so someone must have dragged" — has holes: `_run_update`
+        # short-circuits a repeat position, so a grab that ends where it began
+        # produces no changed index at all, and a read that never reaches the
+        # listener (declined, coalesced away) produces nothing either.
+        # See ProgressiveSignalPreview._user_owns.
+        self.interaction_hooks: list = []
+
         # anyplotlib widget (set by subclasses)
         self.roi = None   # Alias for the anyplotlib Widget
         self._widget = None  # type: anyplotlib Widget
@@ -313,9 +330,17 @@ def upstream_selectors(self) -> list:
 
     # ── Update dispatch ───────────────────────────────────────────────────────
 
-    def update_data(self, ev=None) -> None:
+    def update_data(self, ev=None, *, user: bool = False) -> None:
         """Trigger a navigator update on the single serial dispatcher.
 
+        ``user=True`` means "a pointer event caused this" and is passed ONLY by
+        the widget event handlers in selector1d/selector2d. It fires
+        :attr:`interaction_hooks` and changes nothing else about the update —
+        the dispatcher, the coalescing and the settle re-fire below are all
+        untouched. Default False so a programmatic caller (multiplot_manager
+        wiring a new plot, the CSB width change, the strain reference selector)
+        can never be mistaken for a human.
+
         Every selector move just queues the LATEST position on the dispatcher
         (coalescing: a newer submit replaces any still-queued one for this
         selector). The dispatcher runs one update at a time, and the per-future
@@ -340,6 +365,16 @@ def update_data(self, ev=None) -> None:
         newer move follows, that future is not cancelled and paints. This timer has
         NO in-flight gate (unlike the removed self-pacing), so it cannot wedge.
         """
+        if user:
+            # Fired FIRST, before the read is even queued: a listener whose job
+            # is "the panel is the user's now" must be right at the moment of
+            # the touch, not once a frame comes back (which for a
+            # progressively-filled window may be never).
+            for hook in list(self.interaction_hooks):
+                try:
+                    hook(self)
+                except Exception as e:
+                    logger.debug("interaction hook failed: %s", e)
         _nav_dispatcher.submit(self)
         self._arm_settle()
 
@@ -401,11 +436,20 @@ def _run_update(self, force: bool = False, update_contrast: bool = False,
             return
         self.current_indices = indices
 
-        # Per-frame index trace — gated (fires on every move).
+        # Per-frame index trace — gated (fires on every move). The per-child
+        # update-function NAMES are part of it because "which function does this
+        # link dispatch to?" is the question a mis-wired display always turns
+        # into: a live preview / render display installs itself by swapping
+        # `sel.children[child]`, and reading the answer off this line is how you
+        # tell "the swap never landed on the link I dragged" apart from "the
+        # link is right but the read declined".
         if _NAV_TIMING:
-            logger.debug("[NAV-IDX] %s indices=%s force=%s nchildren=%d multi=%s",
-                         type(self).__name__, np.asarray(indices).tolist(), force,
-                         len(self.children), self.multi_selector)
+            logger.debug("[NAV-IDX] %s id=%d indices=%s force=%s multi=%s "
+                         "children=%s",
+                         type(self).__name__, id(self),
+                         np.asarray(indices).tolist(), force, self.multi_selector,
+                         [(id(c), getattr(f, "__qualname__", repr(f)))
+                          for c, f in self.children.items()])
 
         for child, fn in self.children.items():
             try:
diff --git a/spyde/drawing/selectors/selector1d.py b/spyde/drawing/selectors/selector1d.py
index ea577e6c..d23c63bf 100644
--- a/spyde/drawing/selectors/selector1d.py
+++ b/spyde/drawing/selectors/selector1d.py
@@ -69,7 +69,7 @@ def _get_plot1d(self):
         return getattr(plot, "_plot1d", None) if plot is not None else None
 
     def _on_pointer_up(self, event):
-        self.update_data()
+        self.update_data(event, user=True)
 
     #: How many consecutive navigation positions this point sums. 1 is a plain
     #: crosshair; >1 keeps the single pointer but reads a window around it.
@@ -182,7 +182,7 @@ def _on_pointer_up(self, event):
         self._clamp_extent()
         after = self._spans()
         self._trace_geometry(before, after)
-        self.update_data()
+        self.update_data(event, user=True)
 
     def _spans(self):
         """Geometry as ``[(lo, hi)]`` for RoiTrace — normalised so x0>x1 (the
diff --git a/spyde/drawing/selectors/selector2d.py b/spyde/drawing/selectors/selector2d.py
index 281d9059..cbbb72d8 100644
--- a/spyde/drawing/selectors/selector2d.py
+++ b/spyde/drawing/selectors/selector2d.py
@@ -56,7 +56,7 @@ def _get_plot2d(self):
         return getattr(plot, "_plot2d", None) if plot is not None else None
 
     def _on_pointer_up(self, event):
-        self.update_data()
+        self.update_data(event, user=True)
 
     def _get_selected_indices(self) -> np.ndarray:
         if self._widget is None:
@@ -125,7 +125,7 @@ def _on_pointer_up(self, event):
         self._clamp_extent()
         after = self._spans()
         self._trace_geometry(before, after)
-        self.update_data()
+        self.update_data(event, user=True)
 
     def _spans(self):
         """Geometry as ``[(x0, x1), (y0, y1)]`` for RoiTrace — the rectangle is
@@ -238,7 +238,7 @@ def _get_plot2d(self):
         return getattr(plot, "_plot2d", None) if plot is not None else None
 
     def _on_pointer_up(self, event):
-        self.update_data()
+        self.update_data(event, user=True)
 
     def _get_selected_indices(self) -> np.ndarray:
         if self._widget is None:
@@ -275,7 +275,7 @@ def _get_plot2d(self):
         return getattr(plot, "_plot2d", None) if plot is not None else None
 
     def _on_pointer_up(self, event):
-        self.update_data()
+        self.update_data(event, user=True)
 
     def _get_selected_indices(self) -> np.ndarray:
         if self._widget is None:
@@ -387,7 +387,7 @@ def _on_line_moved(self, event=None):
         finally:
             self._syncing = False
         self._redraw()
-        self.update_data()
+        self.update_data(event, user=True)
 
     def _on_width_moved(self, event=None):
         # Width = 2 × the control point's projection onto the perpendicular;
@@ -408,7 +408,7 @@ def _on_width_moved(self, event=None):
         finally:
             self._syncing = False
         self._redraw()
-        self.update_data()
+        self.update_data(event, user=True)
 
     # ── Drawing ─────────────────────────────────────────────────────────────────
 
diff --git a/spyde/drawing/toolbars/plot_control_toolbar.py b/spyde/drawing/toolbars/plot_control_toolbar.py
index 70c3727b..d396493f 100644
--- a/spyde/drawing/toolbars/plot_control_toolbar.py
+++ b/spyde/drawing/toolbars/plot_control_toolbar.py
@@ -163,6 +163,13 @@ def get_toolbar_actions_for_plot(
     """
     Build the action metadata lists for a given PlotState by filtering TOOLBAR_ACTIONS.
 
+    RESOLVES the action functions (importing their modules), so this is the
+    "what would actually run" view. What the renderer DRAWS comes from
+    :func:`get_toolbar_config_for_plot`, which additionally knows about the
+    result-tree compute lock — while a tree is locked that one shows the
+    ``requires_vectors`` actions greyed instead of hiding them. Nothing here
+    needs that: a locked tree refuses every action before it is resolved.
+
     Returns
     -------
     (functions, icons, names, toolbar_sides, toggles, parameters, sub_toolbars, setup_functions)
@@ -282,10 +289,30 @@ def get_toolbar_actions_for_plot(
     return functions, icons, names, toolbar_sides, toggles, parameters, sub_toolbars, setup_functions
 
 
-def _action_matches_plot(action: str, meta: dict, plot_state: "PlotState") -> bool:
+def _action_matches_plot(action: str, meta: dict, plot_state: "PlotState",
+                         *, locked: bool = False) -> bool:
     """Apply the same signal_type / dimension / vectors filters used to decide
     whether an action is offered for a plot — WITHOUT importing the action's
-    function module (so toolbar rendering never depends on heavy action code)."""
+    function module (so toolbar rendering never depends on heavy action code).
+
+    *locked* is "this plot's tree is being filled by a progressive compute"
+    (``lifecycle.tree_lock``). It relaxes ONE gate — ``requires_vectors`` —
+    because that gate cannot, on its own, tell "this action does not apply to
+    this data" from "the result it needs is still computing". On the window a
+    Find-Vectors batch is filling, the answer is always the latter: the tree
+    already carries ``signal_type: spyde_diffraction_vectors_image``, so the
+    vector actions match everything EXCEPT the container that attaches at
+    ``_finalize``. Left as-is they popped into existence when the batch
+    finished; with this they are SHOWN and DISABLED for the whole fill (the
+    caller stamps ``disabled`` on every action of a locked tree) and simply
+    un-grey when the container lands — no pop-in. (A CANCELLED or failed batch
+    unlocks with no container, so they disappear again — correctly: that window
+    really has no vectors, which is the "does not apply" case the gate is for.)
+
+    Every other gate stays absolute while locked: a lock never makes an action
+    appear on data it does not apply to (wrong signal_type, wrong dimension,
+    a missing optional package).
+    """
     signal_types = meta.get("signal_types")
     exclude_signal_types = meta.get("exclude_signal_types")
     signal_class = meta.get("signal_class")
@@ -306,7 +333,7 @@ def _action_matches_plot(action: str, meta: dict, plot_state: "PlotState") -> bo
             signal_class is None
             or isinstance(signal, _resolve_signal_class(signal_class))
         )
-        and (not requires_vectors or has_vectors)
+        and (not requires_vectors or has_vectors or locked)
         and _has_original_metadata(signal, meta.get("requires_original_metadata"))
         and _packages_present(meta)
         and (plot_state.dimensions in plot_dim)
@@ -326,11 +353,33 @@ def get_toolbar_config_for_plot(plot_state: "PlotState") -> list[dict]:
     directly — it never imports the action *function* modules, so rendering the
     toolbar is decoupled from the (heavy, possibly-Qt) action implementations.
     The function is resolved on demand when the action is actually invoked.
+
+    Actions carry ``disabled`` (+ ``disabled_reason``) while this plot's tree is
+    LOCKED by a progressive compute (``lifecycle.lock_tree``). Disabled rather
+    than HIDDEN: hiding says "this action does not apply to this data", where
+    the lock says "not yet" — a button that vanishes and comes back reads as a
+    glitch, and the user cannot tell that waiting will bring it back. Every
+    toolbar action is disabled, because ``_dispatch_toolbar_action`` refuses
+    every one of them on a locked tree; the ``registry.is_lock_exempt`` carve-out
+    is for STAGED verbs, which are caret-internal and never appear here. The
+    refusal stays as the backstop — a renderer holding a stale config must not
+    be able to land a node on a locked tree.
+
+    The lock also **widens** the set: while locked, ``requires_vectors`` actions
+    are included (and disabled like everything else) instead of being filtered
+    out. See ``_action_matches_plot`` — on a filling Find-Vectors window that
+    gate is answering "the result is still computing", not "wrong data", and the
+    two must not look the same. When the container attaches the same buttons
+    simply un-grey.
     """
+    from spyde.actions.lifecycle import tree_lock
+    lock_label = tree_lock(getattr(plot_state.plot, "signal_tree", None))
+
     actions = []
     for action, meta in TOOLBAR_ACTIONS["functions"].items():
         try:
-            if not _action_matches_plot(action, meta, plot_state):
+            if not _action_matches_plot(action, meta, plot_state,
+                                        locked=bool(lock_label)):
                 continue
         except Exception:
             continue
@@ -345,12 +394,18 @@ def get_toolbar_config_for_plot(plot_state: "PlotState") -> list[dict]:
                 "parameters": sub_meta.get("parameters", {}),
             })
 
-        actions.append({
+        descriptor = {
             "name": action,
             "icon": resolve_icon_path(meta.get("icon", "")),
             "side": meta.get("toolbar_side", "left"),
             "toggle": meta.get("toggle", False),
             "parameters": meta.get("parameters", {}),
             "subfunctions": sub_actions,
-        })
+        }
+        if lock_label:
+            descriptor["disabled"] = True
+            descriptor["disabled_reason"] = (
+                f"'{lock_label}' is still computing into this window"
+            )
+        actions.append(descriptor)
     return actions
diff --git a/spyde/signal_tree.py b/spyde/signal_tree.py
index d3c82447..f1f8241e 100644
--- a/spyde/signal_tree.py
+++ b/spyde/signal_tree.py
@@ -1069,6 +1069,12 @@ def add_node(
         *,
         local: bool | None = None,
     ) -> None:
+        # A tree being progressively filled is LOCKED: its root is a placeholder
+        # the batch is about to replace, so a node hung off it now would describe
+        # data that does not exist yet. See lifecycle.refuse_if_locked.
+        from spyde.actions.lifecycle import refuse_if_locked
+        if refuse_if_locked(self, f"Adding '{transformation}'"):
+            return
         parent_node = self.get_node(parent_signal)
         if parent_node is None:
             raise ValueError("Parent node not found in the tree.")
@@ -1097,6 +1103,13 @@ def add_transformation(
         **kwargs,
     ) -> BaseSignal | None:
         from spyde.backend.ipc import emit_error
+        from spyde.actions.lifecycle import refuse_if_locked
+
+        # Same lock as add_node — refuse BEFORE running the transformation, so a
+        # locked tree never pays for compute whose node it will not keep.
+        if refuse_if_locked(
+                self, f"'{method or getattr(function, '__name__', 'Transform')}'"):
+            return None
 
         if method is not None:
             try:
diff --git a/spyde/tests/migrated/test_lifecycle.py b/spyde/tests/migrated/test_lifecycle.py
index 9e78756a..9aac5594 100644
--- a/spyde/tests/migrated/test_lifecycle.py
+++ b/spyde/tests/migrated/test_lifecycle.py
@@ -185,6 +185,48 @@ def test_nothing_running_errors_after_grace(self, loop_session, captured_message
         assert not fired
 
 
+class TestResultTreeLock:
+    """The one gate a progressive result window is closed behind while its batch
+    fills it (lifecycle.lock_tree / refuse_if_locked). Everything that would add
+    a node or run an action calls `refuse_if_locked`; the value of ONE helper is
+    that a new entry point either calls it or is visibly missing it."""
+
+    def test_unlocked_tree_is_permitted_silently(self, captured_messages):
+        tree = _FakeTree()
+        assert lifecycle.tree_lock(tree) is None
+        assert lifecycle.refuse_if_locked(tree, "'Rebin'") is False
+        assert captured_messages == []
+
+    def test_locked_tree_is_refused_with_a_user_facing_error(self,
+                                                             captured_messages):
+        """Refusal must SAY so. A gate that silently no-ops reads as a broken
+        button, which is worse than the action running."""
+        tree = _FakeTree()
+        lifecycle.lock_tree(tree, "Find Diffraction Vectors")
+        assert lifecycle.tree_lock(tree) == "Find Diffraction Vectors"
+        assert lifecycle.refuse_if_locked(tree, "'Rebin'") is True
+        errs = [m for m in captured_messages if m.get("type") == "error"]
+        assert len(errs) == 1
+        assert "Rebin" in errs[0]["text"]
+        assert "Find Diffraction Vectors" in errs[0]["text"]
+
+    def test_unlock_releases_and_is_idempotent(self):
+        """The batch clears the lock twice — where the result attaches AND in
+        its teardown — because only the teardown runs on a cancelled or failed
+        run, and a stranded lock would leave the window refusing everything for
+        the rest of the session."""
+        tree = _FakeTree()
+        lifecycle.lock_tree(tree, "Find Diffraction Vectors")
+        lifecycle.unlock_tree(tree)
+        lifecycle.unlock_tree(tree)
+        assert lifecycle.tree_lock(tree) is None
+        assert lifecycle.refuse_if_locked(tree, "'Rebin'") is False
+
+    def test_no_tree_is_not_a_refusal(self):
+        """A bare figure window / a plot with no tree must not be gated."""
+        assert lifecycle.refuse_if_locked(None, "'Rebin'") is False
+
+
 class TestReplaceTreeAttr:
     def test_removes_old_and_sets_new(self):
         class Overlay:
diff --git a/spyde/tests/migrated/test_progressive_signal_preview.py b/spyde/tests/migrated/test_progressive_signal_preview.py
index c989b123..514781d4 100644
--- a/spyde/tests/migrated/test_progressive_signal_preview.py
+++ b/spyde/tests/migrated/test_progressive_signal_preview.py
@@ -41,9 +41,13 @@ def _block(ny, nx, n_slots, peaks):
     return arr
 
 
-def _result_tree(session, nav=(4, 5), sig=(16, 16)):
+def _result_tree(session, nav=(4, 5), sig=(16, 16), signal_type=None):
     """A Find-Vectors-shaped result tree: lazy zero placeholder + a count-map
-    navigator override, i.e. a real navigator + signal pair."""
+    navigator override, i.e. a real navigator + signal pair.
+
+    *signal_type* mirrors what ``_start_batch`` passes
+    (``spyde_diffraction_vectors_image``) — needed by anything asserting on the
+    vector toolbar gates, which key off that type."""
     import dask.array as da
     import hyperspy.api as hs
     from spyde.actions.commit import open_result_tree
@@ -54,10 +58,23 @@ def _result_tree(session, nav=(4, 5), sig=(16, 16)):
         da.zeros(shape, chunks=shape, dtype=np.float32)).as_lazy()
     nav_sig = hs.signals.BaseSignal(np.zeros(nav, dtype=np.float32)).T
     return open_result_tree(session, title="Preview", signal=sig_placeholder,
+                            signal_type=signal_type,
                             navigator_override=nav_sig,
                             selector_type=CrosshairSelector)
 
 
+def _tiny_vectors(nav=(4, 5), sig=(16, 16)):
+    """The smallest real :class:`SpyDEDiffractionVectors` — what ``_finalize``
+    attaches, for tests that need the ``requires_vectors`` gate to flip."""
+    flat = np.zeros((1, 6), dtype=np.float32)
+    flat[0] = (0, 0, 0.0, 0.0, -1.0, 1.0)
+    axes = [_AxisLite(scale=1.0, offset=0.0, size=sig[1]),
+            _AxisLite(scale=1.0, offset=0.0, size=sig[0])]
+    return SpyDEDiffractionVectors.from_arrays(
+        flat_buffer=flat, full_nav_shape=tuple(nav), sig_shape=tuple(sig),
+        sig_axes=axes, kernel_radius_px=2.0, kernel_radius_data=2.0)
+
+
 def _nav_selector(tree):
     npm = tree.navigator_plot_manager
     return list(npm.all_navigation_selectors)[0]
@@ -300,20 +317,184 @@ def test_sample_paints_are_throttled(self, window):
         assert preview.ready_count == 8           # …but readiness still landed
         preview.close()
 
-    def test_user_drag_holds_off_the_sampler(self, window):
-        """A landing block must not yank the frame away from a user who is
-        dragging the navigator."""
+    def test_user_drag_latches_off_the_sampler_for_good(self, window):
+        """A read at a new position ends auto-sampling for the rest of the run
+        — the BACKSTOP latch (a crosshair moved without a pointer event; the
+        primary latch is the pointer hook two tests below).
+
+        Not a timed hold: a hold hands the panel back the moment the user pauses
+        to look at what they navigated to, which is exactly when it must not.
+        Here two blocks land well after the user's read (the throttle interval is
+        stepped over between them) and NEITHER may paint.
+        """
         session = window["window"]
         tree = _result_tree(session)
         store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
         preview = attach_signal_preview(session, tree, render=store.render,
                                         nav_shape=(4, 5))
-        _nav_selector(tree).current_indices = np.array([[4, 0]])
-        preview.slice_fn(_nav_selector(tree), None, [[0, 0]])   # user read
-        sl = (slice(0, 2), slice(0, 2))
+        sel = _nav_selector(tree)
+        sel.current_indices = np.array([[4, 0]])
+        preview._last_index = (0, 0)
+        preview.slice_fn(sel, None, [[1, 0]])          # a MOVE: (0,0) → (0,1)
+        assert preview._user_owns is True
+
+        for iy in (0, 2):
+            sl = (slice(iy, iy + 2), slice(0, 2))
+            store.add(sl, _block(2, 2, 4, {(0, 0): [(4.0, 4.0, 9.0)]}))
+            preview._last_paint = 0.0                  # step over the throttle
+            preview.note_block(sl)
+        assert preview.blocks_seen == 2
+        assert preview.frames_painted == 0
+        assert preview.ready_count == 8                # the fill itself is unaffected
+        preview.close()
+
+    def test_a_refire_at_the_same_position_does_not_latch(self, window):
+        """Only a MOVE is user intent. The preview re-fires the parked selector
+        when a block lands under it, and the selector's settle timer re-fires at
+        a resting position — both are forced reads at an UNCHANGED index, and if
+        either latched, one block landing under a resting crosshair would end
+        auto-sampling without the user having touched anything."""
+        session = window["window"]
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        sel = _nav_selector(tree)
+        sel.current_indices = np.array([[4, 0]])
+        preview._last_index = (0, 1)
+        for _ in range(3):
+            preview.slice_fn(sel, None, [[1, 0]])      # same position, repeatedly
+        assert preview._user_owns is False
+
+        sl = (slice(2, 4), slice(3, 5))
         store.add(sl, _block(2, 2, 4, {(0, 0): [(4.0, 4.0, 9.0)]}))
         preview.note_block(sl)
+        assert preview.frames_painted == 1             # auto-sampling still alive
+        preview.close()
+
+    def test_a_pointer_grab_latches_even_with_no_read_at_a_new_index(
+            self, window):
+        """THE latch: the TOUCH decides ownership, not what the read returns.
+
+        Reported symptom: "while the vectors are computing I can drag around,
+        but it still tries to update when I let go". Inferring ownership from
+        the reads leaves holes that all look like that — `_run_update`
+        short-circuits a repeat position, so a grab-and-release (or a drag that
+        comes back to where it started, or a release at the index the crosshair
+        was already on) produces NO read at a new index at all; the sampler
+        stayed live and the next landing block repainted the panel at exactly
+        the moment the user let go.
+
+        Here the selector is already committed at the position the pointer event
+        reports, so `_run_update` reads nothing — and ownership must still be
+        taken.
+        """
+        session = window["window"]
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        sel = _nav_selector(tree)
+        sel._arm_settle = lambda: None            # no trailing timer in a test
+        pos = np.array([[1, 0]])
+        sel.get_selected_indices = lambda: pos
+        sel.current_indices = pos                 # already committed here
+        preview._last_index = preview._resolve_index(pos)
+        assert preview._user_owns is False
+
+        sel.update_data(object(), user=True)      # grab + release, no move
+        assert preview._user_owns is True, (
+            "a pointer event that produced no read left the sampler live — a "
+            "landing block will repaint the panel as the user lets go")
+
+        # …and the sampler really is off: a block landing elsewhere may not
+        # paint over what the user is looking at.
+        sl = (slice(2, 4), slice(3, 5))
+        store.add(sl, _block(2, 2, 4, {(0, 0): [(4.0, 4.0, 9.0)]}))
+        preview._last_paint = 0.0                 # step over the throttle
+        preview.note_block(sl)
         assert preview.frames_painted == 0
+        assert preview.ready_count == 4           # the fill itself is unaffected
+        preview.close()
+
+    def test_only_a_pointer_event_counts_as_the_user(self, window):
+        """`interaction_hooks` fire for a POINTER-driven update and nothing
+        else. Every internal re-fire reaches `update_data`/`delayed_update_data`
+        without the flag — multiplot_manager wiring a new plot, the CSB width
+        change, the strain reference selector, the settle timer — and if any of
+        them counted, auto-sampling would end with nobody having touched
+        anything."""
+        session = window["window"]
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        sel = _nav_selector(tree)
+        sel._arm_settle = lambda: None
+        pos = np.array([[1, 0]])
+        sel.get_selected_indices = lambda: pos
+        sel.current_indices = pos
+        fired: list = []
+        sel.interaction_hooks.append(fired.append)
+
+        sel.update_data()                         # programmatic
+        assert fired == []
+        assert preview._user_owns is False
+
+        sel.update_data(object(), user=True)      # a pointer event
+        # len, not identity: a CompositeSelector delegates `update_data` to its
+        # active sub-selector, which is the object the hook is handed.
+        assert len(fired) == 1
+        assert preview._user_owns is True
+        preview.close()
+
+    def test_close_unregisters_the_interaction_hook(self, window):
+        """The hook is the preview's alone — a closed preview must not stay
+        wired to a selector that outlives it."""
+        session = window["window"]
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        sel = _nav_selector(tree)
+        assert preview.interaction_hook in sel.interaction_hooks
+        preview.close()
+        assert preview.interaction_hook not in sel.interaction_hooks
+
+    def test_release_over_an_uncomputed_position_paints_nothing(self, window):
+        """Letting go where the batch has not reached leaves the last good
+        frame up.
+
+        Two things fire on a release and NEITHER may paint: the selector's
+        settle re-fire (a FORCED read at the resting position — the preview
+        returns None for an uncomputed one, so `_run_update` paints nothing),
+        and the blocks that keep landing meanwhile (the sampler is off once the
+        user has touched the crosshair)."""
+        session = window["window"]
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        sel = _nav_selector(tree)
+        sel._arm_settle = lambda: None
+        resting = np.array([[4, 3]])              # nav (iy=3, ix=4): uncomputed
+        sel.get_selected_indices = lambda: resting
+        sel.current_indices = resting
+        sel.update_data(object(), user=True)
+        assert preview._user_owns is True
+
+        # the settle re-fire's forced read at the resting position
+        child = tree.signal_plots[0]
+        assert preview.slice_fn(sel, child, resting) is None
+        assert preview.reads_declined >= 1
+
+        painted = preview.frames_painted
+        sl = (slice(0, 2), slice(0, 2))
+        store.add(sl, _block(2, 2, 4, {(0, 0): [(4.0, 4.0, 9.0)]}))
+        preview._last_paint = 0.0
+        preview.note_block(sl)
+        assert preview.frames_painted == painted, \
+            "a landing block repainted the panel after the user let go"
         preview.close()
 
     def test_parked_navigator_refires_instead_of_sampling(self, window):
@@ -377,6 +558,252 @@ def test_out_of_bounds_index_is_not_ready(self, window):
         preview.close()
 
 
+# ── the link the navigator actually dispatches to ─────────────────────────────
+
+class TestInstalledOnTheDispatchedLink:
+    """install() must land on the link `BaseSelector._run_update` iterates, not
+    merely on *a* selector/plot pair.
+
+    This is the assertion the e2e failure was blamed on for a whole cycle: a
+    drag served nothing, and "the swap never reached the dragged link" was the
+    natural explanation. It was not — the drag never reached the backend at all
+    (the harness had parked the crosshair from the backend, and the press
+    hit-tested against a renderer state that no longer matched). Pinning the
+    link here means that explanation can be RULED OUT next time instead of
+    investigated: the only way to tell the two apart is to check the routing
+    directly.
+    """
+
+    def test_the_dispatched_fn_is_the_previews(self, window):
+        session = window["window"]
+        tree = _result_tree(session)
+        preview = attach_signal_preview(session, tree, render=lambda i: None,
+                                        nav_shape=(4, 5))
+        sel = _nav_selector(tree)
+        # Exactly what _run_update does: fn = self.children[child], for every
+        # child. The tree's signal plot must be among them and must resolve to
+        # the preview.
+        dispatched = dict(sel.children)
+        assert tree.signal_plots, "the result window has no signal plot"
+        for sp in tree.signal_plots:
+            assert dispatched.get(sp) is preview.slice_fn
+        preview.close()
+
+    def test_a_real_dispatcher_read_serves(self, window):
+        """End to end through the selector: a forced update at a COMPUTED
+        position must come back through the preview with a frame."""
+        import time
+        from spyde.drawing.selectors.base_selector import _nav_dispatcher
+        session = window["window"]
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        store.add((slice(2, 4), slice(0, 2)),
+                  _block(2, 2, 4, {(0, 1): [(6.0, 7.0, 4.0)]}))
+        preview.note_block((slice(2, 4), slice(0, 2)))
+
+        served0 = preview.frames_served
+        sel = _nav_selector(tree)
+        sel.get_selected_indices = lambda: np.array([[1, 2]])   # [[ix, iy]]
+        sel.delayed_update_data(force=True)
+        end = time.monotonic() + 5.0
+        while time.monotonic() < end and preview.frames_served == served0:
+            time.sleep(0.02)
+        assert preview.frames_served > served0, (
+            "a dispatcher read at a computed position did not reach the preview"
+        )
+        assert _nav_dispatcher is not None      # the read ran on the real lane
+        preview.close()
+
+
+# ── decline narration ─────────────────────────────────────────────────────────
+
+class TestDeclineNarration:
+    """A declined navigator read is narrated at INFO with cumulative counts —
+    the log-side counterpart of `reads_declined`, so a drag that serves NOTHING
+    is distinguishable in the captured log from a drag whose reads never ran
+    (the e2e spec's `declinedCount` parses this line, mirroring `servedCount`)."""
+
+    @staticmethod
+    def _decline_records(caplog):
+        return [r for r in caplog.records
+                if r.name == "spyde.actions.live_signal"
+                and "navigator read declined" in r.getMessage()]
+
+    def test_first_decline_always_logs_with_counts(self, window, caplog):
+        import logging
+        caplog.set_level(logging.INFO, logger="spyde.actions.live_signal")
+        session = window["window"]
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        sel = _nav_selector(tree)
+
+        assert preview.slice_fn(sel, None, [[1, 2]]) is None   # nothing computed
+        recs = self._decline_records(caplog)
+        assert len(recs) == 1
+        msg = recs[0].getMessage()
+        # WHERE the read landed + the parseable cumulative counts.
+        assert "(2, 1)" in msg
+        assert "0 served / 1 declined" in msg
+        preview.close()
+
+    def test_declines_are_throttled_but_counted(self, window, caplog):
+        import logging
+        caplog.set_level(logging.INFO, logger="spyde.actions.live_signal")
+        session = window["window"]
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        sel = _nav_selector(tree)
+
+        preview.slice_fn(sel, None, [[1, 2]])
+        preview.slice_fn(sel, None, [[2, 2]])   # inside the throttle window
+        assert preview.reads_declined == 2
+        assert len(self._decline_records(caplog)) == 1   # narration throttled
+
+        # Once the throttle window has passed, the next decline narrates the
+        # CUMULATIVE count — the spec reads the last line, not a per-event sum.
+        preview._last_decline_log = 0.0
+        preview.slice_fn(sel, None, [[3, 2]])
+        recs = self._decline_records(caplog)
+        assert len(recs) == 2
+        assert "3 declined" in recs[-1].getMessage()
+        preview.close()
+
+
+# ── the ready-mask aim (test_aim_ready_position) ──────────────────────────────
+
+class TestReadyWalkTarget:
+    """The pure target picker behind the `test_aim_ready_position` backend
+    action: near the right end of the longest ready run in one row (backed off
+    a quarter-run so the walk starts INSIDE the computed region, not on its
+    boundary), so a leftward crosshair walk of `ready_left` columns stays over
+    computed data."""
+
+    def test_nothing_ready_is_none(self):
+        from spyde.backend._session_testharness import _ready_walk_target
+        assert _ready_walk_target(np.zeros((4, 6), dtype=bool)) is None
+
+    def test_near_the_right_end_of_the_longest_run(self):
+        from spyde.backend._session_testharness import _ready_walk_target
+        mask = np.zeros((3, 10), dtype=bool)
+        mask[0, 1:4] = True         # run of 3
+        mask[2, 2:9] = True         # run of 7 — the winner
+        # right end 8, backed off 7//4=1 → start 7, 6 ready columns to its left
+        assert _ready_walk_target(mask) == (2, 7, 6)
+
+    def test_longest_run_within_a_row_wins_over_fragments(self):
+        from spyde.backend._session_testharness import _ready_walk_target
+        mask = np.zeros((2, 12), dtype=bool)
+        mask[0, 0:2] = True
+        mask[0, 5:9] = True         # longest single run (4) despite row 1's
+        mask[1, 0:3] = True         # larger total (3 + 3 = 6, runs of 3)
+        mask[1, 6:9] = True
+        assert _ready_walk_target(mask) == (0, 7, 3)
+
+    def test_full_row_backs_off_the_edge(self):
+        """A fully-ready row must NOT start the walk at the image's right edge:
+        the spec converts the target to screen pixels and rounds, so a start on
+        the boundary can land one column outside the computed region."""
+        from spyde.backend._session_testharness import _ready_walk_target
+        mask = np.zeros((2, 12), dtype=bool)
+        mask[1, :] = True           # run of 12, right end 11
+        assert _ready_walk_target(mask) == (1, 8, 9)   # backed off 12//4=3
+
+    def test_leading_stack_dims_collapse_to_index_zero(self):
+        from spyde.backend._session_testharness import _ready_walk_target
+        mask = np.zeros((3, 4, 6), dtype=bool)
+        mask[0, 1, 2:5] = True      # visible to the spatial aim (3//4=0 backoff)
+        mask[2, 3, 0:6] = True      # a later stack plane — ignored
+        assert _ready_walk_target(mask) == (1, 4, 3)
+
+
+class TestAimReadyPositionAction:
+    """`test_aim_ready_position` on a real result tree.
+
+    It REPORTS a walk target from the preview's ready mask — as a delta from
+    where the crosshair already is — and moves nothing. Moving the widget from
+    the backend is what the first version did, and the measured consequence was
+    that the e2e spec's press on the redrawn crosshair delivered no pointer
+    event at all: the renderer hit-tests against its OWN widget state, which a
+    backend-side write had left it disagreeing with. So "the action must not
+    touch the widget" is the contract, and these tests pin it.
+    """
+
+    @staticmethod
+    def _aim_records(caplog):
+        return [r for r in caplog.records if "[test-aim]" in r.getMessage()]
+
+    @staticmethod
+    def _prepared(session, caplog):
+        tree = _result_tree(session)
+        store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+        preview = attach_signal_preview(session, tree, render=store.render,
+                                        nav_shape=(4, 5))
+        sl = (slice(2, 4), slice(0, 2))
+        peaks = {(iy, ix): [(4.0, 4.0, 9.0)] for iy in range(2) for ix in range(2)}
+        store.add(sl, _block(2, 2, 4, peaks))
+        preview.note_block(sl)
+        return tree, preview
+
+    def test_reports_a_ready_target_as_a_delta(self, window, caplog):
+        import logging
+        caplog.set_level(logging.INFO)
+        session = window["window"]
+        tree, preview = self._prepared(session, caplog)
+        sel = _nav_selector(tree)
+        sel.current_indices = np.array([[3, 1]])       # crosshair at iy=1, ix=3
+
+        session.dispatch_action({"action": "test_aim_ready_position"})
+
+        aimed = [r for r in self._aim_records(caplog)
+                 if "walk target" in r.getMessage()]
+        assert aimed, f"no aim narration; got: {caplog.text[-1500:]}"
+        msg = aimed[0].getMessage()
+        # Ready block rows 2..3 × cols 0..1 → longest run right end = (2, 1).
+        assert "walk target iy=2 ix=1" in msg
+        assert "from iy=1 ix=3" in msg
+        # The DELTA is what the spec converts to a pointer move, plus the nav
+        # shape it needs for the index→pixel scale.
+        assert "dix=-2 diy=1" in msg
+        assert "nav 5x4" in msg
+        preview.close()
+
+    def test_moves_nothing(self, window, caplog):
+        """The whole point: no widget write, no dispatcher submit, no read."""
+        import logging
+        caplog.set_level(logging.INFO)
+        session = window["window"]
+        tree, preview = self._prepared(session, caplog)
+        sel = _nav_selector(tree)
+        cross = getattr(sel, "_crosshair_selector", sel)
+        inner = getattr(cross, "selector", cross)
+        w = getattr(inner, "_widget", None) or getattr(cross, "_widget", None)
+        before = (float(w.cx), float(w.cy)) if w is not None else None
+        served0, declined0 = preview.frames_served, preview.reads_declined
+
+        session.dispatch_action({"action": "test_aim_ready_position"})
+
+        if w is not None:
+            assert (float(w.cx), float(w.cy)) == before
+        assert (preview.frames_served, preview.reads_declined) == (served0,
+                                                                   declined0)
+        preview.close()
+
+    def test_without_a_preview_it_narrates_and_does_not_raise(self, window,
+                                                              caplog):
+        import logging
+        caplog.set_level(logging.INFO)
+        session = window["window"]
+        session.dispatch_action({"action": "test_aim_ready_position"})
+        assert any("no live signal preview" in r.getMessage()
+                   for r in self._aim_records(caplog))
+
+
 # ── the Find-Vectors wiring ───────────────────────────────────────────────────
 
 class TestFindVectorsWiring:
@@ -478,6 +905,291 @@ def fake_compute(src, p, **kw):
                        None) is None
 
 
+class TestResultTreeIsLockedWhileFilling:
+    """The result tree is LOCKED for the duration of the batch — no actions, no
+    new nodes — and released when the vectors attach.
+
+    The lock is not housekeeping: it is what makes the preview's install-ONCE
+    snapshot of the navigator→signal links correct by construction, so the
+    interactive-fill read path needs no per-read re-check (which would put a
+    branch on the Live-Display nav read, CLAUDE.md §3).
+    """
+
+    @staticmethod
+    def _run_batch(session, tree, monkeypatch, compute):
+        import time
+        import spyde.actions.find_vectors_action as fva
+        monkeypatch.setattr(fva, "_do_compute_vectors", compute)
+        monkeypatch.setattr(fva, "emit_error", lambda *a, **k: None)
+        fva._start_batch(session, tree.signal_plots[0], tree,
+                         fva._coerce(dict(fva.DEFAULTS)))
+        for _ in range(400):
+            if len(session.signal_trees) > 1:
+                break
+            time.sleep(0.01)
+        return session.signal_trees[-1]
+
+    def test_locked_during_the_batch_and_released_after(self, stem_4d_dataset,
+                                                        monkeypatch,
+                                                        captured_messages):
+        import threading
+        import time
+        from spyde.actions.lifecycle import tree_lock
+        session = stem_4d_dataset["window"]
+        tree = session.signal_trees[0]
+        inside = threading.Event()
+        release = threading.Event()
+        seen: dict = {}
+
+        def fake_compute(src, p, **kw):
+            result_tree = session.signal_trees[-1]
+            seen["lock"] = tree_lock(result_tree)
+            # A node-add on the locked tree is REFUSED, and says why.
+            before = len(list(result_tree.walk()))
+            result_tree.add_node(result_tree.root, result_tree.root, "rebin")
+            seen["nodes_added"] = len(list(result_tree.walk())) - before
+            inside.set()
+            release.wait(10.0)
+            return None                       # no result → no finalize
+
+        result_tree = self._run_batch(session, tree, monkeypatch, fake_compute)
+        assert inside.wait(10.0), "the batch worker never ran"
+        assert seen["lock"] == "Find Diffraction Vectors"
+        assert seen["nodes_added"] == 0, "a node was added to a locked tree"
+        errs = [m for m in captured_messages if m.get("type") == "error"]
+        assert any("still computing" in m.get("text", "") for m in errs), \
+            f"the refusal was silent; errors were {errs}"
+
+        release.set()
+        end = time.monotonic() + 10.0
+        while time.monotonic() < end and tree_lock(result_tree) is not None:
+            time.sleep(0.02)
+        assert tree_lock(result_tree) is None, \
+            "the batch teardown left the result tree locked"
+        # …and now a node CAN be added.
+        before = len(list(result_tree.walk()))
+        result_tree.add_node(result_tree.root, result_tree.root, "rebin")
+        assert len(list(result_tree.walk())) == before + 1
+
+    def test_a_toolbar_action_is_refused_while_locked(self, stem_4d_dataset,
+                                                      captured_messages):
+        """The dispatch gate, on the path a toolbar click takes. Both dispatch
+        paths call the same helper, so this pins the wiring rather than the
+        rule (which `test_lifecycle.TestResultTreeLock` owns)."""
+        from spyde.actions.lifecycle import lock_tree, unlock_tree
+        session = stem_4d_dataset["window"]
+        tree = session.signal_trees[0]
+        plot = tree.signal_plots[0]
+        ran: list = []
+        lock_tree(tree, "Find Diffraction Vectors")
+        try:
+            session._dispatch_toolbar_action(plot, "Rebin", {})
+        finally:
+            unlock_tree(tree)
+        assert not ran
+        errs = [m for m in captured_messages if m.get("type") == "error"]
+        assert any("still computing" in m.get("text", "") for m in errs), \
+            f"the toolbar action was not refused; errors were {errs}"
+
+    def test_a_staged_action_is_refused_while_locked(self, stem_4d_dataset,
+                                                     captured_messages,
+                                                     monkeypatch):
+        from spyde.actions import registry
+        from spyde.actions.lifecycle import lock_tree, unlock_tree
+        session = stem_4d_dataset["window"]
+        tree = session.signal_trees[0]
+        plot = tree.signal_plots[0]
+        key = next(iter(registry.STAGED_HANDLERS))
+        ran: list = []
+        monkeypatch.setattr(registry, "resolve_staged",
+                            lambda name: lambda *a, **k: ran.append(name))
+        import spyde.backend._session_actions as sa
+        monkeypatch.setattr(sa, "resolve_staged", registry.resolve_staged)
+
+        lock_tree(tree, "Find Diffraction Vectors")
+        try:
+            session.dispatch_action({"action": key,
+                                     "window_id": plot.window_id,
+                                     "payload": {}})
+        finally:
+            unlock_tree(tree)
+        assert ran == [], f"staged handler {key!r} ran on a locked tree"
+
+        session.dispatch_action({"action": key, "window_id": plot.window_id,
+                                 "payload": {}})
+        assert ran == [key], "the staged handler stayed blocked after unlock"
+
+    def test_toolbar_config_disables_every_action_while_locked(
+            self, stem_4d_dataset, captured_messages):
+        """The VISIBLE half of the lock: the buttons must render unavailable
+        rather than look clickable and error.
+
+        Disabled, not hidden — the `requires_vectors` family HIDES because those
+        actions do not apply to the data, where the lock means "not yet", and a
+        button that vanishes and comes back reads as a glitch. Every toolbar
+        action is disabled because `_dispatch_toolbar_action` refuses every one
+        of them (`registry.is_lock_exempt` covers STAGED verbs, which never
+        appear in this config).
+        """
+        from spyde.actions.lifecycle import lock_tree, unlock_tree
+        from spyde.drawing.toolbars.plot_control_toolbar import (
+            get_toolbar_config_for_plot,
+        )
+        session = stem_4d_dataset["window"]
+        tree = session.signal_trees[0]
+        state = tree.signal_plots[0].plot_state
+
+        free = get_toolbar_config_for_plot(state)
+        assert free, "the fixture window has no toolbar actions to test with"
+        assert not any(a.get("disabled") for a in free)
+
+        lock_tree(tree, "Find Diffraction Vectors")
+        try:
+            locked = get_toolbar_config_for_plot(state)
+            assert {a["name"] for a in locked} == {a["name"] for a in free}, \
+                "locking must DISABLE the actions, never remove them"
+            assert all(a.get("disabled") is True for a in locked)
+            assert all("Find Diffraction Vectors" in a["disabled_reason"]
+                       for a in locked)
+        finally:
+            unlock_tree(tree)
+
+        restored = get_toolbar_config_for_plot(state)
+        assert not any(a.get("disabled") for a in restored)
+
+    def test_requires_vectors_actions_are_greyed_not_hidden_while_locked(
+            self, window):
+        """The vector actions belong on the window their own batch is filling —
+        VISIBLE and disabled, not absent until it finishes.
+
+        ``requires_vectors`` gates on ``tree.diffraction_vectors``, which a
+        Find-Vectors run attaches only at ``_finalize``. On any OTHER signal
+        that gate means "this action does not apply to this data" and hiding is
+        right. On the result window it means "the result is still computing",
+        and hiding is wrong twice over: the user cannot tell that waiting will
+        bring the buttons back, and when it does they POP IN (measured in the
+        real app: 4 buttons during the fill, 7 after). The LOCK is what tells
+        the two cases apart — it is set exactly while a batch is filling this
+        tree — so it is the only thing that relaxes the gate.
+        """
+        from spyde import TOOLBAR_ACTIONS
+        from spyde.actions.lifecycle import (
+            attach_container, lock_tree, unlock_tree,
+        )
+        from spyde.drawing.toolbars.plot_control_toolbar import (
+            get_toolbar_config_for_plot,
+        )
+        session = window["window"]
+        tree = _result_tree(session,
+                            signal_type="spyde_diffraction_vectors_image")
+        state = tree.signal_plots[0].plot_state
+        gated = {n for n, meta in TOOLBAR_ACTIONS["functions"].items()
+                 if meta.get("requires_vectors")}
+        assert gated, "no requires_vectors action is declared any more"
+
+        # 1. UNLOCKED with no vectors → hidden, exactly as before.
+        free = {a["name"] for a in get_toolbar_config_for_plot(state)}
+        assert not (gated & free), (
+            "a requires_vectors action showed on an unlocked vectorless tree: "
+            f"{sorted(gated & free)}")
+
+        # 2. LOCKED with no vectors yet → shown, and disabled like every other
+        #    action on a locked tree.
+        lock_tree(tree, "Find Diffraction Vectors")
+        try:
+            locked = {a["name"]: a for a in get_toolbar_config_for_plot(state)}
+            missing = gated - set(locked)
+            assert not missing, (
+                "requires_vectors actions stayed HIDDEN on the window their own"
+                f" batch is filling: {sorted(missing)}")
+            for name in sorted(gated):
+                assert locked[name].get("disabled") is True, \
+                    f"{name!r} was shown ENABLED on a locked tree"
+                assert "Find Diffraction Vectors" in locked[name]["disabled_reason"]
+        finally:
+            # 3. attach + unlock, the order _finalize does it in.
+            attach_container(tree, _tiny_vectors(), name="diffraction_vectors")
+            unlock_tree(tree)
+
+        live = {a["name"]: a for a in get_toolbar_config_for_plot(state)}
+        assert not any(live[n].get("disabled") for n in gated), \
+            "the vector actions stayed greyed after the vectors attached"
+        # NO POP-IN is the whole point: finishing the batch changes `disabled`,
+        # never which buttons exist.
+        assert set(live) == set(locked), (
+            "the toolbar gained/lost buttons when the batch finished: "
+            f"+{sorted(set(live) - set(locked))} -{sorted(set(locked) - set(live))}")
+
+    def test_locking_pushes_the_greyed_toolbar_immediately(
+            self, stem_4d_dataset, captured_messages):
+        """Taking the lock RE-SENDS the config, so the buttons grey out at the
+        START of the fill — not only when the batch finishes and something else
+        happens to re-send. Both the signal AND the navigator windows: the
+        navigator's Add Selector would add the very navigator→signal link the
+        lock exists to freeze."""
+        from spyde.actions.lifecycle import lock_tree, unlock_tree
+        session = stem_4d_dataset["window"]
+        tree = session.signal_trees[0]
+
+        def configs():
+            return [m for m in captured_messages
+                    if m.get("type") == "toolbar_config"]
+
+        n_before = len(configs())
+        lock_tree(tree, "Find Diffraction Vectors")
+        sent = configs()[n_before:]
+        assert sent, "locking sent no toolbar config"
+        assert all(a.get("disabled") for m in sent for a in m["toolbar_actions"])
+        nav_ids = {id(p) for lst in
+                   tree.navigator_plot_manager.plots.values() for p in lst}
+        assert nav_ids & {m["plot_id"] for m in sent}, \
+            "the navigator window's toolbar was not greyed"
+
+        n_locked = len(configs())
+        unlock_tree(tree)
+        after = configs()[n_locked:]
+        assert after, "unlocking sent no toolbar config"
+        assert not any(a.get("disabled") for m in after
+                       for a in m["toolbar_actions"])
+        # Idempotent: a second unlock is not a transition, so no more traffic.
+        n_after = len(configs())
+        unlock_tree(tree)
+        assert len(configs()) == n_after
+
+    def test_read_only_and_teardown_verbs_are_exempt(self, stem_4d_dataset,
+                                                     captured_messages,
+                                                     monkeypatch):
+        """`overlay_query` is fired by the RENDERER itself whenever the active
+        window changes, so gating it put an unrequested error in the status bar
+        on every progressive fill (observed) and left the dock's layer state
+        stale. Teardown verbs are exempt for the mirror reason: a lock that can
+        trap a caret open is worse than no lock."""
+        from spyde.actions import registry
+        from spyde.actions.lifecycle import lock_tree, unlock_tree
+        session = stem_4d_dataset["window"]
+        tree = session.signal_trees[0]
+        plot = tree.signal_plots[0]
+        ran: list = []
+        monkeypatch.setattr(registry, "resolve_staged",
+                            lambda name: lambda *a, **k: ran.append(name))
+        import spyde.backend._session_actions as sa
+        monkeypatch.setattr(sa, "resolve_staged", registry.resolve_staged)
+
+        lock_tree(tree, "Find Diffraction Vectors")
+        try:
+            for key in ("overlay_query", "fv_close", "movie_cancel"):
+                assert key in registry.STAGED_HANDLERS
+                session.dispatch_action({"action": key,
+                                         "window_id": plot.window_id,
+                                         "payload": {}})
+        finally:
+            unlock_tree(tree)
+        assert ran == ["overlay_query", "fv_close", "movie_cancel"]
+        assert not [m for m in captured_messages
+                    if m.get("type") == "error"
+                    and "still computing" in m.get("text", "")]
+
+
 class TestOrchestratorPlumbing:
     def test_on_chunk_block_is_optional(self):
         """The signature stays back-compatible — every existing caller passes
diff --git a/spyde/tests/migrated/test_psp_guard_interaction.py b/spyde/tests/migrated/test_psp_guard_interaction.py
new file mode 100644
index 00000000..8487cd69
--- /dev/null
+++ b/spyde/tests/migrated/test_psp_guard_interaction.py
@@ -0,0 +1,252 @@
+"""
+Can PR #126's nav-read guard starve the progressive vectors preview's
+navigator reads? (CI: progressive_signal_preview.spec.ts once served ZERO
+frames over a whole drag while the batch was parked — the suspicion was that
+``update_from_navigation_selection``'s new ``_nav_readable_data`` skip fired on
+every read mid-fill.)
+
+Finding: NO — structurally impossible, and pinned here so it stays that way.
+
+The guard lives INSIDE ``update_from_navigation_selection``
+(update_functions.py, the capture-once + ``_nav_readable_data`` skip). But a
+progressive result window's navigator→signal reads never run that function
+while the preview is installed: ``ProgressiveSignalPreview.install()``
+REPLACES the selector's child entry wholesale (``sel.children[child] =
+self.slice_fn``, live_signal.py) and ``BaseSelector._run_update`` dispatches
+``fn = self.children[child]`` — there is no shared upstream through the
+guard. The preview's slice function renders from the retained peaks blocks
+(``LiveVectorFrames``) and consults readiness (``is_ready``), never the
+signal's ``.data`` — so even parking hyperspy's deepcopy placeholder
+(``array([None], dtype=object)``, the exact state the guard skips on) on the
+result tree's root for the WHOLE drive changes nothing: every dispatcher read
+at a computed position still serves.
+
+The guard applies exactly where #126 put it: the DEFAULT slice path — which is
+what the selector falls back to after ``preview.close()``.
+"""
+from __future__ import annotations
+
+import logging
+import threading
+import time
+
+import numpy as np
+
+from spyde.actions.find_vectors.live_frames import LiveVectorFrames
+from spyde.actions.live_signal import attach_signal_preview
+from spyde.drawing.selectors.base_selector import _nav_dispatcher
+
+
+def _guard_skip_records(caplog):
+    """The #126 guard's own skip narration (logged at DEBUG in
+    spyde.drawing.update_functions)."""
+    return [r for r in caplog.records
+            if r.name == "spyde.drawing.update_functions"
+            and r.getMessage().startswith("nav read skipped")]
+
+
+def _error_records(caplog):
+    return [r for r in caplog.records if r.levelno >= logging.ERROR]
+
+
+def _wait_dispatcher_idle(timeout: float = 3.0) -> None:
+    """Wait until the serial dispatcher has drained its pending queue (same
+    helper as test_nav_second_signal_race.py)."""
+    end = time.monotonic() + timeout
+    while time.monotonic() < end:
+        with _nav_dispatcher._lock:
+            empty = not _nav_dispatcher._pending
+        if empty:
+            time.sleep(0.05)   # let the in-flight job finish
+            return
+        time.sleep(0.01)
+
+
+def _block(ny, nx, n_slots, peaks):
+    """A padded peaks block: NaN everywhere, ``peaks[(iy, ix)]`` filled in."""
+    arr = np.full((ny, nx, n_slots, 3), np.nan, dtype=np.float32)
+    for (iy, ix), rows in peaks.items():
+        for k, row in enumerate(rows):
+            arr[iy, ix, k] = row
+    return arr
+
+
+def _result_tree(session, nav=(4, 5), sig=(16, 16)):
+    """A Find-Vectors-shaped result tree: lazy zero placeholder signal + a
+    count-map navigator override (same shape test_progressive_signal_preview
+    builds)."""
+    import dask.array as da
+    import hyperspy.api as hs
+    from spyde.actions.commit import open_result_tree
+    from spyde.drawing.selectors import CrosshairSelector
+
+    shape = tuple(nav) + tuple(sig)
+    sig_placeholder = hs.signals.Signal2D(
+        da.zeros(shape, chunks=shape, dtype=np.float32)).as_lazy()
+    nav_sig = hs.signals.BaseSignal(np.zeros(nav, dtype=np.float32)).T
+    return open_result_tree(session, title="GuardProbe", signal=sig_placeholder,
+                            navigator_override=nav_sig,
+                            selector_type=CrosshairSelector)
+
+
+def _nav_selector(tree):
+    npm = tree.navigator_plot_manager
+    return list(npm.all_navigation_selectors)[0]
+
+
+def _attach_ready_preview(session, tree):
+    """Attach a preview with block (iy 2..3, ix 0..1) already computed, so nav
+    positions [[ix=0..1, iy=2..3]] are servable."""
+    store = LiveVectorFrames(sig_hw=(16, 16), kernel_radius_px=2)
+    preview = attach_signal_preview(session, tree, render=store.render,
+                                    nav_shape=(4, 5))
+    store.add((slice(2, 4), slice(0, 2)),
+              _block(2, 2, 4, {(0, 0): [(6.0, 7.0, 4.0)],
+                               (0, 1): [(5.0, 9.0, 3.0)],
+                               (1, 0): [(3.0, 2.0, 8.0)],
+                               (1, 1): [(8.0, 8.0, 1.0)]}))
+    preview.note_block((slice(2, 4), slice(0, 2)))
+    return preview
+
+
+def _drive(sel, ix, iy):
+    """Run one forced navigator update through the REAL serial dispatcher at
+    widget position [[ix, iy]] (the crosshair's raw report order)."""
+    pos = np.array([[int(ix), int(iy)]])
+    sel.get_selected_indices = lambda: pos
+    sel.delayed_update_data(force=True)
+    _wait_dispatcher_idle()
+
+
+class TestGuardCannotStarvePreviewReads:
+    """The hypothesis test: park / hammer the exact ``.data`` state the #126
+    guard skips on, drive real dispatcher reads over computed positions, and
+    count both the serves and the guard's own skip line."""
+
+    def test_preview_serves_with_the_placeholder_parked_all_along(
+            self, window, caplog):
+        """Worst case for the hypothesis: the deepcopy placeholder is parked on
+        the result signal's ``.data`` for the ENTIRE drag — every read lands
+        'mid-rebind'. If the guard were anywhere in this path, every read would
+        skip and serve nothing (the CI symptom). Instead every read serves and
+        the guard never fires."""
+        caplog.set_level(logging.DEBUG, logger="spyde.drawing.update_functions")
+        session = window["window"]
+        tree = _result_tree(session)
+        preview = _attach_ready_preview(session, tree)
+        sel = _nav_selector(tree)
+        _wait_dispatcher_idle()
+
+        root = tree.root
+        old = root.data
+        root.data = None       # hyperspy's transient: array([None], dtype=object)
+        assert root.data.shape == (1,) and root.data.dtype == object
+        served0, declined0 = preview.frames_served, preview.reads_declined
+        n = 20
+        try:
+            for i in range(n):
+                # alternate between two COMPUTED positions (nav iy=2..3, ix=0..1)
+                _drive(sel, ix=i % 2, iy=2 + (i // 2) % 2)
+        finally:
+            root.data = old
+
+        # >= not ==: note_block's parked-position re-fire can legitimately add
+        # an extra serve at attach time. The claim is "nothing was starved":
+        # every driven read served, none declined.
+        assert preview.frames_served - served0 >= n, (
+            f"only {preview.frames_served - served0}/{n} dispatcher reads served"
+            f" ({preview.reads_declined - declined0} declined) — the preview"
+            " path stalled")
+        assert preview.reads_declined - declined0 == 0
+        assert not _guard_skip_records(caplog), (
+            "the #126 guard fired on the preview-owned read path: "
+            + "\n".join(r.getMessage() for r in _guard_skip_records(caplog)))
+        assert not _error_records(caplog), caplog.text[:2000]
+        preview.close()
+
+    def test_rebind_hammer_cannot_starve_serving(self, window, caplog):
+        """The CI-shaped timing: a thread flips ``.data`` between the real
+        binding and the deepcopy placeholder as fast as it can (denser than any
+        real progressive fill's operations) while the dispatcher reads computed
+        positions. Serving must not miss a single read; zero guard skips."""
+        caplog.set_level(logging.DEBUG, logger="spyde.drawing.update_functions")
+        session = window["window"]
+        tree = _result_tree(session)
+        preview = _attach_ready_preview(session, tree)
+        sel = _nav_selector(tree)
+        _wait_dispatcher_idle()
+
+        root = tree.root
+        real = root.data
+        stop = threading.Event()
+
+        def hammer():
+            while not stop.is_set():
+                root.data = None      # the _deepcopy_with_new_data transient
+                root.data = real
+
+        t = threading.Thread(target=hammer, daemon=True)
+        served0 = preview.frames_served
+        n = 40
+        t.start()
+        try:
+            for i in range(n):
+                _drive(sel, ix=i % 2, iy=2 + (i // 2) % 2)
+        finally:
+            stop.set()
+            t.join(timeout=2.0)
+            root.data = real
+        _wait_dispatcher_idle()
+
+        assert preview.frames_served - served0 >= n, (
+            f"only {preview.frames_served - served0}/{n} reads served under the"
+            " rebind hammer — the preview path can be starved")
+        assert not _guard_skip_records(caplog), (
+            "the #126 guard fired on the preview-owned read path")
+        assert not _error_records(caplog), caplog.text[:2000]
+        preview.close()
+
+    def test_guard_lives_only_on_the_default_path_the_preview_replaced(
+            self, window, caplog):
+        """The seam, pinned from both sides with the SAME parked placeholder:
+
+        - preview installed → the read is ``preview.slice_fn`` → serves;
+        - preview closed → the selector falls back to the default
+          ``update_from_navigation_selection`` → the #126 guard skips the frame
+          (its designed behaviour), quietly.
+
+        So the guard and the preview occupy the same slot ALTERNATELY — the
+        guard is not upstream of the preview and cannot have caused a
+        zero-served drag on a preview-owned window."""
+        caplog.set_level(logging.DEBUG, logger="spyde.drawing.update_functions")
+        session = window["window"]
+        tree = _result_tree(session)
+        preview = _attach_ready_preview(session, tree)
+        sel = _nav_selector(tree)
+        child = tree.signal_plots[0]
+        assert sel.children[child] is preview.slice_fn
+        _wait_dispatcher_idle()
+
+        root = tree.root
+        old = root.data
+        root.data = None
+        try:
+            served0 = preview.frames_served
+            _drive(sel, ix=1, iy=2)
+            assert preview.frames_served >= served0 + 1
+            assert not _guard_skip_records(caplog)
+
+            preview.close()
+            from spyde.drawing.update_functions import (
+                update_from_navigation_selection)
+            assert sel.children[child] is update_from_navigation_selection
+
+            served1 = preview.frames_served
+            _drive(sel, ix=1, iy=3)
+            assert len(_guard_skip_records(caplog)) >= 1, (
+                "the restored default path should have skipped the placeholder"
+                " read via the #126 guard")
+            assert preview.frames_served == served1   # nothing served it
+            assert not _error_records(caplog), caplog.text[:2000]
+        finally:
+            root.data = old