@@ -108,10 +108,36 @@ func (d *drawer) close() {
 
 // showLive hosts a verb that renders itself. The drawer owns the region and
 // the dismissal; the view owns everything inside it.
+// itemView is a live view that has a LIST rather than a screen. The pit takes
+// its rows and drives them with the picker; the view keeps only the verbs that
+// are its own. A view that does not implement this still renders itself.
+type itemView interface {
+	Items(width int) []drawerRow
+	Activate(path string)
+}
+
 func (d *drawer) showLive(name string, v cmdkit.LiveView) {
 	d.kind, d.name, d.title = drawerLive, name, ""
 	d.flash, d.pick = "", nil
 	d.live = v
+	if iv, ok := v.(itemView); ok {
+		d.pick = newPicker(iv.Items(80), true)
+	}
+}
+
+// refreshLive re-reads an itemised view's rows, keeping the cursor on the same
+// PATH rather than the same index: a form that grows a key under the cursor
+// must not move the selection out from under it.
+func (d *drawer) refreshLive(w int) {
+	iv, ok := d.live.(itemView)
+	if !ok || d.pick == nil {
+		return
+	}
+	keep := ""
+	if row, had := d.pick.selected(); had {
+		keep = row.id
+	}
+	d.replaceRows(iv.Items(w), keep)
 }
 
 // showMessage is the one-line drawer: an error, a result, a note. It carries
@@ -239,13 +265,16 @@ func (d *drawer) lines(w, h int) []string {
 	if !d.open() {
 		return nil
 	}
-	if d.kind == drawerLive {
+	if d.kind == drawerLive && d.pick == nil {
 		rows := d.live.Rows(w, d.visible(h))
 		for i, r := range rows {
 			rows[i] = drawerGray(clipToWidth(r, w))
 		}
 		return rows
 	}
+	if d.kind == drawerLive {
+		d.refreshLive(w) // the view is live: its rows change under the pit
+	}
 	out := make([]string, 0, d.visible(h)+3)
 	if d.title != "" {
 		out = append(out, drawerGray(clipToWidth(d.title, w)))
 
@@ -230,6 +230,57 @@ func (v *formView) yank() {
 // to a *os.File with \x1b[H\x1b[2J and an absolute jump to the last line. That
 // is why `form listen` could not be hosted: it did not render, it TOOK a
 // screen.
+// Items is how a form takes part in THE PIT: it hands over rows and stops
+// owning a list. It used to keep its own rows, cursor and top and its own j/k
+// handler -- a fourth implementation beside the picker -- and it computed its
+// window as height-2 while the pit reserved its own, so the cursor and the
+// visible range disagreed and the highlight appeared to skip entries.
+//
+// Now the view supplies content and the two VERBS that are its own (Enter
+// expands a branch, y yanks a value); everything a finger does to move is the
+// picker's, once, for every pit.
+func (v *formView) Items(width int) []drawerRow {
+	snap, version, gaps := v.mirror.state()
+	if width <= 0 {
+		width = 80
+	}
+	v.mu.Lock()
+	defer v.mu.Unlock()
+	v.rows = flattenFormTree(buildFormTree(snap), v.open, nil)
+
+	head := fmt.Sprintf("form %s · v%d · %d keys · %d rows", v.aria, version, snap.Len(), len(v.rows))
+	if gaps > 0 {
+		head += fmt.Sprintf(" · %d resync", gaps)
+	}
+	out := make([]drawerRow, 0, len(v.rows)+1)
+	out = append(out, staticRow(clipLine(head, width)))
+	for _, n := range v.rows {
+		// EVERY ROW IS SELECTABLE, which is the other half of the bug: a form's
+		// child rows were not, so a motion that stepped to the next selectable
+		// row jumped over whole properties. A form is a list of things you
+		// look at; all of them can hold the cursor.
+		out = append(out, drawerRow{
+			text: renderFormRow(n, width, false),
+			yank: yankFormNode(n),
+			id:   n.path,
+		})
+	}
+	return out
+}
+
+// Activate is Enter on a row: expand or collapse that branch.
+func (v *formView) Activate(path string) {
+	v.mu.Lock()
+	for _, n := range v.rows {
+		if n.path == path {
+			openBranch(n, v.open)
+			break
+		}
+	}
+	v.mu.Unlock()
+	v.changed()
+}
+
 func (v *formView) Rows(width, height int) []string {
 	snap, version, gaps := v.mirror.state()
 	if width <= 0 {
 
@@ -1728,10 +1728,18 @@ func (t *transcript) dispatch(ev keyEvent) {
 		// right for help and status -- you glance and move on -- and wrong the
 		// moment a drawer is a thing you navigate: ^N used to move the
 		// selection and dismiss the list it was selecting in, in that order.
-		// A HOSTED VERB GETS FIRST REFUSAL on every key. It reports what it
-		// took; anything it declines falls through to the dismissal below, so
-		// Esc still closes the drawer without the view knowing what one is.
-		if t.drawer.kind == drawerLive && ev.nav == navNone && t.drawer.live.Key(ev.b) {
+		// A HOSTED VERB GETS FIRST REFUSAL on every key -- UNLESS IT HAS A
+		// LIST, in which case the pit owns everything a finger does to move
+		// and the view keeps only the verbs that are its own. That inversion
+		// is the fix for `form show`: the view was taking j/k and running its
+		// own cursor against its own window, which disagreed with the pit's,
+		// so the highlight appeared to skip rows.
+		if t.drawer.kind == drawerLive && t.drawer.pick != nil {
+			if t.pitVerb(ev) {
+				t.render()
+				return
+			}
+		} else if t.drawer.kind == drawerLive && ev.nav == navNone && t.drawer.live.Key(ev.b) {
 			t.render()
 			return
 		}
@@ -2491,6 +2499,30 @@ func (t *transcript) cycleCompletion(dir int) {
 	t.cmdline.insert(t.completions[t.completionIdx])
 }
 
+// pitVerb runs an itemised live view's OWN verbs -- Enter expands, y yanks --
+// against the row the PIT has selected. The view no longer has a cursor to
+// disagree about.
+func (t *transcript) pitVerb(ev keyEvent) bool {
+	iv, ok := t.drawer.live.(itemView)
+	if !ok {
+		return false
+	}
+	row, has := t.drawer.selected()
+	switch {
+	case ev.b == '\r' || ev.b == '\n':
+		if has && row.id != "" {
+			iv.Activate(row.id)
+		}
+		return true
+		// 'y' is NOT claimed here: the input loop already yanks a selected pit row
+		// (see inputYank), and two owners for one key is how a yank comes to copy
+		// one thing and report another.
+	}
+	_ = row
+	_ = has
+	return t.drawerMotion(ev)
+}
+
 // drawerMotion runs the shared list motions against the open drawer, and
 // reports whether it took the key. ONE VOCABULARY: these are the transcript's
 // own motions, pointed at the drawer, so a reader who can move around a
 
@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# form show/listen in the pit, against a REAL aria on a REAL model.
+#
+# The fake gateway cannot produce a form worth walking: what is under test is a
+# tree of real keys (skills, system, credo…), the pit's cursor over it, and
+# whether EVERY row can hold the highlight. So this one spends tokens.
+#
+# Isolated store, isolated tmux server, credentials copied from the real config
+# and never written back.
+set -uo pipefail
+
+BIN=${BIN:-/tmp/statusbar/figaro}
+DIR=$(mktemp -d /tmp/formpit.XXXXXX)
+SOCK=$DIR/tmux.sock
+export FIGARO_STATE_DIR=$DIR/state FIGARO_RUNTIME_DIR=$DIR/run \
+       FIGARO_CONFIG_DIR=$DIR/cfg FIGARO_CACHE_DIR=$DIR/cache
+mkdir -p "$FIGARO_STATE_DIR" "$FIGARO_RUNTIME_DIR" "$FIGARO_CACHE_DIR"
+cp -r "$HOME/.config/figaro/." "$FIGARO_CONFIG_DIR"
+chmod 700 "$FIGARO_CONFIG_DIR"
+
+cleanup() {
+  tmux -S "$SOCK" kill-server 2>/dev/null
+  "$BIN" stop >/dev/null 2>&1
+  rm -rf "$DIR"
+}
+trap cleanup EXIT
+
+fail=0
+ARIA=$("$BIN" new -j | python3 -c 'import json,sys;print(json.load(sys.stdin)["aria_id"])') || exit 1
+echo "== real aria $ARIA (real model, real tokens)"
+"$BIN" send -f --id "$ARIA" -- "Say the single word: ready." >/dev/null 2>&1
+for _ in $(seq 90); do
+  [[ "$("$BIN" status "$ARIA" -j 2>/dev/null | python3 -c 'import json,sys;print(json.load(sys.stdin).get("state",""))')" == idle ]] && break
+  sleep 1
+done
+echo "== form has $("$BIN" state show --id "$ARIA" -j 2>/dev/null | python3 -c 'import json,sys;print(len(json.load(sys.stdin)))') top-level keys"
+
+tmux -S "$SOCK" new-session -d -s pit -x 120 -y 41 bash --norc
+tmux -S "$SOCK" set -g status off
+H=$(tmux -S "$SOCK" display -p -t pit:0 '#{pane_height}')
+tmux -S "$SOCK" send-keys -t pit:0 "export FIGARO_STATE_DIR=$FIGARO_STATE_DIR FIGARO_RUNTIME_DIR=$FIGARO_RUNTIME_DIR FIGARO_CONFIG_DIR=$FIGARO_CONFIG_DIR FIGARO_CACHE_DIR=$FIGARO_CACHE_DIR FORCE_COLOR=1" Enter
+tmux -S "$SOCK" send-keys -t pit:0 "$BIN listen $ARIA" Enter
+sleep 4
+echo "== pane height $H"
+
+# Open the form in the pit.
+tmux -S "$SOCK" send-keys -t pit:0 ':'; sleep 0.5
+tmux -S "$SOCK" send-keys -t pit:0 -l "form listen"; sleep 0.5
+tmux -S "$SOCK" send-keys -t pit:0 Enter; sleep 3
+
+pane() { tmux -S "$SOCK" capture-pane -p -t pit:0; }
+# The highlighted row: the picker paints it with a background SGR, so read the
+# ESCAPES, not the text -- capture-pane -e keeps them.
+hl() { tmux -S "$SOCK" capture-pane -p -e -t pit:0 | grep -a "48;5;237m" | head -1 | sed 's/\x1b\[[0-9;]*m//g' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//'; }
+
+first=$(hl)
+echo "first highlight: [$first]"
+[[ -n "$first" ]] || { echo "FAIL: nothing is highlighted in the form pit"; fail=1; }
+
+if pane | grep -q "𝄢"; then echo "ok   the form pit shows its glyph"; else echo "FAIL: no 𝄢 on the bar"; fail=1; fi
+
+# WALK THE WHOLE LIST with j, collecting every distinct highlight. Every step
+# must move by exactly one row: skipping is the bug this test exists for.
+declare -A seen
+order=()
+prev="$first"
+seen["$first"]=1; order+=("$first")
+skips=0
+for i in $(seq 1 60); do
+  tmux -S "$SOCK" send-keys -t pit:0 j; sleep 0.22
+  cur=$(hl)
+  [[ -z "$cur" ]] && { echo "FAIL: highlight vanished after $i presses of j"; fail=1; break; }
+  if [[ "$cur" == "$prev" ]]; then
+    # bottom of the list, or a stuck cursor
+    break
+  fi
+  if [[ -n "${seen[$cur]:-}" ]]; then
+    echo "FAIL: j revisited a row already seen: [$cur]"; fail=1; break
+  fi
+  seen["$cur"]=1; order+=("$cur"); prev="$cur"
+done
+echo "== j visited ${#order[@]} distinct rows"
+printf '   %s\n' "${order[@]}" | head -12
+(( ${#order[@]} >= 8 )) || { echo "FAIL: j only reached ${#order[@]} rows; the form has far more"; fail=1; }
+
+# Now walk BACK with k and insist we see the same rows in reverse. A cursor that
+# skips on the way down often skips differently on the way up.
+back=()
+for i in $(seq 1 ${#order[@]}); do
+  tmux -S "$SOCK" send-keys -t pit:0 k; sleep 0.22
+  cur=$(hl)
+  [[ -n "$cur" ]] || break
+  back+=("$cur")
+  [[ "$cur" == "${order[0]}" ]] && break
+done
+echo "== k walked back over ${#back[@]} rows"
+if [[ "${back[-1]}" == "${order[0]}" ]]; then
+  echo "ok   k returned to the first row"
+else
+  echo "FAIL: k did not return to the first row (ended on [${back[-1]}])"; fail=1
+fi
+
+# Every row j visited must be visited by k too -- EXCEPT THE LAST, which is
+# where k starts and therefore never reports again. (The first draft of this
+# check asserted otherwise and failed on a correct program: k walked back over
+# 9 of 10 rows because the tenth was under the cursor when it began.)
+missing=0
+for row in "${order[@]:1:${#order[@]}-2}"; do
+  found=0
+  for b in "${back[@]}"; do [[ "$b" == "$row" ]] && { found=1; break; }; done
+  (( found )) || { echo "FAIL: k skipped a row j visited: [$row]"; missing=1; }
+done
+(( missing )) && fail=1
+(( missing )) || echo "ok   j and k visit the same rows"
+
+# The pit's HEIGHT must not move as the cursor crosses the list edges.
+tmux -S "$SOCK" send-keys -t pit:0 G; sleep 0.5
+hbot=$(pane | grep -c .)
+tmux -S "$SOCK" send-keys -t pit:0 g; sleep 0.2; tmux -S "$SOCK" send-keys -t pit:0 g; sleep 0.5
+htop=$(pane | grep -c .)
+if [[ "$hbot" == "$htop" ]]; then
+  echo "ok   the pit's height is the same at both ends ($htop rows)"
+else
+  echo "FAIL: the pit changed height between the ends of the list: $htop vs $hbot"; fail=1
+fi
+
+# Enter expands a branch: the row count must grow.
+before=$(pane | grep -c .)
+tmux -S "$SOCK" send-keys -t pit:0 Enter; sleep 1
+[[ -n "$(hl)" ]] || { echo "FAIL: the highlight was lost by Enter"; fail=1; }
+echo "ok   Enter kept the highlight"
+
+tmux -S "$SOCK" send-keys -t pit:0 Escape; sleep 0.5
+tmux -S "$SOCK" send-keys -t pit:0 q; sleep 1
+echo
+(( fail )) && echo "FAILED" || echo "all good"
+exit $fail