diff --git a/content/de/_index.md b/content/de/_index.md
index c8d8c0b..46dee04 100644
--- a/content/de/_index.md
+++ b/content/de/_index.md
@@ -61,7 +61,7 @@ Plattformen cross-kompilieren lässt.
 | [MVVM]({{< relref "/state/mvvm.md" >}}) | Observables, Commands, Binder, Rückgängig |
 | [Das Daten-Rückgrat]({{< relref "/state/data.md" >}}) | typisierte Datensätze, Abfragen, ein lokaler oder entfernter Speicher |
 | [Wohin es zeichnet]({{< relref "/surfaces/_index.md" >}}) | jedes Back-End und wie es ausgewählt wird |
-| [Ein natives Fenster]({{< relref "/surfaces/native-window.md" >}}) | X11, Wayland, Cocoa, Win32, GTK4, Android, wasmbox |
+| [Ein natives Fenster]({{< relref "/surfaces/native-window.md" >}}) | X11, Wayland, Cocoa, Win32, GTK4, Android, wasmbox, ein Browser-Tab |
 | [Eine Anwendung und ihr Tray]({{< relref "/surfaces/application.md" >}}) | Lebenszyklus, Erscheinungsbild, ein Menüleisten-Symbol |
 | [Ein Browser-Tab]({{< relref "/surfaces/browser.md" >}}) | ein einfaches `<canvas>` oder ein wasmdesk-Fenster |
 | [Ein Terminal]({{< relref "/surfaces/terminal.md" >}}) | zellennative Widgets und ein interaktiver Runner |
diff --git a/content/de/modules.md b/content/de/modules.md
index 3987fc1..4c51b3f 100644
--- a/content/de/modules.md
+++ b/content/de/modules.md
@@ -12,23 +12,23 @@ Schreibens – maßgeblich ist die Tag-Liste des jeweiligen Repositorys.
 
 | Modul | Tag | Was es ist | Referenz |
 |---|---|---|---|
-| [`painter`](https://github.com/go-widgets/painter) | v0.15.0 | [die Zeichenschnittstelle]({{< relref "/rendering/painter.md" >}}): Pixel- und Zellen-Painter | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/painter) |
+| [`painter`](https://github.com/go-widgets/painter) | v0.16.0 | [die Zeichenschnittstelle]({{< relref "/rendering/painter.md" >}}): Pixel- und Zellen-Painter | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/painter) |
 | [`toolkit`](https://github.com/go-widgets/toolkit) | v0.328.0 | [der Widget-Satz]({{< relref "/rendering/toolkit.md" >}}), Themes, Layouts, Text | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/toolkit) |
-| [`skin`](https://github.com/go-widgets/skin) | v0.2.0 | [Widgets als Daten beschrieben]({{< relref "/rendering/skin.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/skin) |
+| [`skin`](https://github.com/go-widgets/skin) | v0.3.0 | [Widgets als Daten beschrieben]({{< relref "/rendering/skin.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/skin) |
 | [`isoicons`](https://github.com/go-widgets/isoicons) | v0.3.0 | isometrische Icon-Pakete (Cloud-native, AWS) für die isometrischen Diagramme des Toolkits | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/isoicons) |
-| [`mvvm`](https://github.com/go-widgets/mvvm) | v0.13.0 | [Observables, Commands, Binder, Rückgängig]({{< relref "/state/mvvm.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvm) |
-| [`mvvmtk`](https://github.com/go-widgets/mvvmtk) | v0.14.1 | [Binder mit einem Aufruf für Toolkit-Widgets]({{< relref "/state/mvvm.md#mvvmtk-one-call-per-widget" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmtk) |
-| [`data`](https://github.com/go-widgets/data) | v0.3.0 | [typisierte Datensätze, Abfragen, ein lokaler oder entfernter Speicher]({{< relref "/state/data.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/data) |
-| [`window`](https://github.com/go-widgets/window) | v0.86.1 | [ein natives Fenster]({{< relref "/surfaces/native-window.md" >}}) auf sieben Back-Ends | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/window) |
-| [`application`](https://github.com/go-widgets/application) | v0.7.0 | [der Anwendungslebenszyklus]({{< relref "/surfaces/application.md" >}}) oberhalb eines Fensters | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/application) |
-| [`tray`](https://github.com/go-widgets/tray) | v0.14.0 | [ein Tray-Symbol und sein Menü]({{< relref "/surfaces/application.md#the-tray" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tray) |
-| [`webcanvas`](https://github.com/go-widgets/webcanvas) | v0.2.0 | [eine Szene in einem Browser-`<canvas>`]({{< relref "/surfaces/browser.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/webcanvas) |
+| [`mvvm`](https://github.com/go-widgets/mvvm) | v0.15.0 | [Observables, Commands, Binder, Rückgängig]({{< relref "/state/mvvm.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvm) |
+| [`mvvmtk`](https://github.com/go-widgets/mvvmtk) | v0.15.0 | [Binder mit einem Aufruf für Toolkit-Widgets]({{< relref "/state/mvvm.md#mvvmtk-one-call-per-widget" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmtk) |
+| [`data`](https://github.com/go-widgets/data) | v0.4.0 | [typisierte Datensätze, Abfragen, ein lokaler oder entfernter Speicher]({{< relref "/state/data.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/data) |
+| [`window`](https://github.com/go-widgets/window) | v0.89.0 | [ein natives Fenster]({{< relref "/surfaces/native-window.md" >}}) auf acht Back-Ends | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/window) |
+| [`application`](https://github.com/go-widgets/application) | v0.8.0 | [der Anwendungslebenszyklus]({{< relref "/surfaces/application.md" >}}) oberhalb eines Fensters | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/application) |
+| [`tray`](https://github.com/go-widgets/tray) | v0.15.0 | [ein Tray-Symbol und sein Menü]({{< relref "/surfaces/application.md#the-tray" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tray) |
+| [`webcanvas`](https://github.com/go-widgets/webcanvas) | v0.4.1 | [eine Szene in einem Browser-`<canvas>`]({{< relref "/surfaces/browser.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/webcanvas) |
 | [`tui`](https://github.com/go-widgets/tui) | v0.61.0 | [Terminal-Rendering und zellennative Widgets]({{< relref "/surfaces/terminal.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tui) |
-| [`android`](https://github.com/go-widgets/android) | v0.15.0 | [eine APK, gezeichnet von einem CGO-freien Prozess]({{< relref "/surfaces/android.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/android) |
-| [`svg`](https://github.com/go-widgets/svg) | v0.6.0 | [ein Rendering als SVG oder PNG]({{< relref "/surfaces/snapshots.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/svg) |
-| [`mvvmlint`](https://github.com/go-widgets/mvvmlint) | v0.4.0 | [die MVVM-Prüfung]({{< relref "/guard-rails/mvvmlint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmlint) |
-| [`bricolint`](https://github.com/go-widgets/bricolint) | v0.4.0 | [die Prüfung gegen handgezeichnete UI]({{< relref "/guard-rails/bricolint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/bricolint) |
-| [`app-template`](https://github.com/go-widgets/app-template) | v0.4.0 | [der Ausgangspunkt für eine Anwendung]({{< relref "/getting-started.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/app-template) |
+| [`android`](https://github.com/go-widgets/android) | v0.16.0 | [eine APK, gezeichnet von einem CGO-freien Prozess]({{< relref "/surfaces/android.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/android) |
+| [`svg`](https://github.com/go-widgets/svg) | v0.7.0 | [ein Rendering als SVG oder PNG]({{< relref "/surfaces/snapshots.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/svg) |
+| [`mvvmlint`](https://github.com/go-widgets/mvvmlint) | v0.4.1 | [die MVVM-Prüfung]({{< relref "/guard-rails/mvvmlint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmlint) |
+| [`bricolint`](https://github.com/go-widgets/bricolint) | v0.4.1 | [die Prüfung gegen handgezeichnete UI]({{< relref "/guard-rails/bricolint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/bricolint) |
+| [`app-template`](https://github.com/go-widgets/app-template) | v0.5.0 | [der Ausgangspunkt für eine Anwendung]({{< relref "/getting-started.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/app-template) |
 | [`gallery`](https://github.com/go-widgets/gallery) | v0.6.0 | die [Live-Demo](https://go-widgets.github.io/gallery/) jeder Widget-Familie | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/gallery) |
 | [`desktop`](https://github.com/go-widgets/desktop) | v0.19.0 | eine Desktop-Shell, die go-freedesktop und go-widgets kombiniert, nativ und in wasmdesk | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/desktop) |
 
@@ -38,9 +38,9 @@ Schreibens – maßgeblich ist die Tag-Liste des jeweiligen Repositorys.
   einer Bibliothek.
 - Cross-kompiliert für amd64, arm64, riscv64, loong64, ppc64le und s390x – letzteres
   Big-Endian, was jede Wire-Kodierung ehrlich hält – und, wo es zutrifft,
-  `js/wasm`. Zwölf der neunzehn schaffen heute alle sechs, zwei sind
-  Browser-Anwendungen, und die übrigen fünf sind unter [Stand]({{< relref "/status.md#what-ci-does-not-cover-yet" >}}) aufgeführt.
-- Eine Schranke für die Anweisungsabdeckung in der CI: 100 % bei achtzehn der neunzehn. Wo eine
+  `js/wasm`. Alle siebzehn Bibliotheken und Werkzeuge tun das seit dem 2026-10-10;
+  die übrigen zwei sind Browser-Anwendungen ([Stand]({{< relref "/status.md#what-ci-does-not-cover-yet" >}})).
+- Eine Schranke für die Anweisungsabdeckung in der CI: 100 %, bei allen neunzehn. Wo eine
   Datei nicht in einem Test laufen kann (eine Browser-Schleife, eine native Run-Loop), sagt das Modul,
   welche Datei ausgenommen ist und warum. Die Ausnahmen stehen unter [Stand]({{< relref "/status.md" >}}).
 - BSD-3-Clause.
diff --git a/content/de/status.md b/content/de/status.md
index 3ef0181..b557db1 100644
--- a/content/de/status.md
+++ b/content/de/status.md
@@ -48,17 +48,48 @@ die Plattform selbst gefragt wurde:
   ohne cgo linkt.
 - `window.Screens` gibt unter `js/wasm` `ErrScreensUnsupported` zurück.
 
-## Was die CI noch nicht abdeckt {#what-ci-does-not-cover-yet}
+## Was die CI abdeckt {#what-ci-does-not-cover-yet}
 
-Gemessen an den Workflows jedes Repositorys in den oben genannten Tags:
+Am 2026-10-10 wurden die fünf Lücken geschlossen, die diese Seite aufführte:
 
-| Modul | Lücke |
-|---|---|
-| `mvvmtk` | keine Coverage-Schranke; Cross-Builds nur für amd64 und arm64, auf sechs Betriebssystemen |
-| `application` | Cross-Builds für Linux, macOS und Windows nur auf amd64 |
-| `tray` | Cross-Builds für vier Paare aus Betriebssystem und Architektur |
-| `mvvmlint` | kein Cross-Build |
-| `bricolint` | sein Schritt „6 arches" baut fünf: loong64 fehlt |
+| Modul | Vorher | Jetzt |
+|---|---|---|
+| `mvvmtk` | keine Coverage-Schranke; nur amd64 und arm64 | genau die 100-%-Schranke des Toolkits (es lag bereits bei 100,0 %); Linux auf allen sechs |
+| `application` | Linux, macOS und Windows nur auf amd64 | Linux auf allen sechs; macOS und Windows auf amd64 und arm64 |
+| `tray` | fünf Paare aus Betriebssystem und Architektur | Linux auf allen sechs, macOS auf zwei, Windows auf einer |
+| `mvvmlint` | kein Cross-Build | Linux auf allen sechs, macOS und Windows |
+| `bricolint` | ein Schritt „6 arches", der fünf baute | loong64 hinzugefügt |
 
+Damit bauen nun alle siebzehn Bibliotheken und Werkzeuge per Cross-Build für die
+sechs 64-Bit-Linux-Architekturen, und alle neunzehn haben eine Schranke bei 100 %
+Anweisungsabdeckung.
 `app-template` und `gallery` sind Browser-Anwendungen und bauen für `js/wasm`,
 ihr einziges Ziel.
+
+## Sicherheit {#security}
+
+Gemessen mit `govulncheck` (auf Symbolebene: nur Code, den das Modul erreichen kann)
+am 2026-10-10:
+
+- 15 der 19 Module erreichten verwundbaren Code: in der Standardbibliothek von
+  go1.27.1 (`html/template`, `net/http`, `crypto/tls`, `mime/multipart`; behoben
+  in go1.27.2) und in `golang.org/x/net` v0.58.0 (`http2`, über gRPC in
+  `data`; behoben in v0.60.0).
+- Noch am selben Abend behoben. Die CI jedes Moduls baut mit go1.27.2, und
+  jedes Modul verlangt `x/net` v0.60.0. In den meisten ist es eine indirekte
+  Abhängigkeit, die Renovate nicht aktualisiert; sie wurde daher von Hand
+  angehoben. Ein zweiter `govulncheck`-Lauf über alle 19 Module findet keine
+  erreichbare Schwachstelle.
+- Veröffentlicht: android v0.16.0, app-template v0.5.0, application v0.8.0,
+  bricolint v0.4.1, data v0.4.0, mvvm v0.15.0, mvvmlint v0.4.1, mvvmtk
+  v0.15.0, painter v0.16.0, skin v0.3.0, svg v0.7.0, tray v0.15.0, webcanvas
+  v0.4.1, window v0.89.0, jede Version von `gorelease` aus ihrer API
+  abgeleitet. toolkit, tui, desktop, gallery und isoicons sind auf `main`
+  behoben, aber noch nicht getaggt: `gorelease` kann ihren Modulgraphen nicht
+  lesen, der ein nie veröffentlichtes Modul
+  `github.com/ajroetker/go-highway/hwy/goat` erreicht.
+- Die Workflows aller 23 Repositorys (31 Dateien) wurden mit
+  `actionlint` und `wfaudit` geprüft: kein privilegierter Trigger, keine
+  Schreibberechtigung auf Workflow-Ebene, kein Token in einem hochgeladenen Checkout,
+  kein nicht vertrauenswürdiger Ausdruck in einem Shell-Schritt. Jeder Workflow
+  deklariert seine Berechtigungen, sodass keiner vom Standard-Token eines Repositorys abhängt.
diff --git a/content/de/surfaces/_index.md b/content/de/surfaces/_index.md
index 5539ed6..3d4693b 100644
--- a/content/de/surfaces/_index.md
+++ b/content/de/surfaces/_index.md
@@ -10,7 +10,7 @@ tags: [oberflächen, back-ends]
 |---|---|---|
 | [Ein natives Fenster]({{< relref "/surfaces/native-window.md" >}}) unter X11, Wayland, macOS, Windows | `window` | Pixel |
 | [Eine Anwendung]({{< relref "/surfaces/application.md" >}}) mit Tray-Symbol und dem Erscheinungsbild des Systems | `application`, `tray` | Pixel |
-| [Ein Browser-Tab]({{< relref "/surfaces/browser.md" >}}): ein einfaches `<canvas>` | `webcanvas` | Pixel |
+| [Ein Browser-Tab]({{< relref "/surfaces/browser.md" >}}): ein einfaches `<canvas>` | `webcanvas` oder `window` | Pixel |
 | [Ein Browser-Desktop]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}): ein Fenster des wasmdesk-Compositors | `window` (wasmbox) | Pixel |
 | [Ein Terminal]({{< relref "/surfaces/terminal.md" >}}) | `tui` | Zellen |
 | [Eine Android-APK]({{< relref "/surfaces/android.md" >}}) | `android`, `window` | Pixel |
diff --git a/content/de/surfaces/browser.md b/content/de/surfaces/browser.md
index d1c584a..45c0ff6 100644
--- a/content/de/surfaces/browser.md
+++ b/content/de/surfaces/browser.md
@@ -34,9 +34,16 @@ nicht neu gezeichnet wird. Sie kann außerdem `Ticker`, `Animator`, `Resizer` od
 Die [Galerie](https://go-widgets.github.io/gallery/) und
 [`app-template`]({{< relref "/getting-started.md" >}}) laufen auf diese Weise.
 
+Oder man lässt `window` wählen. Seit window v0.87.0 gibt
+[`window.Open`]({{< relref "/surfaces/native-window.md#how-open-chooses" >}}),
+für `js/wasm` gebaut, auf einer gewöhnlichen Seite ein Back-End zurück, das über
+`webcanvas` in das `<canvas>` der Seite zeichnet (`Config.Canvas`, Standard `"screen"`).
+Eine gegen `window` geschriebene Anwendung läuft dann unverändert als natives Fenster,
+in einem Browser-Tab und in wasmdesk.
+
 ## Ein Fenster auf dem wasmdesk-Desktop {#a-window-on-the-wasmdesk-desktop}
 
-Unter `js/wasm` gibt [`window.Open`]({{< relref "/surfaces/native-window.md" >}})
+In einem wasmdesk-Worker gibt [`window.Open`]({{< relref "/surfaces/native-window.md" >}})
 einen Client des Browser-Compositors [wasmdesk/wasmbox](https://github.com/wasmdesk/wasmbox)
 zurück. Er legt seine Oberfläche in einem `SharedArrayBuffer` an, sagt
 `hello` über seinen `MessagePort`, wartet auf `welcome`, zeichnet in den gemeinsamen
diff --git a/content/de/surfaces/native-window.md b/content/de/surfaces/native-window.md
index 715a0d1..935210e 100644
--- a/content/de/surfaces/native-window.md
+++ b/content/de/surfaces/native-window.md
@@ -2,7 +2,7 @@
 title: "Ein natives Fenster"
 linkTitle: "Natives Fenster"
 weight: 10
-description: "go-widgets/window: eine einzige Open/Run-API über X11, Wayland, Cocoa, Win32, GTK4, Android und wasmbox, alle mit CGO_ENABLED=0."
+description: "go-widgets/window: eine einzige Open/Run-API über X11, Wayland, GTK4, Cocoa, Win32, Android, wasmbox und einen Browser-Tab, alle mit CGO_ENABLED=0."
 tags: [oberflächen, fenster, x11, wayland, macos, windows]
 ---
 
@@ -34,7 +34,8 @@ lesbaren Standardwert), Instanz und Klasse für `WM_CLASS`, ein `Theme` und eine
 | Windows | Win32 | ein Top-Level-`HWND` über Syscalls von user32 und gdi32, `StretchDIBits` |
 | Android, `$GW_ANDROID_SOCKET` gesetzt | Android-Host | ein gerahmtes Protokoll zum [Java-Host]({{< relref "/surfaces/android.md" >}}), Pixel in einem gemeinsamen memfd |
 | Android, sonst | Wayland oder X11 | eine Shell unter Termux hat trotzdem einen Display-Server, mit dem sie sich verbinden kann |
-| `js/wasm` | wasmbox | ein Client des [wasmdesk-Compositors]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) |
+| `js/wasm`, innerhalb von wasmdesk | wasmbox | ein Client des [wasmdesk-Compositors]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) |
+| `js/wasm`, eine gewöhnliche Seite | Browser-Tab | ein `<canvas>` der Seite (`Config.Canvas`, Standard `"screen"`) über `webcanvas`: kein Compositor, kein `SharedArrayBuffer`, keine Cross-Origin-Isolation |
 | alles andere | — | `window.ErrUnsupported`, damit ein Cross-Build trotzdem kompiliert |
 
 Jedes Back-End ist `CGO_ENABLED=0`. Das X11-Back-End ist das Kernprotokoll, von Grund auf
@@ -53,8 +54,10 @@ auf jedem Betriebssystem. Die dünne Plattformanbindung ist live nachgewiesen: s
 ## Nur was sich geändert hat {#only-what-changed}
 
 Eine Wurzel, die `DamageRenderer` implementiert (wie `toolkit/scene.HostRoot`),
-meldet die Rechtecke, die sie neu gezeichnet hat, und die Back-Ends für Cocoa, Win32 und wasmbox
-stellen nur diese dar.
+meldet die Rechtecke, die sie neu gezeichnet hat, und jedes Back-End außer GTK4 stellt nur
+diese dar: X11 über MIT-SHM `ShmPutImage`, Wayland über `wl_shm`-Damage, Cocoa, Win32,
+Android, wasmbox und der Browser-Tab. Der erste Frame, eine Größenänderung und ein
+X11-`Expose` stellen weiterhin die ganze Oberfläche dar.
 
 ## HiDPI {#hidpi}
 
@@ -84,7 +87,7 @@ braucht.
 | Wayland | erneuter Commit | Null-Puffer und Commit | `ErrNotSupported`: xdg-shell hat keine solche Anfrage |
 | macOS | `orderFront:` | `orderOut:` | die App aktivieren, `makeKeyAndOrderFront:` |
 | Windows | `SW_SHOWNA` | `SW_HIDE` | `SW_RESTORE` und `SetForegroundWindow` |
-| GTK, Android, wasmbox | `ErrNotSupported` | `ErrNotSupported` | `ErrNotSupported` |
+| GTK, Android, wasmbox, Browser-Tab | `ErrNotSupported` | `ErrNotSupported` | `ErrNotSupported` |
 
 Den Fokus gewährt die Plattform: Unter einem Schutz gegen Fokusraub kann `Raise`
 das Fenster möglicherweise nur als aufmerksamkeitsbedürftig markieren und kann das nicht erkennen.
diff --git a/content/en/_index.md b/content/en/_index.md
index e1d5dc2..f54bb02 100644
--- a/content/en/_index.md
+++ b/content/en/_index.md
@@ -61,7 +61,7 @@ any of them.
 | [MVVM]({{< relref "/state/mvvm.md" >}}) | observables, commands, binders, undo |
 | [The data spine]({{< relref "/state/data.md" >}}) | typed records, queries, a local or remote store |
 | [Where it paints]({{< relref "/surfaces/_index.md" >}}) | every back-end and how it is chosen |
-| [A native window]({{< relref "/surfaces/native-window.md" >}}) | X11, Wayland, Cocoa, Win32, GTK4, Android, wasmbox |
+| [A native window]({{< relref "/surfaces/native-window.md" >}}) | X11, Wayland, Cocoa, Win32, GTK4, Android, wasmbox, a browser tab |
 | [An application and its tray]({{< relref "/surfaces/application.md" >}}) | lifecycle, appearance, a menu-bar icon |
 | [A browser tab]({{< relref "/surfaces/browser.md" >}}) | a plain `<canvas>`, or a wasmdesk window |
 | [A terminal]({{< relref "/surfaces/terminal.md" >}}) | cell-native widgets and an interactive runner |
diff --git a/content/en/modules.md b/content/en/modules.md
index d3a87ed..6af7813 100644
--- a/content/en/modules.md
+++ b/content/en/modules.md
@@ -12,23 +12,23 @@ writing — the repository's own tag list is the authority.
 
 | Module | Tag | What it is | Reference |
 |---|---|---|---|
-| [`painter`](https://github.com/go-widgets/painter) | v0.15.0 | [the drawing seam]({{< relref "/rendering/painter.md" >}}): pixel and cell painters | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/painter) |
+| [`painter`](https://github.com/go-widgets/painter) | v0.16.0 | [the drawing seam]({{< relref "/rendering/painter.md" >}}): pixel and cell painters | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/painter) |
 | [`toolkit`](https://github.com/go-widgets/toolkit) | v0.328.0 | [the widget set]({{< relref "/rendering/toolkit.md" >}}), themes, layouts, text | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/toolkit) |
-| [`skin`](https://github.com/go-widgets/skin) | v0.2.0 | [widgets described as data]({{< relref "/rendering/skin.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/skin) |
+| [`skin`](https://github.com/go-widgets/skin) | v0.3.0 | [widgets described as data]({{< relref "/rendering/skin.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/skin) |
 | [`isoicons`](https://github.com/go-widgets/isoicons) | v0.3.0 | isometric icon packs (cloud-native, AWS) for the toolkit's isometric diagrams | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/isoicons) |
-| [`mvvm`](https://github.com/go-widgets/mvvm) | v0.13.0 | [observables, commands, binders, undo]({{< relref "/state/mvvm.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvm) |
-| [`mvvmtk`](https://github.com/go-widgets/mvvmtk) | v0.14.1 | [one-call binders for toolkit widgets]({{< relref "/state/mvvm.md#mvvmtk-one-call-per-widget" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmtk) |
-| [`data`](https://github.com/go-widgets/data) | v0.3.0 | [typed records, queries, a local or remote store]({{< relref "/state/data.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/data) |
-| [`window`](https://github.com/go-widgets/window) | v0.86.1 | [a native window]({{< relref "/surfaces/native-window.md" >}}) on seven back-ends | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/window) |
-| [`application`](https://github.com/go-widgets/application) | v0.7.0 | [the application lifecycle]({{< relref "/surfaces/application.md" >}}) above a window | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/application) |
-| [`tray`](https://github.com/go-widgets/tray) | v0.14.0 | [a tray icon and its menu]({{< relref "/surfaces/application.md#the-tray" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tray) |
-| [`webcanvas`](https://github.com/go-widgets/webcanvas) | v0.2.0 | [a scene in a browser `<canvas>`]({{< relref "/surfaces/browser.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/webcanvas) |
+| [`mvvm`](https://github.com/go-widgets/mvvm) | v0.15.0 | [observables, commands, binders, undo]({{< relref "/state/mvvm.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvm) |
+| [`mvvmtk`](https://github.com/go-widgets/mvvmtk) | v0.15.0 | [one-call binders for toolkit widgets]({{< relref "/state/mvvm.md#mvvmtk-one-call-per-widget" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmtk) |
+| [`data`](https://github.com/go-widgets/data) | v0.4.0 | [typed records, queries, a local or remote store]({{< relref "/state/data.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/data) |
+| [`window`](https://github.com/go-widgets/window) | v0.89.0 | [a native window]({{< relref "/surfaces/native-window.md" >}}) on eight back-ends | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/window) |
+| [`application`](https://github.com/go-widgets/application) | v0.8.0 | [the application lifecycle]({{< relref "/surfaces/application.md" >}}) above a window | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/application) |
+| [`tray`](https://github.com/go-widgets/tray) | v0.15.0 | [a tray icon and its menu]({{< relref "/surfaces/application.md#the-tray" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tray) |
+| [`webcanvas`](https://github.com/go-widgets/webcanvas) | v0.4.1 | [a scene in a browser `<canvas>`]({{< relref "/surfaces/browser.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/webcanvas) |
 | [`tui`](https://github.com/go-widgets/tui) | v0.61.0 | [terminal rendering and cell-native widgets]({{< relref "/surfaces/terminal.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tui) |
-| [`android`](https://github.com/go-widgets/android) | v0.15.0 | [an APK painted by a CGO-free process]({{< relref "/surfaces/android.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/android) |
-| [`svg`](https://github.com/go-widgets/svg) | v0.6.0 | [a render as SVG or PNG]({{< relref "/surfaces/snapshots.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/svg) |
-| [`mvvmlint`](https://github.com/go-widgets/mvvmlint) | v0.4.0 | [the MVVM check]({{< relref "/guard-rails/mvvmlint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmlint) |
-| [`bricolint`](https://github.com/go-widgets/bricolint) | v0.4.0 | [the no-hand-drawn-UI check]({{< relref "/guard-rails/bricolint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/bricolint) |
-| [`app-template`](https://github.com/go-widgets/app-template) | v0.4.0 | [the starting point for an application]({{< relref "/getting-started.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/app-template) |
+| [`android`](https://github.com/go-widgets/android) | v0.16.0 | [an APK painted by a CGO-free process]({{< relref "/surfaces/android.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/android) |
+| [`svg`](https://github.com/go-widgets/svg) | v0.7.0 | [a render as SVG or PNG]({{< relref "/surfaces/snapshots.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/svg) |
+| [`mvvmlint`](https://github.com/go-widgets/mvvmlint) | v0.4.1 | [the MVVM check]({{< relref "/guard-rails/mvvmlint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmlint) |
+| [`bricolint`](https://github.com/go-widgets/bricolint) | v0.4.1 | [the no-hand-drawn-UI check]({{< relref "/guard-rails/bricolint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/bricolint) |
+| [`app-template`](https://github.com/go-widgets/app-template) | v0.5.0 | [the starting point for an application]({{< relref "/getting-started.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/app-template) |
 | [`gallery`](https://github.com/go-widgets/gallery) | v0.6.0 | the [live demo](https://go-widgets.github.io/gallery/) of every widget family | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/gallery) |
 | [`desktop`](https://github.com/go-widgets/desktop) | v0.19.0 | a desktop shell composing go-freedesktop and go-widgets, native and in wasmdesk | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/desktop) |
 
@@ -38,9 +38,9 @@ writing — the repository's own tag list is the authority.
   of a library.
 - Cross-compiled for amd64, arm64, riscv64, loong64, ppc64le and s390x — the
   last big-endian, which keeps every wire encoding honest — and, where it
-  applies, `js/wasm`. Twelve of the nineteen do all six today, two are
-  browser applications, and the other five are listed in [Status]({{< relref "/status.md#what-ci-does-not-cover-yet" >}}).
-- A statement-coverage gate in CI: 100% in eighteen of the nineteen. Where a
+  applies, `js/wasm`. All seventeen libraries and tools do since 2026-10-10;
+  the other two are browser applications ([Status]({{< relref "/status.md#what-ci-does-not-cover-yet" >}})).
+- A statement-coverage gate in CI: 100%, in all nineteen. Where a
   file cannot run in a test (a browser loop, a native run loop), the module
   says which file is left out and why. See [Status]({{< relref "/status.md" >}})
   for the exceptions.
diff --git a/content/en/status.md b/content/en/status.md
index 2d686e9..31e5eb5 100644
--- a/content/en/status.md
+++ b/content/en/status.md
@@ -48,17 +48,45 @@ platform itself was asked:
   links without cgo.
 - `window.Screens` returns `ErrScreensUnsupported` on `js/wasm`.
 
-## What CI does not cover yet
+## What CI covers {#what-ci-does-not-cover-yet}
 
-Measured from each repository's workflows at the tags above:
+On 2026-10-10 the five gaps this page listed were closed:
 
-| Module | Gap |
-|---|---|
-| `mvvmtk` | no coverage gate; cross-builds amd64 and arm64 only, on six operating systems |
-| `application` | cross-builds Linux, macOS and Windows on amd64 only |
-| `tray` | cross-builds four OS/architecture pairs |
-| `mvvmlint` | no cross-build |
-| `bricolint` | its "6 arches" step builds five: loong64 is missing |
+| Module | Was | Now |
+|---|---|---|
+| `mvvmtk` | no coverage gate; amd64 and arm64 only | the exact 100% gate the toolkit uses (it stood at 100.0% already); Linux on all six |
+| `application` | Linux, macOS and Windows on amd64 only | Linux on all six; macOS and Windows on amd64 and arm64 |
+| `tray` | five OS/architecture pairs | Linux on all six, macOS on two, Windows on one |
+| `mvvmlint` | no cross-build | Linux on all six, macOS and Windows |
+| `bricolint` | a "6 arches" step that built five | loong64 added |
 
+So all seventeen libraries and tools now cross-build for the six 64-bit
+Linux architectures, and all nineteen gate at 100% statement coverage.
 `app-template` and `gallery` are browser applications and build for `js/wasm`,
 which is their only target.
+
+## Security {#security}
+
+Measured with `govulncheck` (symbol level: only code the module can reach) on
+2026-10-10:
+
+- 15 of the 19 modules reached vulnerable code: in the standard library of
+  go1.27.1 (`html/template`, `net/http`, `crypto/tls`, `mime/multipart`; fixed
+  in go1.27.2) and in `golang.org/x/net` v0.58.0 (`http2`, through gRPC in
+  `data`; fixed in v0.60.0).
+- Fixed the same evening. Every module's CI builds with go1.27.2, and every
+  module requires `x/net` v0.60.0. It is an indirect requirement in most of
+  them, which Renovate does not update, so it was raised by hand. A second
+  `govulncheck` pass over all 19 modules finds no reachable vulnerability.
+- Released: android v0.16.0, app-template v0.5.0, application v0.8.0,
+  bricolint v0.4.1, data v0.4.0, mvvm v0.15.0, mvvmlint v0.4.1, mvvmtk
+  v0.15.0, painter v0.16.0, skin v0.3.0, svg v0.7.0, tray v0.15.0, webcanvas
+  v0.4.1, window v0.89.0, each version derived from its API by `gorelease`.
+  toolkit, tui, desktop, gallery and isoicons are fixed on `main` and not yet
+  tagged: `gorelease` cannot read their module graph, which reaches a module
+  `github.com/ajroetker/go-highway/hwy/goat` that was never published.
+- The workflows of all 23 repositories (31 files) were audited with
+  `actionlint` and `wfaudit`: no privileged trigger, no write grant at the
+  workflow level, no token left in an uploaded checkout, no untrusted
+  expression in a shell step. Every workflow declares its permissions, so
+  none depends on a repository's default token.
diff --git a/content/en/surfaces/_index.md b/content/en/surfaces/_index.md
index ca9acd6..ca5b4ed 100644
--- a/content/en/surfaces/_index.md
+++ b/content/en/surfaces/_index.md
@@ -10,7 +10,7 @@ tags: [surfaces, back-ends]
 |---|---|---|
 | [A native window]({{< relref "/surfaces/native-window.md" >}}) on X11, Wayland, macOS, Windows | `window` | pixels |
 | [An application]({{< relref "/surfaces/application.md" >}}) with a tray icon and the system appearance | `application`, `tray` | pixels |
-| [A browser tab]({{< relref "/surfaces/browser.md" >}}): a plain `<canvas>` | `webcanvas` | pixels |
+| [A browser tab]({{< relref "/surfaces/browser.md" >}}): a plain `<canvas>` | `webcanvas`, or `window` | pixels |
 | [A browser desktop]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}): a window of the wasmdesk compositor | `window` (wasmbox) | pixels |
 | [A terminal]({{< relref "/surfaces/terminal.md" >}}) | `tui` | cells |
 | [An Android APK]({{< relref "/surfaces/android.md" >}}) | `android`, `window` | pixels |
diff --git a/content/en/surfaces/browser.md b/content/en/surfaces/browser.md
index eea084c..e9904d3 100644
--- a/content/en/surfaces/browser.md
+++ b/content/en/surfaces/browser.md
@@ -34,9 +34,16 @@ is not repainted. It may also implement `Ticker`, `Animator`, `Resizer` or
 The [gallery](https://go-widgets.github.io/gallery/) and
 [`app-template`]({{< relref "/getting-started.md" >}}) run this way.
 
+Or let `window` choose. Since window v0.87.0,
+[`window.Open`]({{< relref "/surfaces/native-window.md#how-open-chooses" >}})
+built for `js/wasm` on an ordinary page returns a back-end that draws into the
+page's `<canvas>` (`Config.Canvas`, default `"screen"`) through `webcanvas`. An
+application written against `window` then runs unchanged as a native window, in
+a browser tab, and in wasmdesk.
+
 ## A window on the wasmdesk desktop
 
-On `js/wasm`, [`window.Open`]({{< relref "/surfaces/native-window.md" >}})
+Inside a wasmdesk worker, [`window.Open`]({{< relref "/surfaces/native-window.md" >}})
 returns a client of the [wasmdesk/wasmbox](https://github.com/wasmdesk/wasmbox)
 browser compositor. It allocates its surface in a `SharedArrayBuffer`, says
 `hello` over its `MessagePort`, waits for `welcome`, paints into the shared
diff --git a/content/en/surfaces/native-window.md b/content/en/surfaces/native-window.md
index 310e46f..414b130 100644
--- a/content/en/surfaces/native-window.md
+++ b/content/en/surfaces/native-window.md
@@ -2,7 +2,7 @@
 title: "A native window"
 linkTitle: "Native window"
 weight: 10
-description: "go-widgets/window: one Open/Run API over X11, Wayland, Cocoa, Win32, GTK4, Android and wasmbox, all with CGO_ENABLED=0."
+description: "go-widgets/window: one Open/Run API over X11, Wayland, GTK4, Cocoa, Win32, Android, wasmbox and a browser tab, all with CGO_ENABLED=0."
 tags: [surfaces, window, x11, wayland, macos, windows]
 ---
 
@@ -34,7 +34,8 @@ readable default), the `WM_CLASS` instance and class, a `Theme`, and a
 | Windows | Win32 | a top-level `HWND` through user32 and gdi32 syscalls, `StretchDIBits` |
 | Android, `$GW_ANDROID_SOCKET` set | Android host | a framed protocol to [the Java host]({{< relref "/surfaces/android.md" >}}), pixels in a shared memfd |
 | Android, otherwise | Wayland or X11 | a shell under Termux still has a display server to dial |
-| `js/wasm` | wasmbox | a client of the [wasmdesk compositor]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) |
+| `js/wasm`, inside wasmdesk | wasmbox | a client of the [wasmdesk compositor]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) |
+| `js/wasm`, an ordinary page | browser tab | a `<canvas>` of the page (`Config.Canvas`, default `"screen"`) through `webcanvas`: no compositor, no `SharedArrayBuffer`, no cross-origin isolation |
 | anything else | — | `window.ErrUnsupported`, so a cross-build still compiles |
 
 Every back-end is `CGO_ENABLED=0`. The X11 one is the core protocol written
@@ -53,8 +54,10 @@ on every operating system. The thin platform glue is proven live: see
 ## Only what changed
 
 A root that implements `DamageRenderer` (as `toolkit/scene.HostRoot` does)
-reports the rectangles it repainted, and the Cocoa, Win32 and wasmbox
-back-ends present only those.
+reports the rectangles it repainted, and every back-end but GTK4 presents only
+those: X11 through MIT-SHM `ShmPutImage`, Wayland through `wl_shm` damage,
+Cocoa, Win32, Android, wasmbox and the browser tab. The first frame, a
+resize and an X11 `Expose` still present the whole surface.
 
 ## HiDPI
 
@@ -84,7 +87,7 @@ needs.
 | Wayland | commit again | null buffer and commit | `ErrNotSupported`: xdg-shell has no such request |
 | macOS | `orderFront:` | `orderOut:` | activate the app, `makeKeyAndOrderFront:` |
 | Windows | `SW_SHOWNA` | `SW_HIDE` | `SW_RESTORE` and `SetForegroundWindow` |
-| GTK, Android, wasmbox | `ErrNotSupported` | `ErrNotSupported` | `ErrNotSupported` |
+| GTK, Android, wasmbox, browser tab | `ErrNotSupported` | `ErrNotSupported` | `ErrNotSupported` |
 
 Focus is the platform's to grant: under focus-stealing prevention, `Raise`
 may only mark the window as wanting attention, and cannot tell.
diff --git a/content/es/_index.md b/content/es/_index.md
index a2ca058..7c00f91 100644
--- a/content/es/_index.md
+++ b/content/es/_index.md
@@ -61,7 +61,7 @@ compila de forma cruzada desde cualquier máquina hacia cualquiera de ellas.
 | [MVVM]({{< relref "/state/mvvm.md" >}}) | observables, comandos, binders, deshacer |
 | [La columna vertebral de datos]({{< relref "/state/data.md" >}}) | registros tipados, consultas, un almacén local o remoto |
 | [Dónde pinta]({{< relref "/surfaces/_index.md" >}}) | cada backend y cómo se elige |
-| [Una ventana nativa]({{< relref "/surfaces/native-window.md" >}}) | X11, Wayland, Cocoa, Win32, GTK4, Android, wasmbox |
+| [Una ventana nativa]({{< relref "/surfaces/native-window.md" >}}) | X11, Wayland, Cocoa, Win32, GTK4, Android, wasmbox, una pestaña del navegador |
 | [Una aplicación y su bandeja]({{< relref "/surfaces/application.md" >}}) | ciclo de vida, apariencia, un icono en la barra de menús |
 | [Una pestaña del navegador]({{< relref "/surfaces/browser.md" >}}) | un simple `<canvas>`, o una ventana de wasmdesk |
 | [Un terminal]({{< relref "/surfaces/terminal.md" >}}) | widgets nativos de celdas y un ejecutor interactivo |
diff --git a/content/es/modules.md b/content/es/modules.md
index 2acd140..4a9ecb9 100644
--- a/content/es/modules.md
+++ b/content/es/modules.md
@@ -12,23 +12,23 @@ de escribir; la autoridad es la lista de etiquetas del propio repositorio.
 
 | Módulo | Etiqueta | Qué es | Referencia |
 |---|---|---|---|
-| [`painter`](https://github.com/go-widgets/painter) | v0.15.0 | [la costura de dibujo]({{< relref "/rendering/painter.md" >}}): painters de píxeles y de celdas | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/painter) |
+| [`painter`](https://github.com/go-widgets/painter) | v0.16.0 | [la costura de dibujo]({{< relref "/rendering/painter.md" >}}): painters de píxeles y de celdas | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/painter) |
 | [`toolkit`](https://github.com/go-widgets/toolkit) | v0.328.0 | [el conjunto de widgets]({{< relref "/rendering/toolkit.md" >}}), temas, layouts, texto | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/toolkit) |
-| [`skin`](https://github.com/go-widgets/skin) | v0.2.0 | [widgets descritos como datos]({{< relref "/rendering/skin.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/skin) |
+| [`skin`](https://github.com/go-widgets/skin) | v0.3.0 | [widgets descritos como datos]({{< relref "/rendering/skin.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/skin) |
 | [`isoicons`](https://github.com/go-widgets/isoicons) | v0.3.0 | paquetes de iconos isométricos (cloud-native, AWS) para los diagramas isométricos del toolkit | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/isoicons) |
-| [`mvvm`](https://github.com/go-widgets/mvvm) | v0.13.0 | [observables, comandos, binders, deshacer]({{< relref "/state/mvvm.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvm) |
-| [`mvvmtk`](https://github.com/go-widgets/mvvmtk) | v0.14.1 | [binders de una sola llamada para los widgets del toolkit]({{< relref "/state/mvvm.md#mvvmtk-one-call-per-widget" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmtk) |
-| [`data`](https://github.com/go-widgets/data) | v0.3.0 | [registros tipados, consultas, un almacén local o remoto]({{< relref "/state/data.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/data) |
-| [`window`](https://github.com/go-widgets/window) | v0.86.1 | [una ventana nativa]({{< relref "/surfaces/native-window.md" >}}) sobre siete backends | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/window) |
-| [`application`](https://github.com/go-widgets/application) | v0.7.0 | [el ciclo de vida de la aplicación]({{< relref "/surfaces/application.md" >}}) por encima de una ventana | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/application) |
-| [`tray`](https://github.com/go-widgets/tray) | v0.14.0 | [un icono de bandeja y su menú]({{< relref "/surfaces/application.md#the-tray" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tray) |
-| [`webcanvas`](https://github.com/go-widgets/webcanvas) | v0.2.0 | [una escena en un `<canvas>` de navegador]({{< relref "/surfaces/browser.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/webcanvas) |
+| [`mvvm`](https://github.com/go-widgets/mvvm) | v0.15.0 | [observables, comandos, binders, deshacer]({{< relref "/state/mvvm.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvm) |
+| [`mvvmtk`](https://github.com/go-widgets/mvvmtk) | v0.15.0 | [binders de una sola llamada para los widgets del toolkit]({{< relref "/state/mvvm.md#mvvmtk-one-call-per-widget" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmtk) |
+| [`data`](https://github.com/go-widgets/data) | v0.4.0 | [registros tipados, consultas, un almacén local o remoto]({{< relref "/state/data.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/data) |
+| [`window`](https://github.com/go-widgets/window) | v0.89.0 | [una ventana nativa]({{< relref "/surfaces/native-window.md" >}}) sobre ocho backends | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/window) |
+| [`application`](https://github.com/go-widgets/application) | v0.8.0 | [el ciclo de vida de la aplicación]({{< relref "/surfaces/application.md" >}}) por encima de una ventana | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/application) |
+| [`tray`](https://github.com/go-widgets/tray) | v0.15.0 | [un icono de bandeja y su menú]({{< relref "/surfaces/application.md#the-tray" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tray) |
+| [`webcanvas`](https://github.com/go-widgets/webcanvas) | v0.4.1 | [una escena en un `<canvas>` de navegador]({{< relref "/surfaces/browser.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/webcanvas) |
 | [`tui`](https://github.com/go-widgets/tui) | v0.61.0 | [renderizado en terminal y widgets nativos de celdas]({{< relref "/surfaces/terminal.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tui) |
-| [`android`](https://github.com/go-widgets/android) | v0.15.0 | [un APK pintado por un proceso sin CGO]({{< relref "/surfaces/android.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/android) |
-| [`svg`](https://github.com/go-widgets/svg) | v0.6.0 | [un renderizado como SVG o PNG]({{< relref "/surfaces/snapshots.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/svg) |
-| [`mvvmlint`](https://github.com/go-widgets/mvvmlint) | v0.4.0 | [la comprobación MVVM]({{< relref "/guard-rails/mvvmlint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmlint) |
-| [`bricolint`](https://github.com/go-widgets/bricolint) | v0.4.0 | [la comprobación de que no haya interfaz dibujada a mano]({{< relref "/guard-rails/bricolint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/bricolint) |
-| [`app-template`](https://github.com/go-widgets/app-template) | v0.4.0 | [el punto de partida de una aplicación]({{< relref "/getting-started.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/app-template) |
+| [`android`](https://github.com/go-widgets/android) | v0.16.0 | [un APK pintado por un proceso sin CGO]({{< relref "/surfaces/android.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/android) |
+| [`svg`](https://github.com/go-widgets/svg) | v0.7.0 | [un renderizado como SVG o PNG]({{< relref "/surfaces/snapshots.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/svg) |
+| [`mvvmlint`](https://github.com/go-widgets/mvvmlint) | v0.4.1 | [la comprobación MVVM]({{< relref "/guard-rails/mvvmlint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmlint) |
+| [`bricolint`](https://github.com/go-widgets/bricolint) | v0.4.1 | [la comprobación de que no haya interfaz dibujada a mano]({{< relref "/guard-rails/bricolint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/bricolint) |
+| [`app-template`](https://github.com/go-widgets/app-template) | v0.5.0 | [el punto de partida de una aplicación]({{< relref "/getting-started.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/app-template) |
 | [`gallery`](https://github.com/go-widgets/gallery) | v0.6.0 | la [demo en vivo](https://go-widgets.github.io/gallery/) de todas las familias de widgets | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/gallery) |
 | [`desktop`](https://github.com/go-widgets/desktop) | v0.19.0 | un shell de escritorio que combina go-freedesktop y go-widgets, nativo y en wasmdesk | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/desktop) |
 
@@ -38,10 +38,10 @@ de escribir; la autoridad es la lista de etiquetas del propio repositorio.
   comandos en lugar de una biblioteca.
 - Compilación cruzada para amd64, arm64, riscv64, loong64, ppc64le y s390x
   —esta última big-endian, lo que mantiene honesta cada codificación binaria— y,
-  cuando procede, `js/wasm`. Doce de los diecinueve cubren hoy las seis, dos son
-  aplicaciones de navegador y los otros cinco figuran en [Estado]({{< relref "/status.md#what-ci-does-not-cover-yet" >}}).
-- Una barrera de cobertura de sentencias en la CI: 100 % en dieciocho de los
-  diecinueve. Cuando un archivo no puede ejecutarse en una prueba (un bucle de
+  cuando procede, `js/wasm`. Las diecisiete bibliotecas y herramientas lo hacen
+  desde el 2026-10-10; los otros dos son aplicaciones de navegador ([Estado]({{< relref "/status.md#what-ci-does-not-cover-yet" >}})).
+- Una barrera de cobertura de sentencias en la CI: 100 %, en los diecinueve.
+  Cuando un archivo no puede ejecutarse en una prueba (un bucle de
   navegador, un bucle de ejecución nativo), el módulo indica qué archivo queda
   fuera y por qué. Consulte [Estado]({{< relref "/status.md" >}}) para las
   excepciones.
diff --git a/content/es/status.md b/content/es/status.md
index 168fd91..708e6bc 100644
--- a/content/es/status.md
+++ b/content/es/status.md
@@ -50,17 +50,48 @@ los que se interrogó a la propia plataforma:
   enlaza sin cgo.
 - `window.Screens` devuelve `ErrScreensUnsupported` en `js/wasm`.
 
-## Lo que la CI aún no cubre {#what-ci-does-not-cover-yet}
+## Lo que cubre la CI {#what-ci-does-not-cover-yet}
 
-Medido a partir de los workflows de cada repositorio en las etiquetas anteriores:
+El 2026-10-10 se cerraron las cinco carencias que esta página enumeraba:
 
-| Módulo | Carencia |
-|---|---|
-| `mvvmtk` | sin barrera de cobertura; compilación cruzada solo para amd64 y arm64, en seis sistemas operativos |
-| `application` | compilación cruzada para Linux, macOS y Windows solo en amd64 |
-| `tray` | compilación cruzada para cuatro pares sistema operativo/arquitectura |
-| `mvvmlint` | sin compilación cruzada |
-| `bricolint` | su paso «6 arches» compila cinco: falta loong64 |
+| Módulo | Antes | Ahora |
+|---|---|---|
+| `mvvmtk` | sin barrera de cobertura; solo amd64 y arm64 | exactamente la barrera del 100 % que usa el toolkit (ya estaba en el 100,0 %); Linux en las seis |
+| `application` | Linux, macOS y Windows solo en amd64 | Linux en las seis; macOS y Windows en amd64 y arm64 |
+| `tray` | cinco pares sistema operativo/arquitectura | Linux en las seis, macOS en dos, Windows en una |
+| `mvvmlint` | sin compilación cruzada | Linux en las seis, macOS y Windows |
+| `bricolint` | un paso «6 arches» que compilaba cinco | loong64 añadida |
 
+Así, las diecisiete bibliotecas y herramientas se compilan ya de forma cruzada
+para las seis arquitecturas Linux de 64 bits, y los diecinueve módulos tienen
+una barrera del 100 % de cobertura de sentencias.
 `app-template` y `gallery` son aplicaciones de navegador y se compilan para
 `js/wasm`, que es su único destino.
+
+## Seguridad {#security}
+
+Medido con `govulncheck` (a nivel de símbolo: solo el código que el módulo
+puede alcanzar) el 2026-10-10:
+
+- 15 de los 19 módulos alcanzaban código vulnerable: en la biblioteca estándar
+  de go1.27.1 (`html/template`, `net/http`, `crypto/tls`, `mime/multipart`;
+  corregido en go1.27.2) y en `golang.org/x/net` v0.58.0 (`http2`, a través de
+  gRPC en `data`; corregido en v0.60.0).
+- Corregido esa misma noche. La CI de todos los módulos compila con go1.27.2, y
+  todos los módulos requieren `x/net` v0.60.0. En la mayoría es una dependencia
+  indirecta, que Renovate no actualiza, así que se subió a mano. Una segunda
+  pasada de `govulncheck` sobre los 19 módulos no encuentra ninguna
+  vulnerabilidad alcanzable.
+- Publicados: android v0.16.0, app-template v0.5.0, application v0.8.0,
+  bricolint v0.4.1, data v0.4.0, mvvm v0.15.0, mvvmlint v0.4.1, mvvmtk
+  v0.15.0, painter v0.16.0, skin v0.3.0, svg v0.7.0, tray v0.15.0, webcanvas
+  v0.4.1, window v0.89.0, cada versión deducida de su API por `gorelease`.
+  toolkit, tui, desktop, gallery e isoicons están corregidos en `main` pero aún
+  sin etiqueta: `gorelease` no puede leer su grafo de módulos, que alcanza un
+  módulo `github.com/ajroetker/go-highway/hwy/goat` que nunca se publicó.
+- Los workflows de los 23 repositorios (31 archivos) se auditaron con
+  `actionlint` y `wfaudit`: ningún disparador privilegiado, ningún permiso de
+  escritura a nivel de workflow, ningún token olvidado en un checkout subido,
+  ninguna expresión no confiable en un paso de shell. Todos los workflows
+  declaran sus permisos, de modo que ninguno depende del token por defecto de
+  un repositorio.
diff --git a/content/es/surfaces/_index.md b/content/es/surfaces/_index.md
index 5d5a540..f46692d 100644
--- a/content/es/surfaces/_index.md
+++ b/content/es/surfaces/_index.md
@@ -10,7 +10,7 @@ tags: [superficies, backends]
 |---|---|---|
 | [Una ventana nativa]({{< relref "/surfaces/native-window.md" >}}) en X11, Wayland, macOS, Windows | `window` | píxeles |
 | [Una aplicación]({{< relref "/surfaces/application.md" >}}) con un icono en la bandeja y la apariencia del sistema | `application`, `tray` | píxeles |
-| [Una pestaña del navegador]({{< relref "/surfaces/browser.md" >}}): un simple `<canvas>` | `webcanvas` | píxeles |
+| [Una pestaña del navegador]({{< relref "/surfaces/browser.md" >}}): un simple `<canvas>` | `webcanvas`, o `window` | píxeles |
 | [Un escritorio en el navegador]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}): una ventana del compositor wasmdesk | `window` (wasmbox) | píxeles |
 | [Un terminal]({{< relref "/surfaces/terminal.md" >}}) | `tui` | celdas |
 | [Un APK de Android]({{< relref "/surfaces/android.md" >}}) | `android`, `window` | píxeles |
diff --git a/content/es/surfaces/browser.md b/content/es/surfaces/browser.md
index e603436..24f52d4 100644
--- a/content/es/surfaces/browser.md
+++ b/content/es/surfaces/browser.md
@@ -35,9 +35,16 @@ cambios no se repinte. También puede implementar `Ticker`, `Animator`,
 La [galería](https://go-widgets.github.io/gallery/) y
 [`app-template`]({{< relref "/getting-started.md" >}}) funcionan así.
 
+O deje que `window` elija. Desde window v0.87.0,
+[`window.Open`]({{< relref "/surfaces/native-window.md#how-open-chooses" >}})
+compilado para `js/wasm` en una página corriente devuelve un backend que dibuja
+en el `<canvas>` de la página (`Config.Canvas`, por defecto `"screen"`) a través
+de `webcanvas`. Una aplicación escrita contra `window` se ejecuta entonces sin
+cambios como ventana nativa, en una pestaña del navegador y en wasmdesk.
+
 ## Una ventana en el escritorio wasmdesk {#a-window-on-the-wasmdesk-desktop}
 
-En `js/wasm`, [`window.Open`]({{< relref "/surfaces/native-window.md" >}})
+Dentro de un worker de wasmdesk, [`window.Open`]({{< relref "/surfaces/native-window.md" >}})
 devuelve un cliente del compositor de navegador
 [wasmdesk/wasmbox](https://github.com/wasmdesk/wasmbox). Asigna su superficie
 en un `SharedArrayBuffer`, dice `hello` por su `MessagePort`, espera `welcome`,
diff --git a/content/es/surfaces/native-window.md b/content/es/surfaces/native-window.md
index 8990437..052da2a 100644
--- a/content/es/surfaces/native-window.md
+++ b/content/es/surfaces/native-window.md
@@ -2,7 +2,7 @@
 title: "Una ventana nativa"
 linkTitle: "Ventana nativa"
 weight: 10
-description: "go-widgets/window: una sola API Open/Run sobre X11, Wayland, Cocoa, Win32, GTK4, Android y wasmbox, todo con CGO_ENABLED=0."
+description: "go-widgets/window: una sola API Open/Run sobre X11, Wayland, GTK4, Cocoa, Win32, Android, wasmbox y una pestaña del navegador, todo con CGO_ENABLED=0."
 tags: [superficies, ventana, x11, wayland, macos, windows]
 ---
 
@@ -35,7 +35,8 @@ y un `RenderScale`.
 | Windows | Win32 | un `HWND` de nivel superior mediante llamadas al sistema de user32 y gdi32, `StretchDIBits` |
 | Android, `$GW_ANDROID_SOCKET` definida | Host Android | un protocolo por tramas hacia [el host Java]({{< relref "/surfaces/android.md" >}}), píxeles en un memfd compartido |
 | Android, en otro caso | Wayland o X11 | un shell bajo Termux sigue teniendo un servidor gráfico al que conectarse |
-| `js/wasm` | wasmbox | un cliente del [compositor wasmdesk]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) |
+| `js/wasm`, dentro de wasmdesk | wasmbox | un cliente del [compositor wasmdesk]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) |
+| `js/wasm`, una página corriente | pestaña del navegador | un `<canvas>` de la página (`Config.Canvas`, por defecto `"screen"`) a través de `webcanvas`: sin compositor, sin `SharedArrayBuffer`, sin aislamiento entre orígenes |
 | cualquier otra cosa | — | `window.ErrUnsupported`, para que una compilación cruzada siga compilando |
 
 Todos los backends son `CGO_ENABLED=0`. El de X11 es el protocolo central
@@ -56,8 +57,11 @@ unión con la plataforma se demuestra en vivo: consulte
 ## Solo lo que ha cambiado {#only-what-changed}
 
 Una raíz que implementa `DamageRenderer` (como hace `toolkit/scene.HostRoot`)
-informa de los rectángulos que ha repintado, y los backends Cocoa, Win32 y
-wasmbox presentan solo esos.
+informa de los rectángulos que ha repintado, y todos los backends salvo GTK4
+presentan solo esos: X11 mediante `ShmPutImage` de MIT-SHM, Wayland mediante
+el daño de `wl_shm`, Cocoa, Win32, Android, wasmbox y la pestaña del navegador.
+El primer fotograma, un cambio de tamaño y un `Expose` de X11 siguen
+presentando toda la superficie.
 
 ## HiDPI {#hidpi}
 
@@ -87,7 +91,7 @@ cerrarla y la traen de vuelta: lo que necesita una
 | Wayland | volver a hacer commit | búfer nulo y commit | `ErrNotSupported`: xdg-shell no tiene esa petición |
 | macOS | `orderFront:` | `orderOut:` | activar la aplicación, `makeKeyAndOrderFront:` |
 | Windows | `SW_SHOWNA` | `SW_HIDE` | `SW_RESTORE` y `SetForegroundWindow` |
-| GTK, Android, wasmbox | `ErrNotSupported` | `ErrNotSupported` | `ErrNotSupported` |
+| GTK, Android, wasmbox, pestaña del navegador | `ErrNotSupported` | `ErrNotSupported` | `ErrNotSupported` |
 
 Conceder el foco corresponde a la plataforma: con la prevención del robo de
 foco, `Raise` puede limitarse a marcar la ventana como necesitada de atención,
diff --git a/content/fr/_index.md b/content/fr/_index.md
index 835b3ee..d45dcb7 100644
--- a/content/fr/_index.md
+++ b/content/fr/_index.md
@@ -61,7 +61,7 @@ n'importe quelle machine vers chacune d'elles.
 | [MVVM]({{< relref "/state/mvvm.md" >}}) | observables, commandes, binders, annulation |
 | [La colonne vertébrale des données]({{< relref "/state/data.md" >}}) | enregistrements typés, requêtes, stockage local ou distant |
 | [Où elle peint]({{< relref "/surfaces/_index.md" >}}) | chaque back-end et la façon dont il est choisi |
-| [Une fenêtre native]({{< relref "/surfaces/native-window.md" >}}) | X11, Wayland, Cocoa, Win32, GTK4, Android, wasmbox |
+| [Une fenêtre native]({{< relref "/surfaces/native-window.md" >}}) | X11, Wayland, Cocoa, Win32, GTK4, Android, wasmbox, un onglet de navigateur |
 | [Une application et son icône de zone de notification]({{< relref "/surfaces/application.md" >}}) | cycle de vie, apparence, une icône dans la barre des menus |
 | [Un onglet de navigateur]({{< relref "/surfaces/browser.md" >}}) | un simple `<canvas>`, ou une fenêtre wasmdesk |
 | [Un terminal]({{< relref "/surfaces/terminal.md" >}}) | des widgets natifs en cellules et un exécuteur interactif |
diff --git a/content/fr/modules.md b/content/fr/modules.md
index b7ce697..e7cd13a 100644
--- a/content/fr/modules.md
+++ b/content/fr/modules.md
@@ -12,23 +12,23 @@ rédaction — la liste des étiquettes du dépôt lui-même fait foi.
 
 | Module | Étiquette | Ce que c'est | Référence |
 |---|---|---|---|
-| [`painter`](https://github.com/go-widgets/painter) | v0.15.0 | [la jonction de dessin]({{< relref "/rendering/painter.md" >}}) : painters en pixels et en cellules | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/painter) |
+| [`painter`](https://github.com/go-widgets/painter) | v0.16.0 | [la jonction de dessin]({{< relref "/rendering/painter.md" >}}) : painters en pixels et en cellules | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/painter) |
 | [`toolkit`](https://github.com/go-widgets/toolkit) | v0.328.0 | [le jeu de widgets]({{< relref "/rendering/toolkit.md" >}}), thèmes, mises en page, texte | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/toolkit) |
-| [`skin`](https://github.com/go-widgets/skin) | v0.2.0 | [des widgets décrits par des données]({{< relref "/rendering/skin.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/skin) |
+| [`skin`](https://github.com/go-widgets/skin) | v0.3.0 | [des widgets décrits par des données]({{< relref "/rendering/skin.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/skin) |
 | [`isoicons`](https://github.com/go-widgets/isoicons) | v0.3.0 | jeux d'icônes isométriques (cloud-native, AWS) pour les diagrammes isométriques de la boîte à outils | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/isoicons) |
-| [`mvvm`](https://github.com/go-widgets/mvvm) | v0.13.0 | [observables, commandes, binders, annulation]({{< relref "/state/mvvm.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvm) |
-| [`mvvmtk`](https://github.com/go-widgets/mvvmtk) | v0.14.1 | [des binders en un appel pour les widgets de la boîte à outils]({{< relref "/state/mvvm.md#mvvmtk-one-call-per-widget" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmtk) |
-| [`data`](https://github.com/go-widgets/data) | v0.3.0 | [enregistrements typés, requêtes, stockage local ou distant]({{< relref "/state/data.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/data) |
-| [`window`](https://github.com/go-widgets/window) | v0.86.1 | [une fenêtre native]({{< relref "/surfaces/native-window.md" >}}) sur sept back-ends | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/window) |
-| [`application`](https://github.com/go-widgets/application) | v0.7.0 | [le cycle de vie de l'application]({{< relref "/surfaces/application.md" >}}) au-dessus d'une fenêtre | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/application) |
-| [`tray`](https://github.com/go-widgets/tray) | v0.14.0 | [une icône de zone de notification et son menu]({{< relref "/surfaces/application.md#the-tray" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tray) |
-| [`webcanvas`](https://github.com/go-widgets/webcanvas) | v0.2.0 | [une scène dans un `<canvas>` de navigateur]({{< relref "/surfaces/browser.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/webcanvas) |
+| [`mvvm`](https://github.com/go-widgets/mvvm) | v0.15.0 | [observables, commandes, binders, annulation]({{< relref "/state/mvvm.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvm) |
+| [`mvvmtk`](https://github.com/go-widgets/mvvmtk) | v0.15.0 | [des binders en un appel pour les widgets de la boîte à outils]({{< relref "/state/mvvm.md#mvvmtk-one-call-per-widget" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmtk) |
+| [`data`](https://github.com/go-widgets/data) | v0.4.0 | [enregistrements typés, requêtes, stockage local ou distant]({{< relref "/state/data.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/data) |
+| [`window`](https://github.com/go-widgets/window) | v0.89.0 | [une fenêtre native]({{< relref "/surfaces/native-window.md" >}}) sur huit back-ends | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/window) |
+| [`application`](https://github.com/go-widgets/application) | v0.8.0 | [le cycle de vie de l'application]({{< relref "/surfaces/application.md" >}}) au-dessus d'une fenêtre | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/application) |
+| [`tray`](https://github.com/go-widgets/tray) | v0.15.0 | [une icône de zone de notification et son menu]({{< relref "/surfaces/application.md#the-tray" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tray) |
+| [`webcanvas`](https://github.com/go-widgets/webcanvas) | v0.4.1 | [une scène dans un `<canvas>` de navigateur]({{< relref "/surfaces/browser.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/webcanvas) |
 | [`tui`](https://github.com/go-widgets/tui) | v0.61.0 | [rendu en terminal et widgets natifs en cellules]({{< relref "/surfaces/terminal.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/tui) |
-| [`android`](https://github.com/go-widgets/android) | v0.15.0 | [un APK peint par un processus sans CGO]({{< relref "/surfaces/android.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/android) |
-| [`svg`](https://github.com/go-widgets/svg) | v0.6.0 | [un rendu en SVG ou en PNG]({{< relref "/surfaces/snapshots.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/svg) |
-| [`mvvmlint`](https://github.com/go-widgets/mvvmlint) | v0.4.0 | [le contrôle MVVM]({{< relref "/guard-rails/mvvmlint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmlint) |
-| [`bricolint`](https://github.com/go-widgets/bricolint) | v0.4.0 | [le contrôle « pas d'interface dessinée à la main »]({{< relref "/guard-rails/bricolint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/bricolint) |
-| [`app-template`](https://github.com/go-widgets/app-template) | v0.4.0 | [le point de départ d'une application]({{< relref "/getting-started.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/app-template) |
+| [`android`](https://github.com/go-widgets/android) | v0.16.0 | [un APK peint par un processus sans CGO]({{< relref "/surfaces/android.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/android) |
+| [`svg`](https://github.com/go-widgets/svg) | v0.7.0 | [un rendu en SVG ou en PNG]({{< relref "/surfaces/snapshots.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/svg) |
+| [`mvvmlint`](https://github.com/go-widgets/mvvmlint) | v0.4.1 | [le contrôle MVVM]({{< relref "/guard-rails/mvvmlint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/mvvmlint) |
+| [`bricolint`](https://github.com/go-widgets/bricolint) | v0.4.1 | [le contrôle « pas d'interface dessinée à la main »]({{< relref "/guard-rails/bricolint.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/bricolint) |
+| [`app-template`](https://github.com/go-widgets/app-template) | v0.5.0 | [le point de départ d'une application]({{< relref "/getting-started.md" >}}) | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/app-template) |
 | [`gallery`](https://github.com/go-widgets/gallery) | v0.6.0 | la [démonstration en direct](https://go-widgets.github.io/gallery/) de chaque famille de widgets | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/gallery) |
 | [`desktop`](https://github.com/go-widgets/desktop) | v0.19.0 | un shell de bureau qui assemble go-freedesktop et go-widgets, en natif et dans wasmdesk | [pkg.go.dev](https://pkg.go.dev/github.com/go-widgets/desktop) |
 
@@ -38,9 +38,9 @@ rédaction — la liste des étiquettes du dépôt lui-même fait foi.
   d'une bibliothèque.
 - Compilé de manière croisée pour amd64, arm64, riscv64, loong64, ppc64le et s390x — ce dernier
   en gros-boutiste, ce qui garde chaque encodage binaire honnête — et, quand cela
-  s'applique, `js/wasm`. Douze des dix-neuf couvrent les six aujourd'hui, deux sont des
-  applications de navigateur, et les cinq autres sont listés dans [État]({{< relref "/status.md#what-ci-does-not-cover-yet" >}}).
-- Une barrière de couverture des instructions dans la CI : 100 % dans dix-huit des dix-neuf. Quand un
+  s'applique, `js/wasm`. Les dix-sept bibliothèques et outils le font tous depuis le 2026-10-10 ;
+  les deux autres sont des applications de navigateur ([État]({{< relref "/status.md#what-ci-does-not-cover-yet" >}})).
+- Une barrière de couverture des instructions dans la CI : 100 %, dans les dix-neuf. Quand un
   fichier ne peut pas s'exécuter dans un test (une boucle de navigateur, une boucle d'exécution native), le module
   indique quel fichier est laissé de côté et pourquoi. Voir [État]({{< relref "/status.md" >}})
   pour les exceptions.
diff --git a/content/fr/status.md b/content/fr/status.md
index b30d18c..adcf0a5 100644
--- a/content/fr/status.md
+++ b/content/fr/status.md
@@ -48,17 +48,46 @@ la plateforme elle-même :
   sait lier sans cgo.
 - `window.Screens` renvoie `ErrScreensUnsupported` sur `js/wasm`.
 
-## Ce que la CI ne couvre pas encore {#what-ci-does-not-cover-yet}
+## Ce que la CI couvre {#what-ci-does-not-cover-yet}
 
-Mesuré à partir des workflows de chaque dépôt aux étiquettes ci-dessus :
+Le 2026-10-10, les cinq manques que cette page listait ont été comblés :
 
-| Module | Manque |
-|---|---|
-| `mvvmtk` | pas de barrière de couverture ; compilation croisée pour amd64 et arm64 seulement, sur six systèmes d'exploitation |
-| `application` | compilation croisée pour Linux, macOS et Windows sur amd64 seulement |
-| `tray` | compilation croisée pour quatre paires système/architecture |
-| `mvvmlint` | pas de compilation croisée |
-| `bricolint` | son étape « 6 arches » en compile cinq : loong64 manque |
+| Module | Avant | Maintenant |
+|---|---|---|
+| `mvvmtk` | pas de barrière de couverture ; amd64 et arm64 seulement | exactement la barrière de 100 % qu'utilise le toolkit (il était déjà à 100,0 %) ; Linux sur les six |
+| `application` | Linux, macOS et Windows sur amd64 seulement | Linux sur les six ; macOS et Windows sur amd64 et arm64 |
+| `tray` | cinq paires système/architecture | Linux sur les six, macOS sur deux, Windows sur une |
+| `mvvmlint` | pas de compilation croisée | Linux sur les six, macOS et Windows |
+| `bricolint` | une étape « 6 arches » qui en compilait cinq | loong64 ajouté |
 
+Les dix-sept bibliothèques et outils font donc tous désormais une compilation croisée pour les six
+architectures Linux 64 bits, et les dix-neuf ont tous une barrière à 100 % de couverture des instructions.
 `app-template` et `gallery` sont des applications de navigateur et se compilent pour `js/wasm`,
 qui est leur seule cible.
+
+## Sécurité {#security}
+
+Mesuré avec `govulncheck` (au niveau des symboles : seul le code que le module peut atteindre) le
+2026-10-10 :
+
+- 15 des 19 modules atteignaient du code vulnérable : dans la bibliothèque standard de
+  go1.27.1 (`html/template`, `net/http`, `crypto/tls`, `mime/multipart` ; corrigé
+  dans go1.27.2) et dans `golang.org/x/net` v0.58.0 (`http2`, via gRPC dans
+  `data` ; corrigé dans v0.60.0).
+- Corrigé le soir même. La CI de chaque module compile avec go1.27.2, et chaque
+  module exige `x/net` v0.60.0. C'est une dépendance indirecte dans la plupart
+  d'entre eux, que Renovate ne met pas à jour : elle a donc été relevée à la
+  main. Un second passage de `govulncheck` sur les 19 modules ne trouve aucune
+  vulnérabilité atteignable.
+- Publiés : android v0.16.0, app-template v0.5.0, application v0.8.0,
+  bricolint v0.4.1, data v0.4.0, mvvm v0.15.0, mvvmlint v0.4.1, mvvmtk
+  v0.15.0, painter v0.16.0, skin v0.3.0, svg v0.7.0, tray v0.15.0, webcanvas
+  v0.4.1, window v0.89.0, chaque version déduite de son API par `gorelease`.
+  toolkit, tui, desktop, gallery et isoicons sont corrigés sur `main` mais pas
+  encore étiquetés : `gorelease` ne peut pas lire leur graphe de modules, qui
+  atteint un module `github.com/ajroetker/go-highway/hwy/goat` jamais publié.
+- Les workflows des 23 dépôts (31 fichiers) ont été audités avec
+  `actionlint` et `wfaudit` : aucun déclencheur privilégié, aucune permission d'écriture au
+  niveau du workflow, aucun jeton laissé dans un checkout téléversé, aucune
+  expression non fiable dans une étape shell. Chaque workflow déclare ses permissions, si bien
+  qu'aucun ne dépend du jeton par défaut d'un dépôt.
diff --git a/content/fr/surfaces/_index.md b/content/fr/surfaces/_index.md
index 7843bab..6276a7c 100644
--- a/content/fr/surfaces/_index.md
+++ b/content/fr/surfaces/_index.md
@@ -10,7 +10,7 @@ tags: [surfaces, back-ends]
 |---|---|---|
 | [Une fenêtre native]({{< relref "/surfaces/native-window.md" >}}) sur X11, Wayland, macOS, Windows | `window` | pixels |
 | [Une application]({{< relref "/surfaces/application.md" >}}) avec une icône de zone de notification et l'apparence du système | `application`, `tray` | pixels |
-| [Un onglet de navigateur]({{< relref "/surfaces/browser.md" >}}) : un simple `<canvas>` | `webcanvas` | pixels |
+| [Un onglet de navigateur]({{< relref "/surfaces/browser.md" >}}) : un simple `<canvas>` | `webcanvas`, ou `window` | pixels |
 | [Un bureau dans le navigateur]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) : une fenêtre du compositeur wasmdesk | `window` (wasmbox) | pixels |
 | [Un terminal]({{< relref "/surfaces/terminal.md" >}}) | `tui` | cellules |
 | [Un APK Android]({{< relref "/surfaces/android.md" >}}) | `android`, `window` | pixels |
diff --git a/content/fr/surfaces/browser.md b/content/fr/surfaces/browser.md
index ed30666..771e91e 100644
--- a/content/fr/surfaces/browser.md
+++ b/content/fr/surfaces/browser.md
@@ -34,9 +34,16 @@ ne soit pas repeinte. Elle peut aussi implémenter `Ticker`, `Animator`, `Resize
 La [galerie](https://go-widgets.github.io/gallery/) et
 [`app-template`]({{< relref "/getting-started.md" >}}) fonctionnent ainsi.
 
+Ou bien laissez `window` choisir. Depuis window v0.87.0,
+[`window.Open`]({{< relref "/surfaces/native-window.md#how-open-chooses" >}})
+compilé pour `js/wasm` sur une page ordinaire renvoie un back-end qui dessine dans le
+`<canvas>` de la page (`Config.Canvas`, par défaut `"screen"`) via `webcanvas`. Une
+application écrite pour `window` fonctionne alors sans modification comme fenêtre native, dans
+un onglet de navigateur et dans wasmdesk.
+
 ## Une fenêtre sur le bureau wasmdesk {#a-window-on-the-wasmdesk-desktop}
 
-Sur `js/wasm`, [`window.Open`]({{< relref "/surfaces/native-window.md" >}})
+Dans un worker wasmdesk, [`window.Open`]({{< relref "/surfaces/native-window.md" >}})
 renvoie un client du compositeur de navigateur [wasmdesk/wasmbox](https://github.com/wasmdesk/wasmbox).
 Il alloue sa surface dans un `SharedArrayBuffer`, dit
 `hello` sur son `MessagePort`, attend `welcome`, peint dans le tampon partagé
diff --git a/content/fr/surfaces/native-window.md b/content/fr/surfaces/native-window.md
index bb54228..374b50e 100644
--- a/content/fr/surfaces/native-window.md
+++ b/content/fr/surfaces/native-window.md
@@ -2,7 +2,7 @@
 title: "Une fenêtre native"
 linkTitle: "Fenêtre native"
 weight: 10
-description: "go-widgets/window : une seule API Open/Run sur X11, Wayland, Cocoa, Win32, GTK4, Android et wasmbox, toutes avec CGO_ENABLED=0."
+description: "go-widgets/window : une seule API Open/Run sur X11, Wayland, GTK4, Cocoa, Win32, Android, wasmbox et un onglet de navigateur, toutes avec CGO_ENABLED=0."
 tags: [surfaces, window, x11, wayland, macos, windows]
 ---
 
@@ -34,7 +34,8 @@ taille lisible par défaut), l'instance et la classe `WM_CLASS`, un `Theme`, et
 | Windows | Win32 | un `HWND` de premier niveau via des appels système à user32 et gdi32, `StretchDIBits` |
 | Android, `$GW_ANDROID_SOCKET` défini | hôte Android | un protocole tramé vers [l'hôte Java]({{< relref "/surfaces/android.md" >}}), les pixels dans un memfd partagé |
 | Android, sinon | Wayland ou X11 | un shell sous Termux a toujours un serveur d'affichage à contacter |
-| `js/wasm` | wasmbox | un client du [compositeur wasmdesk]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) |
+| `js/wasm`, dans wasmdesk | wasmbox | un client du [compositeur wasmdesk]({{< relref "/surfaces/browser.md#a-window-on-the-wasmdesk-desktop" >}}) |
+| `js/wasm`, une page ordinaire | onglet de navigateur | un `<canvas>` de la page (`Config.Canvas`, par défaut `"screen"`) via `webcanvas` : pas de compositeur, pas de `SharedArrayBuffer`, pas d'isolation cross-origin |
 | tout le reste | — | `window.ErrUnsupported`, pour qu'une compilation croisée compile quand même |
 
 Chaque back-end est `CGO_ENABLED=0`. Celui de X11 est le protocole de base écrit
@@ -53,8 +54,10 @@ sur chaque système d'exploitation. La fine couche de liaison avec la plateforme
 ## Seulement ce qui a changé {#only-what-changed}
 
 Une racine qui implémente `DamageRenderer` (comme le fait `toolkit/scene.HostRoot`)
-signale les rectangles qu'elle a repeints, et les back-ends Cocoa, Win32 et wasmbox
-ne présentent que ceux-là.
+signale les rectangles qu'elle a repeints, et chaque back-end sauf GTK4 ne présente que
+ceux-là : X11 via `ShmPutImage` de MIT-SHM, Wayland via les zones endommagées de `wl_shm`,
+Cocoa, Win32, Android, wasmbox et l'onglet de navigateur. La première image, un
+redimensionnement et un `Expose` X11 présentent encore toute la surface.
 
 ## HiDPI {#hidpi}
 
@@ -83,7 +86,7 @@ la fermer, puis la ramènent — ce dont a besoin une [application de zone de no
 | Wayland | nouveau commit | tampon nul et commit | `ErrNotSupported` : xdg-shell n'a pas de telle requête |
 | macOS | `orderFront:` | `orderOut:` | activer l'application, `makeKeyAndOrderFront:` |
 | Windows | `SW_SHOWNA` | `SW_HIDE` | `SW_RESTORE` et `SetForegroundWindow` |
-| GTK, Android, wasmbox | `ErrNotSupported` | `ErrNotSupported` | `ErrNotSupported` |
+| GTK, Android, wasmbox, onglet de navigateur | `ErrNotSupported` | `ErrNotSupported` | `ErrNotSupported` |
 
 Le focus, c'est à la plateforme de l'accorder : avec la prévention du vol de focus, `Raise`
 peut seulement marquer la fenêtre comme demandant l'attention, sans pouvoir le savoir.