diff --git a/CLAUDE.md b/CLAUDE.md
index b93e8ff..e9b8dd2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -105,7 +105,7 @@ Keep them in lockstep when bumping, and move to a new major only after Vercel of
 
 `bench/web` is a member of the root Bun workspace, so the layers above cover it: the cooldown in `bunfig.toml`, `trustedDependencies` and `overrides` in the root `package.json`, `bun audit`, and the `bun.lock (bench/web)` manifest of the dependency snapshot. What is particular to bench:
 
-- **Install at the root.** `bun install --frozen-lockfile` at the root installs both apps, and `bun run --cwd bench/web <script>` runs bench's scripts; CI and `bench-deploy.yml` do the same, and `bench/web/vercel.json` gives `vercel build` the same install command. A `bun install` in `bench/web` also finds the root's `bunfig.toml`.
+- **Install at the root.** `bun install --frozen-lockfile` at the root installs both apps, and `bun run --cwd bench/web <script>` runs bench's scripts; CI and `bench-deploy.yml` do the same, and `bench/web/vercel.json` gives `vercel build` the same install command. A `bun install` in `bench/web` also finds the root's `bunfig.toml`. `bench/web/package.json` pins the root's `packageManager` (`bun@…`), so pnpm refuses to install there instead of installing around the cooldown; a `renovate.json` rule updates both pins in one branch, and `bench/web/lib/package-manager.test.ts` fails if they differ.
 - **Linker.** `bunfig.toml` sets `linker = "isolated"`, so every package gets the dependencies it resolved, as pnpm gave bench. That layout keeps one app's tools from loading the other's copy of a package; both apps now resolve the same TypeScript, so that no longer matters for it.
 - **Lifecycle scripts.** pnpm's `allowBuilds` let `sharp` build (and `unrs-resolver`, which left with ESLint). `trustedDependencies` already trusts `sharp`, and stays `["esbuild", "sharp"]`. Bun blocks three bench scripts, `protobufjs`, `ssh2` and `cpu-features`, which pnpm blocked too. With the isolated linker, `bun pm untrusted` lists only packages linked at the top of `node_modules`, so it reports none of them; to audit, install once with `bun install --linker hoisted` in a scratch copy and run it there.
 - **Deploy CLI:** `bench-deploy.yml` installs the Vercel CLI from `.github/vercel-cli` with `npm ci --ignore-scripts`. Its `package.json` pins the version, and its `package-lock.json` locks the whole tree. That job holds `VERCEL_TOKEN`. The lockfile is npm's, not Bun's, so GitHub's dependency graph, Dependabot and dependency review read it natively. To change it, run `npm install --package-lock-only --ignore-scripts --before=<7 days ago>` in that directory (Renovate passes the same `--before`), then `npm audit`. Its `overrides` patch advisories in dependencies the CLI pins; see "bench advisories".
diff --git a/bench/docs/architecture/performance.md b/bench/docs/architecture/performance.md
index 99f23c7..5457c71 100644
--- a/bench/docs/architecture/performance.md
+++ b/bench/docs/architecture/performance.md
@@ -269,7 +269,9 @@ nor by the scroll to a link's first group. Scroll is
 restored by element, not by pixel
 ([`lib/scroll-restore.ts`](../../web/lib/scroll-restore.ts)): the open bodies
 mount only after hydration, so a saved `scrollY` would land against a shorter
-page.
+page. While no group is open the page leaves restoration to the browser
+(`history.scrollRestoration` stays `auto`), because the collapsed list is as
+tall before hydration as after; it switches to `manual` while a group is open.
 
 Measured against the previous build, the head of `claude/bench-cleanup`
 (b4caf7c): a local restore of the production dump, desktop (1440×900), no
@@ -293,7 +295,7 @@ with one-off scripts that are not in this repository.
 
 Each request to `/` decides how to send the groups
 ([`app/page.tsx`](../../web/app/page.tsx)). It starts reading them and waits up
-to 150 ms (`LOADING_VIEW_AFTER_MS`). A Data Cache hit answers well inside that,
+to 300 ms (`LOADING_VIEW_AFTER_MS`). A Data Cache hit answers well inside that,
 so the page renders the groups directly, with no Suspense boundary: plain,
 visible HTML that a reader with JavaScript off can read in full. A miss gets a
 Suspense boundary instead: the "Loading benchmark summaries…" view streams at
@@ -328,10 +330,12 @@ keep misses rare, and an ingest causes none: it marks the entries stale rather
 than dropping them (see "Refresh on ingest"), so the next render of `/` takes
 the plain-HTML path with the previous data.
 
-The 150 ms threshold was measured against the local Data Cache, where a hit
-answers in a few milliseconds. Check it against Vercel's function logs on a
-preview deployment before relying on it: a hit there reads the cache over the
-network.
+The threshold was first 150 ms, measured against the local Data Cache, where a
+hit answers in a few milliseconds. On Vercel a hit reads the cache over the
+network: on 2026-10-30, 1 of 12 cache-busted production renders of `/` missed
+150 ms and streamed the loading view, which the CDN would then keep for five
+minutes. At 300 ms a hit has room, and a miss still shows the loading view
+early.
 
 ### Visual downsampling (LTTB)
 
diff --git a/bench/docs/architecture/read-path.md b/bench/docs/architecture/read-path.md
index 90bbdf1..350e16c 100644
--- a/bench/docs/architecture/read-path.md
+++ b/bench/docs/architecture/read-path.md
@@ -155,6 +155,12 @@ the fills never ask for more connections at once than the pool holds. The pool
 is never smaller than 2 (`resolvePoolMax`), because a fill queries on a second
 connection while the first holds its lock.
 
+A background refresh (a stale read after an ingest, see above) has no retry: if
+another invocation holds the entry's lock, it fails at once and Next logs the
+`GroupCacheFillInProgressError`. That is expected. The lock holder's fill
+refreshes the shared entry, so a few of these errors after each ingest cost
+nothing; waiting and filling again would repeat the holder's query.
+
 `bench_read` uses a **static password** rather than RDS IAM auth because the
 Vercel runtime has no AWS credentials to mint an IAM token, and RDS `rds_iam`
 membership disables password auth. The CI roles (`migrator`, `bench_ingest`) do
diff --git a/bench/web/app/page.tsx b/bench/web/app/page.tsx
index d5afca8..c36e19b 100644
--- a/bench/web/app/page.tsx
+++ b/bench/web/app/page.tsx
@@ -93,13 +93,13 @@ export default async function Home({
 
 /**
  * How long the landing page waits for its data before it streams the loading
- * view instead. A Data Cache hit reads in a few milliseconds, well inside it,
- * so the common case stays plain HTML; a miss reads the database, about half a
- * second locally and seconds in production after an idle gap. Long enough that
- * a busy server's hit still lands inside it, short enough that a reader on a
- * miss sees the loading view almost at once.
+ * view instead. A Data Cache hit reads in a few milliseconds locally, but on
+ * Vercel it is a network read, and at 150 ms about one hit in twelve missed the
+ * wait (2026-10-30). The CDN then kept that loading-view copy for five minutes.
+ * A miss reads the database, about half a second locally and seconds in
+ * production after an idle gap, so 300 ms still shows the loading view early.
  */
-const LOADING_VIEW_AFTER_MS = 150;
+const LOADING_VIEW_AFTER_MS = 300;
 
 type SearchParams = Record<string, string | string[] | undefined>;
 type LandingData = [SearchParams, Group[], FilterUniverse];
diff --git a/bench/web/components/Chart.lazy-hydration.test.tsx b/bench/web/components/Chart.lazy-hydration.test.tsx
index 20172f4..f0ae071 100644
--- a/bench/web/components/Chart.lazy-hydration.test.tsx
+++ b/bench/web/components/Chart.lazy-hydration.test.tsx
@@ -10,6 +10,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { Chart } from '@/components/Chart';
 import { GroupBody } from '@/components/GroupBody';
 import { FETCH_TIMEOUT_MS } from '@/lib/chart-format';
+import { PAGE_LEAVE_GRACE_MS } from '@/lib/page-leave';
 import { bundleQueue, hydrationQueue, resetPayloadCache } from '@/lib/chart-store';
 
 vi.mock('@/lib/chart-js', () => ({
@@ -512,6 +513,43 @@ describe('PR-5.0.97 group-bundle hydration', () => {
     },
   );
 
+  // Leaving the page cancels the bundle fetch. WebKit rejects it with a `TypeError` ("Load
+  // failed") before the page's `pagehide`, the same error as a real network failure.
+  it('drops a bundle failure quietly when the page is being left', async () => {
+    vi.useFakeTimers();
+    let reject: (e: unknown) => void = () => {};
+    vi.stubGlobal('fetch', (url: string | URL) => {
+      fetchCalls.push(String(url));
+      return new Promise<Response>((_resolve, rej) => {
+        reject = rej;
+      });
+    });
+    await renderGroup(2);
+    await act(async () => {
+      MockIO.instances[0]!.fire();
+      MockIO.instances[1]!.fire();
+      await vi.advanceTimersByTimeAsync(0);
+    });
+    expect(bundleFetchCount()).toBe(1);
+    await act(async () => {
+      reject(new TypeError('Load failed'));
+      await vi.advanceTimersByTimeAsync(0);
+      window.dispatchEvent(new Event('pagehide'));
+      await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS * 5);
+    });
+    expect(container.querySelectorAll('[data-role="fetch-retry"]')).toHaveLength(0);
+    expect(container.querySelectorAll('.chart-error')).toHaveLength(0);
+    expect(chartFetchCount()).toBe(0);
+
+    // Back from the back/forward cache: the group did lose its charts, so the retry shows.
+    await act(async () => {
+      window.dispatchEvent(new Event('pageshow'));
+      await vi.advanceTimersByTimeAsync(0);
+    });
+    expect(container.querySelectorAll('[data-role="fetch-retry"]')).toHaveLength(2);
+    expect(chartFetchCount()).toBe(0);
+  });
+
   it('closing the group aborts the in-flight bundle (its fetch signal aborts)', async () => {
     const signals: AbortSignal[] = [];
     vi.stubGlobal('fetch', (url: string | URL, init?: { signal?: AbortSignal }) => {
diff --git a/bench/web/components/Chart.loading.test.tsx b/bench/web/components/Chart.loading.test.tsx
index 6b9f29d..37d2438 100644
--- a/bench/web/components/Chart.loading.test.tsx
+++ b/bench/web/components/Chart.loading.test.tsx
@@ -9,6 +9,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { Chart } from '@/components/Chart';
 import { FETCH_TIMEOUT_MS } from '@/lib/chart-format';
+import { PAGE_LEAVE_GRACE_MS } from '@/lib/page-leave';
 import { fullHistoryQueue } from '@/lib/chart-store';
 import { loadChartJs } from '@/lib/chart-js';
 
@@ -557,6 +558,86 @@ describe('Chart opt-in full-history loading', () => {
     });
   });
 
+  // Leaving the page cancels its fetches. WebKit rejects them with a `TypeError` ("Load failed")
+  // before the page's `pagehide`, the same error as a real network failure.
+  describe('a fetch cancelled by leaving the page', () => {
+    function stubRejectableFetch(urlPart: string): { reject: (e: unknown) => void } {
+      let rejecter: (e: unknown) => void = () => {};
+      responders.push({
+        match: (u) => u.includes(urlPart),
+        respond: () =>
+          new Promise<Response>((_res, rej) => {
+            rejecter = rej;
+          }),
+      });
+      return { reject: (e) => rejecter(e) };
+    }
+
+    async function leaveThenShow(shown: () => void): Promise<void> {
+      await act(async () => {
+        window.dispatchEvent(new Event('pagehide'));
+        await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS * 5);
+      });
+      shown();
+      // Back from the back/forward cache: the page did lose the data, so now it reports.
+      await act(async () => {
+        window.dispatchEvent(new Event('pageshow'));
+        await vi.advanceTimersByTimeAsync(0);
+      });
+    }
+
+    it('drops the full-history failure quietly', async () => {
+      const full = stubRejectableFetch('n=all');
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const chip = await renderOpenGroup();
+      vi.useFakeTimers();
+      await act(async () => {
+        chip?.click();
+        await vi.advanceTimersByTimeAsync(0);
+      });
+      await act(async () => {
+        full.reject(new TypeError('Load failed'));
+        await vi.advanceTimersByTimeAsync(0);
+      });
+      await leaveThenShow(() => {
+        expect(warn).not.toHaveBeenCalled();
+        expect(chip?.dataset.state).not.toBe('error');
+      });
+      expect(chip?.dataset.state).toBe('error');
+    });
+
+    it('drops the initial fetch failure quietly', async () => {
+      vi.useFakeTimers();
+      const initial = stubRejectableFetch('n=100');
+      await renderOpenGroup();
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(0);
+        initial.reject(new TypeError('Load failed'));
+        await vi.advanceTimersByTimeAsync(0);
+      });
+      await leaveThenShow(() => {
+        expect(container.querySelector('.chart-error')).toBeNull();
+      });
+      expect(container.querySelector('.chart-error [data-role="fetch-retry"]')).not.toBeNull();
+    });
+
+    it('still reports a network failure while the page stays', async () => {
+      vi.useFakeTimers();
+      const initial = stubRejectableFetch('n=100');
+      await renderOpenGroup();
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(0);
+        initial.reject(new TypeError('Failed to fetch'));
+        await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS - 1);
+      });
+      expect(container.querySelector('.chart-error')).toBeNull();
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(1);
+      });
+      expect(container.querySelector('.chart-error')?.textContent).toContain('Failed to fetch');
+    });
+  });
+
   describe('PR-5.0.95 loading spinner', () => {
     it('renders an animated spinner element (not bare text) while loading', async () => {
       // A never-resolving window fetch keeps the card in the loading state.
diff --git a/bench/web/components/FilterBar.test.tsx b/bench/web/components/FilterBar.test.tsx
index 08b27ec..2a35237 100644
--- a/bench/web/components/FilterBar.test.tsx
+++ b/bench/web/components/FilterBar.test.tsx
@@ -5,11 +5,17 @@
 
 import { act } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { FilterBar } from '@/components/FilterBar';
 import { parseFilterCsv, seriesPassesFilter } from '@/lib/chart-format';
 import { getGlobalFilterSnapshot } from '@/lib/chart-store';
+import { resetUrlWrites, URL_WRITE_DELAY_MS } from '@/lib/url-writes';
+
+/** Fake the write scheduler's timers and its clock, `performance.now()`. */
+function useFakeClock(): void {
+  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout', 'Date', 'performance'] });
+}
 
 const universe = { engines: ['duckdb', 'datafusion'], formats: ['vortex', 'parquet', 'lance'] };
 
@@ -19,6 +25,7 @@ describe('global filter URL round trips', () => {
 
   beforeEach(() => {
     (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+    resetUrlWrites(window);
     container = document.createElement('div');
     document.body.appendChild(container);
   });
@@ -26,6 +33,8 @@ describe('global filter URL round trips', () => {
   afterEach(async () => {
     await act(async () => root.unmount());
     container.remove();
+    vi.useRealTimers();
+    resetUrlWrites(window);
   });
 
   async function mount(): Promise<void> {
@@ -50,7 +59,16 @@ describe('global filter URL round trips', () => {
     });
   }
 
+  /** The URL once a pending write has landed: chip clicks inside the write delay wait for it. */
+  async function settledUrl(): Promise<URL> {
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, URL_WRITE_DELAY_MS));
+    });
+    return new URL(window.location.href);
+  }
+
   async function reload(): Promise<void> {
+    await settledUrl();
     await act(async () => root.unmount());
     await mount();
   }
@@ -68,7 +86,7 @@ describe('global filter URL round trips', () => {
 
       for (const engine of universe.engines) await click('engine', engine);
       for (const format of ['vortex', 'parquet']) await click('format', format);
-      let url = new URL(window.location.href);
+      let url = await settledUrl();
       expect(url.searchParams.get('engine')).toBe('');
       expect(url.searchParams.get('format')).toBe('');
       await reload();
@@ -76,7 +94,7 @@ describe('global filter URL round trips', () => {
 
       await click('engine', '*');
       await click('format', '*');
-      url = new URL(window.location.href);
+      url = await settledUrl();
       expect(url.searchParams.has('engine')).toBe(false);
       expect(url.searchParams.get('format')).toBe('vortex,parquet,lance');
       expect(url.searchParams.get('n')).toBe('all');
@@ -100,8 +118,81 @@ describe('global filter URL round trips', () => {
     expect(seriesPassesFilter({ engine: 'duckdb', format: 'lance' }, active, universe)).toBe(false);
     expect(container.querySelector('[data-role="filter-badge"]')?.textContent).toBe('3');
     await click('engine', '*');
-    expect(new URL(window.location.href).searchParams.get('format')).toBe('vortex,old,older');
+    expect((await settledUrl()).searchParams.get('format')).toBe('vortex,old,older');
     await reload();
     expect(getGlobalFilterSnapshot().active.formats).toEqual(['vortex', 'old', 'older']);
   });
+
+  // Safari refuses more than 100 `history.replaceState` calls in 10 seconds, and Next.js adds one
+  // of its own to each of ours, so the chips share the open groups' coalesced writes.
+  it('writes the URL a few times for a burst of chip clicks, and ends current', async () => {
+    window.history.replaceState(null, '', '/?n=all#tpc-h-nvme-sf-1');
+    await mount();
+    useFakeClock();
+    const replaceState = vi.spyOn(window.history, 'replaceState');
+    const writes: number[] = [];
+    replaceState.mockImplementation(function (this: History, ...args) {
+      writes.push(Date.now());
+      return History.prototype.replaceState.apply(this, args);
+    });
+
+    // 200 clicks 25 ms apart: 5 seconds, twice Safari's budget of calls if each one wrote.
+    for (let i = 0; i < 200; i += 1) {
+      await click('engine', 'duckdb');
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(25);
+      });
+    }
+    expect(writes.length).toBeLessThanOrEqual(3);
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(URL_WRITE_DELAY_MS);
+    });
+    expect(writes.length).toBeLessThanOrEqual(4);
+
+    // 200 toggles leave duckdb as it started: on.
+    const url = new URL(window.location.href);
+    expect(url.searchParams.has('engine')).toBe(false);
+    expect(url.searchParams.get('n')).toBe('all');
+    expect(url.hash).toBe('#tpc-h-nvme-sf-1');
+
+    // One more click after a quiet spell writes at once.
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(URL_WRITE_DELAY_MS);
+    });
+    await click('engine', 'duckdb');
+    expect(new URL(window.location.href).searchParams.get('engine')).toBe('datafusion');
+  });
+
+  it('writes a pending chip change when the page is hidden', async () => {
+    window.history.replaceState(null, '', '/chart/qm.example');
+    await mount();
+    useFakeClock();
+    await click('format', 'vortex');
+    await click('format', 'parquet');
+    expect(new URL(window.location.href).searchParams.get('format')).toBe('parquet');
+
+    await act(async () => {
+      window.dispatchEvent(new Event('pagehide'));
+    });
+    expect(new URL(window.location.href).searchParams.get('format')).toBe('');
+  });
+
+  it('writes a pending chip change before a same-origin link is followed', async () => {
+    window.history.replaceState(null, '', '/chart/qm.example');
+    await mount();
+    useFakeClock();
+    await click('format', 'vortex');
+    await click('format', 'parquet');
+    expect(new URL(window.location.href).searchParams.get('format')).toBe('parquet');
+
+    const link = document.createElement('a');
+    link.href = '/';
+    link.addEventListener('click', (event) => event.preventDefault());
+    document.body.appendChild(link);
+    await act(async () => {
+      link.click();
+    });
+    link.remove();
+    expect(new URL(window.location.href).searchParams.get('format')).toBe('');
+  });
 });
diff --git a/bench/web/components/FilterBar.tsx b/bench/web/components/FilterBar.tsx
index 516295b..0c7793f 100644
--- a/bench/web/components/FilterBar.tsx
+++ b/bench/web/components/FilterBar.tsx
@@ -18,6 +18,7 @@ import {
   toggleGlobalFilterValue,
 } from '@/lib/chart-store';
 import { FilterIcon } from '@/components/icons';
+import { flushUrlWrites, scheduleUrlWrite } from '@/lib/url-writes';
 
 /**
  * The global engine/format filter dropdown in the sticky header, the client
@@ -32,7 +33,12 @@ import { FilterIcon } from '@/components/icons';
  * indicator. Every change re-paints the chips (via the store subscription, here
  * and in every chart island) and syncs the URL `?engine=`/`?format=` allowlists
  * with `history.replaceState`, so a refresh or share preserves the view; the
- * params are omitted only when the active set matches the defaults.
+ * params are omitted only when the active set matches the defaults. The URL
+ * writes go through the coalesced schedule the landing page's open groups use
+ * (`lib/url-writes.ts`): at once after a quiet spell, otherwise once a burst of
+ * clicks stops, because Safari refuses more than 100 `replaceState` calls in 10
+ * seconds and Next.js adds one to each of ours. A write still pending when the
+ * page is hidden is made then.
  *
  * Without JavaScript the dropdown cannot open, so it carries
  * `data-requires-js` and is hidden (globals.css).
@@ -81,6 +87,29 @@ export function FilterBar({
     ? snapshot.active.formats
     : seedActiveFormats(initialFormats, universe.formats);
 
+  // Make a pending URL write when the page is left, so Back and a restored tab
+  // return to the current chips: on `pagehide`, and before a same-origin link
+  // navigates on the client (a pending write is dropped once the path changes).
+  // Capturing, so a handler that stops the click cannot skip the flush. On the
+  // landing page `LandingState` flushes too.
+  useEffect(() => {
+    const onPageHide = (): void => {
+      flushUrlWrites(window);
+    };
+    const onClick = (event: MouseEvent): void => {
+      const link = (event.target as Element | null)?.closest?.('a[href]');
+      if (link instanceof HTMLAnchorElement && link.origin === window.location.origin) {
+        flushUrlWrites(window);
+      }
+    };
+    window.addEventListener('pagehide', onPageHide);
+    document.addEventListener('click', onClick, true);
+    return () => {
+      window.removeEventListener('pagehide', onPageHide);
+      document.removeEventListener('click', onClick, true);
+    };
+  }, []);
+
   // Close on outside click and on Escape, mirroring v3's document listeners.
   useEffect(() => {
     if (!open) {
@@ -207,20 +236,25 @@ function FilterRow({
   );
 }
 
+// The filter's part in the coalesced URL writes.
+const FILTER_PART = 'filters';
+
 /**
  * Mirror the active filter onto the URL as `?engine=`/`?format=` allowlists via
- * `history.replaceState`. Only default selections omit their parameter. An
- * empty selection writes an empty value, and all formats includes Lance.
+ * `history.replaceState`, on the coalesced schedule ([`scheduleUrlWrite`]).
+ * Only default selections omit their parameter. An empty selection writes an
+ * empty value, and all formats includes Lance. The write reads the store when
+ * it is made, so a burst of clicks writes the state it ends in.
  */
 function syncFilterUrl(): void {
   if (!window.history?.replaceState) {
     return;
   }
-  const { universe, active } = getGlobalFilterSnapshot();
-  const url = new URL(window.location.href);
-  syncDimensionUrl(url, 'engine', active.engines, universe.engines);
-  syncDimensionUrl(url, 'format', active.formats, seedActiveFormats(null, universe.formats));
-  window.history.replaceState(null, '', url.toString());
+  scheduleUrlWrite(window, FILTER_PART, (url) => {
+    const { universe, active } = getGlobalFilterSnapshot();
+    syncDimensionUrl(url, 'engine', active.engines, universe.engines);
+    syncDimensionUrl(url, 'format', active.formats, seedActiveFormats(null, universe.formats));
+  });
 }
 
 function syncDimensionUrl(url: URL, paramName: string, active: string[], defaults: string[]): void {
diff --git a/bench/web/components/LandingState.test.tsx b/bench/web/components/LandingState.test.tsx
index c189c50..e4197d5 100644
--- a/bench/web/components/LandingState.test.tsx
+++ b/bench/web/components/LandingState.test.tsx
@@ -573,8 +573,43 @@ describe('LandingState', () => {
   });
 
   describe('scroll restoration', () => {
-    it('switches the page to manual scroll restoration and sets back the mode it found on unmount', async () => {
+    // The browser restores natively while no group is open: the collapsed list is the same
+    // height before and after hydration. An open group's body exists only after hydration, so
+    // then the page restores by element and the browser must not.
+    it('keeps native scroll restoration while no group is open, and manual while one is', async () => {
       await mount('/');
+      expect(window.history.scrollRestoration).toBe('auto');
+
+      disclosure(FIRST).open = true;
+      await flush();
+      expect(window.history.scrollRestoration).toBe('manual');
+
+      disclosure('clickbench').open = true;
+      disclosure(FIRST).open = false;
+      await flush();
+      expect(window.history.scrollRestoration).toBe('manual');
+
+      setAllGroupsOpen(window, false);
+      await flush();
+      expect(window.history.scrollRestoration).toBe('auto');
+
+      window.location.hash = 'random-access';
+      await flush();
+      expect(window.history.scrollRestoration).toBe('manual');
+    });
+
+    it('switches to manual on mount when the fragment opens groups', async () => {
+      await mount(`/#${FIRST},clickbench`);
+      expect(window.history.scrollRestoration).toBe('manual');
+    });
+
+    it('switches to manual on mount when the pre-paint script opened groups', async () => {
+      await hydrate('/#clickbench');
+      expect(window.history.scrollRestoration).toBe('manual');
+    });
+
+    it('sets back the mode it found on unmount', async () => {
+      await mount(`/#${FIRST}`);
       expect(window.history.scrollRestoration).toBe('manual');
 
       await act(async () => {
@@ -584,6 +619,40 @@ describe('LandingState', () => {
       expect(window.history.scrollRestoration).toBe('auto');
     });
 
+    // On Reload or Back the browser uses the mode the history entry had when the page was left.
+    it.each(['reload', 'back_forward'] as const)(
+      'on %s with no group open, leaves the scroll to the browser',
+      async (type) => {
+        navigation(type);
+        sessionStorage.setItem(
+          'bench-scroll:/',
+          JSON.stringify({ kind: 'group', slug: 'qm.click', offset: 40 }),
+        );
+        place(document.getElementById('clickbench')!, 900);
+        window.history.scrollRestoration = 'auto';
+        await mount('/');
+        await nextFrame();
+        expect(scrollTo).not.toHaveBeenCalled();
+        expect(scrollSpy).not.toHaveBeenCalled();
+      },
+    );
+
+    // A group opened just before a reload: the fragment write had not landed, so the page
+    // reloads with no group open, but the browser kept the manual mode and restores nothing.
+    it('on reload with no group open after leaving in manual mode, restores by element', async () => {
+      navigation('reload');
+      sessionStorage.setItem(
+        'bench-scroll:/',
+        JSON.stringify({ kind: 'group', slug: 'qm.click', offset: 40 }),
+      );
+      place(document.getElementById('clickbench')!, 900);
+      window.history.scrollRestoration = 'manual';
+      await mount('/');
+      await nextFrame();
+      expect(scrollTo).toHaveBeenCalledWith({ top: 860, behavior: 'instant' });
+      expect(window.history.scrollRestoration).toBe('auto');
+    });
+
     it('saves the reading position on pagehide and when a chart link is followed', async () => {
       await mount(`/#${FIRST}`);
       await flush();
diff --git a/bench/web/components/LandingState.tsx b/bench/web/components/LandingState.tsx
index b8437b7..c400108 100644
--- a/bench/web/components/LandingState.tsx
+++ b/bench/web/components/LandingState.tsx
@@ -54,10 +54,16 @@ const CHART_LINK = 'a[href^="/chart/"]';
  *   the new fragment, then opens what it lists, rewrites the fragment to the
  *   whole open set (a group that was already open fires no `toggle`, so
  *   nothing else would) and scrolls to the first listed group.
- * - **Scroll** (`lib/scroll-restore.ts`). While mounted, the page sets
- *   `history.scrollRestoration = 'manual'`, and on unmount sets back the mode
- *   it found (the browser's own on a fresh history entry; after a reload or
- *   Back, it may be the `manual` this page left on the entry). On `pagehide`,
+ * - **Scroll** (`lib/scroll-restore.ts`). While no group is open, the page
+ *   keeps `history.scrollRestoration = 'auto'`: the collapsed list is as tall
+ *   before hydration as after, so the browser's own restoration lands right,
+ *   and lands before the first paint. While a group is open it sets `manual`,
+ *   because the open bodies exist only after hydration, and restores by
+ *   element itself. It switches on every open and close, so the mode on the
+ *   history entry when the page is left is the one the browser uses on Reload
+ *   or Back. On unmount it sets back the mode it found (the browser's own on a
+ *   fresh history entry; after a reload or Back, the one this page left on the
+ *   entry). On `pagehide`,
  *   when the tab goes hidden (a mobile browser may discard a hidden tab
  *   without a `pagehide`) and when a chart link is clicked, it saves the
  *   element nearest the top of the viewport. On mount, [`planScroll`]
@@ -65,9 +71,10 @@ const CHART_LINK = 'a[href^="/chart/"]';
  *   scrolled, touched, clicked or pressed a key, it leaves the scroll alone
  *   (they have taken over); otherwise a reload or Back/Forward with a saved
  *   position restores that element to its offset (falling back to the
- *   fragment scroll if the element is gone); otherwise, if the fragment lists
- *   groups, it scrolls to the first one (a fresh visit ignores anything
- *   saved); otherwise it leaves the scroll alone.
+ *   fragment scroll if the element is gone), unless no group is open and the
+ *   entry's mode was `auto`, where the browser has restored it already;
+ *   otherwise, if the fragment lists groups, it scrolls to the first one (a
+ *   fresh visit ignores anything saved); otherwise it leaves the scroll alone.
  *
  * Both scrolls wait for the open groups' bodies to mount their cards
  * ([`groupBodiesReady`]): the upper groups' cards push a target down as they
@@ -83,11 +90,19 @@ export function LandingState(): null {
   useEffect(() => {
     let active = true;
     const { history } = window;
+    // Before anything here changes it: on a reload or Back, the mode the
+    // history entry kept, which the browser has just used.
+    firstRun.current ??= openOnFirstRun();
     const previousRestoration = history.scrollRestoration;
-    history.scrollRestoration = 'manual';
+    // `manual` while a group is open, `auto` otherwise (see above).
+    const syncRestoration = (): void => {
+      history.scrollRestoration = openGroupSlugs(document).length > 0 ? 'manual' : 'auto';
+    };
+    syncRestoration();
     const onToggle = (event: Event): void => {
       const target = event.target as Element | null;
       if (target?.matches?.('details.group-disclosure')) {
+        syncRestoration();
         scheduleOpenFragmentSync(window);
       }
     };
@@ -131,12 +146,20 @@ export function LandingState(): null {
         }
       });
     };
-    firstRun.current ??= openOnFirstRun();
-    const { saved, listed, inputBeforeMount } = firstRun.current;
-    const ready = groupBodiesReady(openGroupSlugs(document));
+    const { saved, listed, inputBeforeMount, arrivalRestoration } = firstRun.current;
+    const openSlugs = openGroupSlugs(document);
+    const ready = groupBodiesReady(openSlugs);
     const fragmentScroll = (): void => scrollToGroupAfter(ready.mounted, listed[0]);
     let cancelRestore = (): void => {};
-    const plan = planScroll(navigationKind(window), saved, listed.length > 0, inputBeforeMount);
+    // With no group open and the entry in `auto` mode, the browser restored
+    // the collapsed list itself.
+    const restoredNatively = openSlugs.length === 0 && arrivalRestoration === 'auto';
+    const plan = planScroll(
+      navigationKind(window),
+      restoredNatively ? null : saved,
+      listed.length > 0,
+      inputBeforeMount,
+    );
     if (plan.kind === 'restore') {
       pendingRestore = plan.saved;
       cancelRestore = restoreScroll(window, plan.saved, ready, fragmentScroll, () => {
@@ -151,6 +174,7 @@ export function LandingState(): null {
       cancelOpenFragmentSync(window);
       cancelRestore();
       const listedNow = openGroupsFromHash(document, window.location.hash);
+      syncRestoration();
       syncOpenFragment(window);
       scrollToGroupAfter(groupBodiesReady(openGroupSlugs(document)).mounted, listedNow[0]);
     };
@@ -176,16 +200,19 @@ export function LandingState(): null {
   return null;
 }
 /** What [`LandingState`]'s first run found: the saved position, the listed
- * groups that are open, and whether the reader moved before hydration. */
+ * groups that are open, whether the reader moved before hydration, and the
+ * scroll restoration mode the page arrived with. */
 interface FirstRun {
   saved: SavedScroll | null;
   listed: string[];
   inputBeforeMount: boolean;
+  arrivalRestoration: ScrollRestoration;
 }
 /** Take the pre-paint script's marker, read the saved position and open the
  * listed groups (or, after the script, keep what the reader left open and
  * write it to the fragment). */
 function openOnFirstRun(): FirstRun {
+  const arrivalRestoration = window.history.scrollRestoration;
   const bootstrap = takeOpenGroupsBootstrap(document);
   // Read the saved position before anything can rewrite the fragment that
   // keys it.
@@ -195,10 +222,11 @@ function openOnFirstRun(): FirstRun {
       saved,
       listed: openGroupsFromHash(document, window.location.hash),
       inputBeforeMount: false,
+      arrivalRestoration,
     };
   }
   // The script opened the listed groups; what is open now is the reader's.
   const listed = listedOpenAnchors(document, window.location.hash);
   syncOpenFragment(window);
-  return { saved, listed, inputBeforeMount: bootstrap.input };
+  return { saved, listed, inputBeforeMount: bootstrap.input, arrivalRestoration };
 }
diff --git a/bench/web/components/chart/controller.ts b/bench/web/components/chart/controller.ts
index 3a2a303..9713a0a 100644
--- a/bench/web/components/chart/controller.ts
+++ b/bench/web/components/chart/controller.ts
@@ -42,6 +42,7 @@ import {
   retryGroupBundle,
   subscribeGroupBundleRetry,
 } from '@/lib/chart-store';
+import { unlessPageLeft } from '@/lib/page-leave';
 import type { ChartResponse } from '@/lib/queries';
 import { effectiveTheme, onThemeChange } from '@/lib/theme';
 
@@ -365,15 +366,23 @@ export class ChartController {
         if (err instanceof DOMException && err.name === 'AbortError') {
           return;
         }
-        this.cb.setLoading(false);
-        const message =
-          err instanceof DOMException && err.name === 'TimeoutError'
-            ? 'timed out'
-            : err instanceof Error
-              ? err.message
-              : 'unknown error';
-        this.cb.setError(`failed to load: ${message}`);
-        this.cb.setRetryable(true);
+        // Leaving the page cancels the fetch with what looks like a network failure; that is
+        // dropped quietly (`lib/page-leave.ts`). By the time a failure reports, the island may be
+        // gone, or a reopen may have started a newer fetch whose loading state this must keep.
+        return unlessPageLeft(err, () => {
+          if (state.disposed || state.payload || state.initialFetchEntry !== null) {
+            return;
+          }
+          this.cb.setLoading(false);
+          const message =
+            err instanceof DOMException && err.name === 'TimeoutError'
+              ? 'timed out'
+              : err instanceof Error
+                ? err.message
+                : 'unknown error';
+          this.cb.setError(`failed to load: ${message}`);
+          this.cb.setRetryable(true);
+        });
       },
     );
   }
@@ -494,10 +503,17 @@ export class ChartController {
         if (err instanceof DOMException && err.name === 'AbortError') {
           return;
         }
-        // Quiet: the latest-100 payload is still usable. Surface to the console
-        // for debugging; the chip exposes the retry affordance.
-        console.warn('bench: full history fetch failed', err);
-        state.chipError = true;
+        // Leaving the page cancels the fetch with what looks like a network failure; that is
+        // dropped quietly (`lib/page-leave.ts`). Otherwise quiet too: the latest-100 payload is
+        // still usable. Surface to the console for debugging; the chip exposes the retry
+        // affordance.
+        return unlessPageLeft(err, () => {
+          if (state.disposed) {
+            return;
+          }
+          console.warn('bench: full history fetch failed', err);
+          state.chipError = true;
+        });
       })
       .then(() => {
         if (state.fullFetchEntry === entry) {
diff --git a/bench/web/lib/chart-store/bundles.ts b/bench/web/lib/chart-store/bundles.ts
index 2b76289..3cf331d 100644
--- a/bench/web/lib/chart-store/bundles.ts
+++ b/bench/web/lib/chart-store/bundles.ts
@@ -2,6 +2,7 @@
 // SPDX-FileCopyrightText: Copyright the Vortex contributors
 
 import { chartHasRecentData, FETCH_TIMEOUT_MS } from '@/lib/chart-format';
+import { unlessPageLeft } from '@/lib/page-leave';
 import type { ChartResponse, GroupChartsResponse } from '@/lib/queries';
 
 import { noteChartRecentData, noteGroupSeries } from './group-store';
@@ -161,17 +162,25 @@ export function ensureGroupBundle(groupSlug: string, priority: number): Promise<
       }
       return { status: 'unavailable' };
     })
-    .catch((err: unknown): BundleResult => {
+    .catch((err: unknown): BundleResult | Promise<BundleResult> => {
       if (
         inFlightBundles.get(groupSlug)?.entry !== entry ||
         (controller.signal.aborted && controller.signal.reason?.name === 'AbortError')
       ) {
         return { status: 'aborted' };
       }
-      return {
-        status: 'failed',
-        error: controller.signal.aborted ? controller.signal.reason : err,
-      };
+      if (controller.signal.aborted) {
+        return { status: 'failed', error: controller.signal.reason };
+      }
+      // Leaving the page cancels the fetch with what looks like a network failure; that is
+      // dropped quietly (`lib/page-leave.ts`). A group closed meanwhile has aborted it.
+      return unlessPageLeft(
+        err,
+        (): BundleResult =>
+          inFlightBundles.get(groupSlug)?.entry === entry
+            ? { status: 'failed', error: err }
+            : { status: 'aborted' },
+      );
     })
     .then((result): BundleResult => {
       if (inFlightBundles.get(groupSlug)?.entry !== entry) {
diff --git a/bench/web/lib/open-groups.ts b/bench/web/lib/open-groups.ts
index 715f03b..f0aa975 100644
--- a/bench/web/lib/open-groups.ts
+++ b/bench/web/lib/open-groups.ts
@@ -14,7 +14,8 @@
  * the group nav) rewrites the fragment with [`syncOpenFragment`], which uses
  * `history.replaceState`, so a toggle adds no history entry. Toggles go
  * through [`scheduleOpenFragmentSync`], which coalesces a burst of them into
- * two writes (see there for why). Readers: the pre-paint
+ * two writes, on the schedule the filter bar's query writes share
+ * (`lib/url-writes.ts`). Readers: the pre-paint
  * script ([`OpenGroupsScript`]) opens the listed groups before the first
  * paint and leaves a marker on its document ([`takeOpenGroupsBootstrap`]).
  * After hydration, [`LandingState`] takes that marker and writes the fragment
@@ -31,6 +32,16 @@
  * `instanceof`, so a test can run them against a second JSDOM realm.
  */
 
+import {
+  cancelUrlWrite,
+  flushUrlWrites,
+  resetUrlWrites,
+  scheduleUrlWrite,
+  URL_WRITE_DELAY_MS,
+  type UrlEdit,
+  writeUrlNow,
+} from '@/lib/url-writes';
+
 /** One group section on the page: its readable anchor (the section `id`) and
  * its opaque API slug (`data-group-slug`). */
 export interface GroupRef {
@@ -186,6 +197,18 @@ export function scrollToGroup(doc: Document, anchor: string): boolean {
   return true;
 }
 
+// The fragment's part in the coalesced URL writes (`lib/url-writes.ts`).
+const FRAGMENT_PART = 'open-groups';
+
+/** Write the open groups into `url`'s fragment. A page without group sections is left alone. */
+function editOpenFragment(doc: Document): UrlEdit {
+  return (url) => {
+    if (groupSections(doc).length > 0) {
+      url.hash = formatOpenFragment(openAnchors(doc));
+    }
+  };
+}
+
 /**
  * Write the open groups into the fragment now, keeping the path and the
  * query. It writes with `history.replaceState`, and only when the URL would
@@ -194,124 +217,63 @@ export function scrollToGroup(doc: Document, anchor: string): boolean {
  * next toggle tries again. A page without group sections is left alone.
  * Returns whether it wrote.
  *
- * The write is current, so it also drops a write that
- * [`scheduleOpenFragmentSync`] has pending.
+ * The write is current, so it replaces a write that
+ * [`scheduleOpenFragmentSync`] has pending, and makes any other pending URL
+ * write (the filter bar's) with it.
  */
 export function syncOpenFragment(win: Window): boolean {
-  cancelOpenFragmentSync(win);
-  const doc = win.document;
-  if (groupSections(doc).length === 0) {
-    return false;
-  }
-  const { pathname, search, hash } = win.location;
-  const target = `${pathname}${search}${formatOpenFragment(openAnchors(doc))}`;
-  if (target === `${pathname}${search}${hash}`) {
-    return false;
-  }
-  lastWrites.set(win, win.performance.now());
-  try {
-    win.history.replaceState(null, '', target);
-  } catch {
-    return false;
-  }
-  return true;
+  return writeUrlNow(win, FRAGMENT_PART, editOpenFragment(win.document));
 }
 
 /**
  * The shortest time between two fragment writes from toggles, in
- * milliseconds; also how long the last toggle of a burst waits before its
- * write. At most about three writes a second, whatever the toggling.
+ * milliseconds: the delay of the coalesced URL writes, [`URL_WRITE_DELAY_MS`].
  */
-export const OPEN_FRAGMENT_SYNC_DELAY_MS = 300;
-
-/** A scheduled write: its timer, and the path and fragment when it was
- * scheduled. */
-interface PendingSync {
-  timer: ReturnType<typeof setTimeout>;
-  pathname: string;
-  hash: string;
-}
-
-const pendingSyncs = new WeakMap<Window, PendingSync>();
-// When [`syncOpenFragment`] last called `replaceState`, per window, on the
-// monotonic `performance.now()` clock: a wall clock that jumps forward would
-// let two writes come closer than the delay.
-const lastWrites = new WeakMap<Window, number>();
+export const OPEN_FRAGMENT_SYNC_DELAY_MS = URL_WRITE_DELAY_MS;
 
 /**
- * Write the open groups into the fragment after a toggle, at most once per
- * [`OPEN_FRAGMENT_SYNC_DELAY_MS`]. After a quiet spell (no write and nothing
- * pending for the delay) it writes at once, so the URL of a page with one
- * toggle is current at once, ready for a reload. Inside the delay it waits
- * instead, and each call restarts the wait, so the rest of a burst (fast
- * clicks, or Enter held on a summary) is one more write, made once the burst
- * stops. Writes are therefore always at least the delay apart.
- *
- * Why: Safari throws a `SecurityError` from a document's 101st
- * `history.replaceState` within 10 seconds, and Next.js makes a second call
- * of its own after each of ours (its router re-syncs its history state). Ours
- * is caught; Next's is not, and the App Router then replaces the page with its
- * error page. A write per toggle reached that limit after about 50 toggles.
- * At one write per 300 ms the page makes at most about 68 calls in 10 seconds.
+ * Write the open groups into the fragment after a toggle, through the
+ * coalesced URL writes ([`scheduleUrlWrite`]): at once after a quiet spell,
+ * otherwise once the burst stops, and never closer than
+ * [`OPEN_FRAGMENT_SYNC_DELAY_MS`] to another write. The filter bar's writes
+ * share the same schedule, so toggles and chip clicks together stay under
+ * Safari's limit of 100 `history.replaceState` calls in 10 seconds (see
+ * `lib/url-writes.ts` for why that limit matters).
  *
  * The URL can therefore lag the page by the delay. Code that reads the URL as
  * the open set (the scroll save on leaving the page) calls
  * [`flushOpenFragmentSync`] first.
  */
 export function scheduleOpenFragmentSync(win: Window): void {
-  const lastWrite = lastWrites.get(win);
-  const quiet =
-    !pendingSyncs.has(win) &&
-    (lastWrite === undefined || win.performance.now() - lastWrite >= OPEN_FRAGMENT_SYNC_DELAY_MS);
-  if (quiet) {
-    syncOpenFragment(win);
-    return;
-  }
-  cancelOpenFragmentSync(win);
-  const timer = setTimeout(() => {
-    flushOpenFragmentSync(win);
-  }, OPEN_FRAGMENT_SYNC_DELAY_MS);
-  pendingSyncs.set(win, { timer, pathname: win.location.pathname, hash: win.location.hash });
+  scheduleUrlWrite(win, FRAGMENT_PART, editOpenFragment(win.document), { ownsHash: true });
 }
 
 /**
- * Make a pending write now, instead of after the delay. Returns whether it
- * wrote; with nothing pending it writes nothing.
+ * Make a pending URL write now, instead of after the delay: the fragment's,
+ * and any other part's. Returns whether it wrote; with nothing pending it
+ * writes nothing.
  *
  * A fragment that changed after the write was scheduled is not ours (a link,
  * or one typed into the address bar, whose `hashchange` may not have run
- * yet), so the pending write is dropped rather than written over it; the
- * `hashchange` handler reads that fragment and writes the open set itself.
+ * yet), so the pending fragment write is dropped rather than written over it;
+ * the `hashchange` handler reads that fragment and writes the open set itself.
  * A path that changed means the page is another route's now (a client
  * navigation that has not unmounted the landing page yet), so the write is
  * dropped too.
  */
 export function flushOpenFragmentSync(win: Window): boolean {
-  const pending = pendingSyncs.get(win);
-  if (pending === undefined) {
-    return false;
-  }
-  cancelOpenFragmentSync(win);
-  if (win.location.pathname !== pending.pathname || win.location.hash !== pending.hash) {
-    return false;
-  }
-  return syncOpenFragment(win);
+  return flushUrlWrites(win);
 }
 
-/** Drop a pending write, if any, without writing. */
+/** Drop a pending fragment write, if any, without writing. */
 export function cancelOpenFragmentSync(win: Window): void {
-  const pending = pendingSyncs.get(win);
-  if (pending !== undefined) {
-    clearTimeout(pending.timer);
-    pendingSyncs.delete(win);
-  }
+  cancelUrlWrite(win, FRAGMENT_PART);
 }
 
-/** Drop a pending write and forget the last write's time. TEST-ONLY: a page
- * load starts with neither. */
+/** Drop every pending URL write and forget the last write's time. TEST-ONLY:
+ * a page load starts with neither. */
 export function resetOpenFragmentSync(win: Window): void {
-  cancelOpenFragmentSync(win);
-  lastWrites.delete(win);
+  resetUrlWrites(win);
 }
 
 /**
diff --git a/bench/web/lib/package-manager.test.ts b/bench/web/lib/package-manager.test.ts
new file mode 100644
index 0000000..b362ad8
--- /dev/null
+++ b/bench/web/lib/package-manager.test.ts
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+function readJson<T>(relative: string): T {
+  return JSON.parse(readFileSync(fileURLToPath(new URL(relative, import.meta.url)), 'utf8')) as T;
+}
+
+interface PackageJson {
+  packageManager?: string;
+}
+
+const root = readJson<PackageJson>('../../../package.json');
+const bench = readJson<PackageJson>('../package.json');
+
+// pnpm refuses to install in a project whose `packageManager` names another package manager, so
+// the pin keeps a pnpm command in bench/web from installing around Bun's release-age cooldown.
+describe('bench/web packageManager', () => {
+  it('pins Bun, the same version as the root workspace', () => {
+    expect(root.packageManager).toMatch(/^bun@\d+\.\d+\.\d+$/);
+    expect(bench.packageManager).toBe(root.packageManager);
+  });
+});
diff --git a/bench/web/lib/page-leave.test.ts b/bench/web/lib/page-leave.test.ts
new file mode 100644
index 0000000..41feeed
--- /dev/null
+++ b/bench/web/lib/page-leave.test.ts
@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { PAGE_LEAVE_GRACE_MS, unlessPageLeft, watchPageLeave } from '@/lib/page-leave';
+
+// A window stand-in: the helper only listens on it.
+function fakeWindow(): Window {
+  return new EventTarget() as unknown as Window;
+}
+
+describe('unlessPageLeft', () => {
+  let win: Window;
+  let report: ReturnType<typeof vi.fn<() => string>>;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    win = fakeWindow();
+    // As the module does for the real window when it loads.
+    watchPageLeave(win);
+    report = vi.fn(() => 'reported');
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('reports a failure that leaving the page cannot cause at once', () => {
+    for (const error of [
+      new Error('HTTP 500'),
+      new DOMException('Fetch timed out', 'TimeoutError'),
+      new SyntaxError('Unexpected end of JSON input'),
+    ]) {
+      expect(unlessPageLeft(error, report, win)).toBe('reported');
+    }
+    expect(report).toHaveBeenCalledTimes(3);
+  });
+
+  it('reports at once without a window (on the server)', () => {
+    expect(unlessPageLeft(new TypeError('fetch failed'), report, undefined)).toBe('reported');
+  });
+
+  it('reports a network failure after the grace while the page stays', async () => {
+    const result = unlessPageLeft(new TypeError('Failed to fetch'), report, win);
+    await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS - 1);
+    expect(report).not.toHaveBeenCalled();
+    await vi.advanceTimersByTimeAsync(1);
+    await expect(result).resolves.toBe('reported');
+  });
+
+  it('drops a network failure when the page starts to unload within the grace', async () => {
+    const result = unlessPageLeft(new TypeError('Load failed'), report, win);
+    await vi.advanceTimersByTimeAsync(20);
+    win.dispatchEvent(new Event('pagehide'));
+    await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS * 10);
+    expect(report).not.toHaveBeenCalled();
+
+    // Restored from the back/forward cache: the data never came, so the failure counts now.
+    win.dispatchEvent(new Event('pageshow'));
+    await expect(result).resolves.toBe('reported');
+  });
+
+  it('drops an AbortError that no controller of ours raised (Firefox)', async () => {
+    void unlessPageLeft(new DOMException('The operation was aborted.', 'AbortError'), report, win);
+    win.dispatchEvent(new Event('pagehide'));
+    await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS * 10);
+    expect(report).not.toHaveBeenCalled();
+  });
+
+  it('holds a failure that comes after the page hid until it shows again', async () => {
+    win.dispatchEvent(new Event('pagehide'));
+    const result = unlessPageLeft(new TypeError('Load failed'), report, win);
+    await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS * 10);
+    expect(report).not.toHaveBeenCalled();
+    win.dispatchEvent(new Event('pageshow'));
+    await expect(result).resolves.toBe('reported');
+
+    // Shown again, a later failure waits only for the grace.
+    const later = unlessPageLeft(new TypeError('Failed to fetch'), report, win);
+    await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS);
+    await expect(later).resolves.toBe('reported');
+  });
+
+  it('rejects when the report throws', async () => {
+    const failure = new Error('island gone');
+    const result = unlessPageLeft(
+      new TypeError('Failed to fetch'),
+      () => {
+        throw failure;
+      },
+      win,
+    );
+    const settled = expect(result).rejects.toBe(failure);
+    await vi.advanceTimersByTimeAsync(PAGE_LEAVE_GRACE_MS);
+    await settled;
+  });
+});
diff --git a/bench/web/lib/page-leave.ts b/bench/web/lib/page-leave.ts
new file mode 100644
index 0000000..f3cc32c
--- /dev/null
+++ b/bench/web/lib/page-leave.ts
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+/**
+ * Fetch failures caused by leaving the page.
+ *
+ * Leaving the page (Back from a chart page, a link, a reload) cancels its in-flight fetches.
+ * WebKit rejects each one with a `TypeError` ("Load failed") as the navigation starts, before the
+ * page's `pagehide`; Firefox rejects with an `AbortError` that no `AbortController` of ours
+ * raised. A real network failure is a `TypeError` too, so the error alone does not tell them
+ * apart. [`unlessPageLeft`] therefore holds such a failure for [`PAGE_LEAVE_GRACE_MS`]: if the
+ * page fires `pagehide` meanwhile, or already has, the failure is dropped quietly, and only a
+ * page restored from the back/forward cache (`pageshow`) reports it, because that page did lose
+ * the data. Any other failure (an HTTP status, a timeout, a bad body) reports at once.
+ *
+ * Only `pagehide` and `pageshow` are watched: a `beforeunload` listener would keep Firefox from
+ * putting the page in its back/forward cache.
+ */
+
+/** How long a network failure waits for the page to start unloading before it counts. */
+export const PAGE_LEAVE_GRACE_MS = 1000;
+
+interface LeaveWatch {
+  /** `pagehide` fired, and no `pageshow` since. */
+  left: boolean;
+  onHide: Set<() => void>;
+  onShow: Set<() => void>;
+}
+
+const watches = new WeakMap<Window, LeaveWatch>();
+
+function runAll(callbacks: Set<() => void>): void {
+  const pending = [...callbacks];
+  callbacks.clear();
+  for (const callback of pending) {
+    callback();
+  }
+}
+
+function leaveWatch(win: Window): LeaveWatch {
+  let watch = watches.get(win);
+  if (watch === undefined) {
+    const created: LeaveWatch = { left: false, onHide: new Set(), onShow: new Set() };
+    win.addEventListener('pagehide', () => {
+      created.left = true;
+      runAll(created.onHide);
+    });
+    win.addEventListener('pageshow', () => {
+      created.left = false;
+      runAll(created.onShow);
+    });
+    watches.set(win, created);
+    watch = created;
+  }
+  return watch;
+}
+
+/** Start watching `win` for `pagehide` and `pageshow`, once per window. The module does this for
+ * the page's window when it loads, so a `pagehide` before the first failure is not missed. */
+export function watchPageLeave(win: Window): void {
+  leaveWatch(win);
+}
+
+if (typeof window !== 'undefined') {
+  watchPageLeave(window);
+}
+
+/** Whether `error` is how a browser fails a fetch that leaving the page cancelled. */
+function mayBeFromLeaving(error: unknown): boolean {
+  return (
+    error instanceof TypeError ||
+    (typeof error === 'object' &&
+      error !== null &&
+      (error as { name?: unknown }).name === 'AbortError')
+  );
+}
+
+/**
+ * Report a fetch failure with `report`, unless leaving the page caused it. A failure that cannot
+ * come from leaving the page reports at once, and this returns what `report` returns. Otherwise
+ * it returns a promise: it reports after [`PAGE_LEAVE_GRACE_MS`] if the page has not started to
+ * unload by then; if it has, it reports only when the page is shown again from the back/forward
+ * cache, which for a page that unloads is never. The caller checks in `report` that the failure
+ * still matters (the island may be gone, or a newer fetch running).
+ */
+export function unlessPageLeft<T>(
+  error: unknown,
+  report: () => T,
+  win: Window | undefined = typeof window === 'undefined' ? undefined : window,
+): T | Promise<T> {
+  if (win === undefined || !mayBeFromLeaving(error)) {
+    return report();
+  }
+  const watch = leaveWatch(win);
+  return new Promise<T>((resolve, reject) => {
+    const settle = (): void => {
+      try {
+        resolve(report());
+      } catch (reportError) {
+        reject(reportError);
+      }
+    };
+    if (watch.left) {
+      watch.onShow.add(settle);
+      return;
+    }
+    const onHide = (): void => {
+      clearTimeout(timer);
+      watch.onShow.add(settle);
+    };
+    const timer = setTimeout(() => {
+      watch.onHide.delete(onHide);
+      settle();
+    }, PAGE_LEAVE_GRACE_MS);
+    watch.onHide.add(onHide);
+  });
+}
diff --git a/bench/web/lib/scroll-restore.ts b/bench/web/lib/scroll-restore.ts
index 0dc26d2..e08b0ef 100644
--- a/bench/web/lib/scroll-restore.ts
+++ b/bench/web/lib/scroll-restore.ts
@@ -9,7 +9,9 @@ import type { GroupBodiesReady } from '@/lib/group-bodies';
  * The server never sees the fragment, so an open group's body (its toolbar and
  * chart cards) exists only after hydration, and the browser's own restoration
  * would land against a shorter page. [`LandingState`] therefore sets
- * `history.scrollRestoration = 'manual'` on `/` and does the work here:
+ * `history.scrollRestoration = 'manual'` on `/` while a group is open (with
+ * none open the collapsed list is as tall before hydration as after, so the
+ * browser's own restoration stays on) and does the work here:
  *
  * - **Save.** On `pagehide`, when the tab goes hidden, and before a chart
  *   link is followed, it records the element nearest the top of the viewport
diff --git a/bench/web/lib/url-writes.test.ts b/bench/web/lib/url-writes.test.ts
new file mode 100644
index 0000000..ace1800
--- /dev/null
+++ b/bench/web/lib/url-writes.test.ts
@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+// @vitest-environment jsdom
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import {
+  cancelUrlWrite,
+  flushUrlWrites,
+  resetUrlWrites,
+  scheduleUrlWrite,
+  URL_WRITE_DELAY_MS,
+  urlWritePending,
+  writeUrlNow,
+} from '@/lib/url-writes';
+
+const setHash = (hash: string) => (url: URL) => {
+  url.hash = hash;
+};
+const setParam = (name: string, value: string) => (url: URL) => {
+  url.searchParams.set(name, value);
+};
+
+describe('coalesced URL writes', () => {
+  let writes: string[];
+
+  beforeEach(() => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout', 'Date', 'performance'] });
+    window.history.replaceState(null, '', '/?n=all');
+    resetUrlWrites(window);
+    writes = [];
+    const replaceState = History.prototype.replaceState;
+    vi.spyOn(window.history, 'replaceState').mockImplementation(function (
+      this: History,
+      data,
+      unused,
+      url,
+    ) {
+      writes.push(String(url));
+      replaceState.call(this, data, unused, url);
+    });
+  });
+
+  afterEach(() => {
+    resetUrlWrites(window);
+    vi.useRealTimers();
+  });
+
+  function here(): string {
+    return `${window.location.pathname}${window.location.search}${window.location.hash}`;
+  }
+
+  it('writes every pending part in one call', () => {
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'a'));
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'b'));
+    scheduleUrlWrite(window, 'open-groups', setHash('#g1'), { ownsHash: true });
+    expect(writes).toEqual(['/?n=all&engine=a']);
+
+    vi.advanceTimersByTime(URL_WRITE_DELAY_MS);
+    expect(writes).toEqual(['/?n=all&engine=a', '/?n=all&engine=b#g1']);
+    expect(here()).toBe('/?n=all&engine=b#g1');
+  });
+
+  it('shares one rate limit between the parts', () => {
+    scheduleUrlWrite(window, 'open-groups', setHash('#g1'), { ownsHash: true });
+    // Inside the delay after the fragment write, a filter write waits.
+    vi.advanceTimersByTime(URL_WRITE_DELAY_MS - 1);
+    scheduleUrlWrite(window, 'filters', setParam('format', ''));
+    expect(writes).toHaveLength(1);
+    vi.advanceTimersByTime(URL_WRITE_DELAY_MS);
+    expect(writes).toHaveLength(2);
+    expect(here()).toBe('/?n=all&format=#g1');
+  });
+
+  it('writes a part now with the other pending parts', () => {
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'a'));
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'b'));
+    expect(writeUrlNow(window, 'open-groups', setHash('#g2'))).toBe(true);
+    expect(here()).toBe('/?n=all&engine=b#g2');
+    expect(urlWritePending(window, 'filters')).toBe(false);
+  });
+
+  it('cancels one part and keeps the other', () => {
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'a'));
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'b'));
+    scheduleUrlWrite(window, 'open-groups', setHash('#g1'), { ownsHash: true });
+    cancelUrlWrite(window, 'open-groups');
+    expect(flushUrlWrites(window)).toBe(true);
+    expect(here()).toBe('/?n=all&engine=b');
+  });
+
+  it('drops the fragment part when the fragment changed, but not the query part', () => {
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'a'));
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'b'));
+    scheduleUrlWrite(window, 'open-groups', setHash('#g1'), { ownsHash: true });
+    // A link changes the fragment before its `hashchange` runs.
+    History.prototype.replaceState.call(window.history, null, '', '/?n=all&engine=a#typed');
+    expect(flushUrlWrites(window)).toBe(true);
+    expect(here()).toBe('/?n=all&engine=b#typed');
+  });
+
+  it('drops every part when the path changed', () => {
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'a'));
+    scheduleUrlWrite(window, 'filters', setParam('engine', 'b'));
+    History.prototype.replaceState.call(window.history, null, '', '/chart/x');
+    expect(flushUrlWrites(window)).toBe(false);
+    expect(here()).toBe('/chart/x');
+  });
+
+  it('survives a browser that refuses the write', () => {
+    vi.mocked(window.history.replaceState).mockImplementationOnce(() => {
+      throw new DOMException('too many calls', 'SecurityError');
+    });
+    expect(writeUrlNow(window, 'filters', setParam('engine', 'a'))).toBe(false);
+    expect(here()).toBe('/?n=all');
+  });
+});
diff --git a/bench/web/lib/url-writes.ts b/bench/web/lib/url-writes.ts
new file mode 100644
index 0000000..5616928
--- /dev/null
+++ b/bench/web/lib/url-writes.ts
@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+/**
+ * Coalesced `history.replaceState` writes of page state into the URL.
+ *
+ * Two parts of the page keep state in the URL: the landing page's open groups in the fragment
+ * (`lib/open-groups.ts`) and the filter bar's chips in the query (`components/FilterBar.tsx`).
+ * Each is a *part*: a name and an edit that writes its current state into a `URL`. A part either
+ * writes now ([`writeUrlNow`]) or schedules a write ([`scheduleUrlWrite`]), and every write
+ * applies all the parts that are pending, in one `replaceState` call, and only when the URL would
+ * change.
+ *
+ * Why: Safari throws a `SecurityError` from a document's 101st `history.replaceState` within 10
+ * seconds, and Next.js makes a second call of its own after each of ours (its router re-syncs its
+ * history state). Ours is caught; Next's is not, and the App Router then replaces the page with
+ * its error page. A write per toggle or chip click reached that limit after about 50 clicks.
+ * Scheduled writes are at least [`URL_WRITE_DELAY_MS`] apart, so the page makes at most about 68
+ * calls in 10 seconds however fast the clicks come.
+ *
+ * Every helper takes the window it acts on, so a test can run them against a second JSDOM realm.
+ */
+
+/**
+ * The shortest time between two scheduled writes, in milliseconds; also how long the last change
+ * of a burst waits before its write. At most about three writes a second.
+ */
+export const URL_WRITE_DELAY_MS = 300;
+
+/** Write a part's current state into `url`. Leave `url` alone to write nothing for the part. */
+export type UrlEdit = (url: URL) => void;
+
+/** A part waiting for the next write: its edit, and the URL when it was scheduled. */
+interface PendingPart {
+  edit: UrlEdit;
+  pathname: string;
+  hash: string;
+  /** Drop the part when the fragment changed after it was scheduled. */
+  ownsHash: boolean;
+}
+
+interface PendingWrite {
+  timer: ReturnType<typeof setTimeout> | null;
+  parts: Map<string, PendingPart>;
+}
+
+const pendingWrites = new WeakMap<Window, PendingWrite>();
+// When this module last called `replaceState`, per window, on the monotonic `performance.now()`
+// clock: a wall clock that jumps forward would let two writes come closer than the delay.
+const lastWrites = new WeakMap<Window, number>();
+
+function pendingFor(win: Window): PendingWrite {
+  let pending = pendingWrites.get(win);
+  if (pending === undefined) {
+    pending = { timer: null, parts: new Map() };
+    pendingWrites.set(win, pending);
+  }
+  return pending;
+}
+
+function addPart(win: Window, name: string, edit: UrlEdit, ownsHash: boolean): void {
+  pendingFor(win).parts.set(name, {
+    edit,
+    pathname: win.location.pathname,
+    hash: win.location.hash,
+    ownsHash,
+  });
+}
+
+/**
+ * Apply every pending part and write the URL now, cancelling the scheduled write. Returns whether
+ * it called `replaceState`.
+ *
+ * A part whose path changed since it was scheduled is dropped: the page is another route's now (a
+ * client navigation that has not unmounted the old page yet). A part that owns the fragment is
+ * dropped too when the fragment changed: that fragment is not ours (a link, or one typed into the
+ * address bar, whose `hashchange` may not have run yet), and the `hashchange` handler writes the
+ * part itself.
+ */
+function writePending(win: Window): boolean {
+  const pending = pendingWrites.get(win);
+  if (pending === undefined) {
+    return false;
+  }
+  if (pending.timer !== null) {
+    clearTimeout(pending.timer);
+  }
+  pendingWrites.delete(win);
+  const { pathname, search, hash, href } = win.location;
+  const url = new URL(href);
+  for (const part of pending.parts.values()) {
+    if (part.pathname === pathname && (!part.ownsHash || part.hash === hash)) {
+      part.edit(url);
+    }
+  }
+  const target = `${url.pathname}${url.search}${url.hash}`;
+  if (target === `${pathname}${search}${hash}`) {
+    return false;
+  }
+  lastWrites.set(win, win.performance.now());
+  try {
+    win.history.replaceState(null, '', target);
+  } catch {
+    // Browsers rate-limit `replaceState` (Safari throws a `SecurityError` past its limit). The
+    // state stays on the page, and the next write tries again.
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Write the part `name` now, with any other part that is pending. For a change the reader asked
+ * to see in the URL at once (a new fragment, the group nav). Returns whether it wrote.
+ */
+export function writeUrlNow(win: Window, name: string, edit: UrlEdit): boolean {
+  addPart(win, name, edit, false);
+  return writePending(win);
+}
+
+/**
+ * Write the part `name` after a change, at most once per [`URL_WRITE_DELAY_MS`]. After a quiet
+ * spell (no write and nothing pending for the delay) it writes at once, so the URL of a page with
+ * one change is current at once, ready for a reload. Inside the delay it waits instead, and each
+ * call restarts the wait, so the rest of a burst (fast clicks, or Enter held on a button) is one
+ * more write, made once the burst stops. Writes are therefore always at least the delay apart.
+ *
+ * `ownsHash` marks a part that writes the fragment: it is dropped if the fragment changes before
+ * the write (see [`flushUrlWrites`]).
+ *
+ * The URL can therefore lag the page by the delay. Code that reads the URL as page state (the
+ * scroll save on leaving the page) calls [`flushUrlWrites`] first.
+ */
+export function scheduleUrlWrite(
+  win: Window,
+  name: string,
+  edit: UrlEdit,
+  { ownsHash = false }: { ownsHash?: boolean } = {},
+): void {
+  const lastWrite = lastWrites.get(win);
+  const quiet =
+    !pendingWrites.has(win) &&
+    (lastWrite === undefined || win.performance.now() - lastWrite >= URL_WRITE_DELAY_MS);
+  addPart(win, name, edit, ownsHash);
+  const pending = pendingFor(win);
+  if (quiet) {
+    writePending(win);
+    return;
+  }
+  if (pending.timer !== null) {
+    clearTimeout(pending.timer);
+  }
+  pending.timer = setTimeout(() => {
+    writePending(win);
+  }, URL_WRITE_DELAY_MS);
+}
+
+/**
+ * Make a pending write now, instead of after the delay. Returns whether it wrote; with nothing
+ * pending it writes nothing. A part whose path changed since it was scheduled, or that owns the
+ * fragment and the fragment changed, is dropped rather than written.
+ */
+export function flushUrlWrites(win: Window): boolean {
+  return writePending(win);
+}
+
+/** Drop the pending write of the part `name`, if any, without writing it. */
+export function cancelUrlWrite(win: Window, name: string): void {
+  const pending = pendingWrites.get(win);
+  if (pending === undefined) {
+    return;
+  }
+  pending.parts.delete(name);
+  if (pending.parts.size === 0) {
+    if (pending.timer !== null) {
+      clearTimeout(pending.timer);
+    }
+    pendingWrites.delete(win);
+  }
+}
+
+/** Whether the part `name` has a write pending. */
+export function urlWritePending(win: Window, name: string): boolean {
+  return pendingWrites.get(win)?.parts.has(name) === true;
+}
+
+/** Drop every pending write and forget the last write's time. TEST-ONLY: a page load starts with
+ * neither. */
+export function resetUrlWrites(win: Window): void {
+  const pending = pendingWrites.get(win);
+  if (pending?.timer != null) {
+    clearTimeout(pending.timer);
+  }
+  pendingWrites.delete(win);
+  lastWrites.delete(win);
+}
diff --git a/bench/web/package.json b/bench/web/package.json
index 43cd045..a9b501a 100644
--- a/bench/web/package.json
+++ b/bench/web/package.json
@@ -2,6 +2,7 @@
   "name": "benchmarks-web",
   "version": "0.1.0",
   "private": true,
+  "packageManager": "bun@1.4.3",
   "scripts": {
     "dev": "next dev",
     "build": "next build",
diff --git a/renovate.json b/renovate.json
index d2cafc9..0073cef 100644
--- a/renovate.json
+++ b/renovate.json
@@ -86,6 +86,13 @@
       "additionalBranchPrefix": "bench-",
       "commitMessageSuffix": "(bench)",
       "addLabels": ["bench"]
+    },
+    {
+      "description": "The root and bench/web package.json pin the same Bun in packageManager. Update both in one branch, without bench's prefix, so the two pins cannot drift. This rule comes after bench's so that it wins.",
+      "matchDepTypes": ["packageManager"],
+      "groupName": "Bun package manager",
+      "additionalBranchPrefix": "",
+      "commitMessageSuffix": ""
     }
   ]
 }