fix: +show-face u21/UTF-8 semantics, Zig output buffering, isAbsolute

Resolves RV14 (docs/rewrite/notes/review-rv14-codex.md, final-Z17.md):
- +show-face --cp parses as u21 (new U21 field type): out-of-range
  values give an invalid-value diagnostic and exit 1 instead of a panic;
  --string accepts raw bytes and fails with error.InvalidUtf8 after the
  codepoint lookup like Zig.
- CLI actions write through ZigWriter, a model of Zig 0.15's buffered
  File.writer (fixed buffer, drain on overflow, explicit flush), so
  stdout/stderr interleave in Zig's flush order (+show-face, help,
  version, validate-config, show-config, list-*, ssh-cache, crash-report,
  edit-config, new-window).
- Zig 0.15.2 std.fs.path.isAbsolute port (Windows: \theme and /theme are
  absolute) replaces Path::is_absolute at every Zig isAbsolute site.
- io_uring is available iff a 256-entry ring can be created, like
  libxev; the reactor falls back to IORING_OP_TIMEOUT without EXT_ARG.
- Windows basename (`λ:theme`) verified against 0.15.2 (test added).

Test Plan:
- cargo test --workspace --no-fail-fast
- diff +show-face outputs (pipe) against /usr/bin/ghostty

crates/ghostty-cli/src/crash_report.rs

@@ -42,7 +42,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
 
     let stdout = std::io::stdout();
     let is_tty = stdout.is_terminal();
-    let mut out = std::io::BufWriter::new(stdout.lock());
+    let mut out = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 1024);
     let result = run_inner(&default_dir()?, is_tty, now_ns(), &mut out);
     let _ = out.flush();
     result

crates/ghostty-cli/src/edit_config.rs

@@ -31,7 +31,7 @@ pub use crate::options::NoOptions as Options;
 /// if both are set. If neither are set, it will print an error
 /// and exit.
 pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
-    let mut stderr = std::io::stderr().lock();
+    let mut stderr = crate::zig_writer::ZigWriter::new(crate::zig_writer::stderr_sink(), 1024);
 
     let mut opts = Options;
     crate::parse_options(&mut opts, args)?;

crates/ghostty-cli/src/ghostty.rs

@@ -165,7 +165,8 @@ impl Action {
                 // to stdout. In the future we can style this much prettier
                 // for all commands by just changing this one place.
                 let text = format!("{}\n", self.help_text());
-                let mut stdout = std::io::stdout().lock();
+                let mut stdout =
+                    crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 1024);
                 if let Err(e) = stdout.write_all(text.as_bytes()) {
                     log::warn!("failed to write help text: {e}\n");
                     return Ok(1);

crates/ghostty-cli/src/help.rs

@@ -26,7 +26,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     let mut opts = Options::default();
     crate::parse_options(&mut opts, args)?;
 
-    let mut out = std::io::BufWriter::new(std::io::stdout().lock());
+    let mut out = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 2048);
     write_help(&mut out)?;
     out.flush()?;
     Ok(0)

crates/ghostty-cli/src/lib.rs

@@ -40,6 +40,7 @@ pub mod ssh_cache;
 pub mod tui;
 pub mod validate_config;
 pub mod version;
+pub(crate) mod zig_writer;
 
 pub use error::Error;
 pub use ghostty::{Action, run_from_args};

crates/ghostty-cli/src/list_actions.rs

@@ -27,7 +27,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     crate::parse_options(&mut opts, args)?;
 
     let out = generate_plaintext(opts.docs);
-    let mut stdout = std::io::stdout().lock();
+    let mut stdout = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 4096);
     stdout.write_all(out.as_bytes())?;
     stdout.flush()?;
     Ok(0)

crates/ghostty-cli/src/list_fonts.rs

@@ -97,7 +97,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     }
 
     // Output each
-    let mut stdout = std::io::BufWriter::new(std::io::stdout().lock());
+    let mut stdout = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 2048);
     for family in &families {
         let Some(list) = map.get_mut(family) else {
             continue;

crates/ghostty-cli/src/list_keybinds.rs

@@ -73,7 +73,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     }
 
     let text = format_plain(&config.keybind, opts.docs)?;
-    let mut out = std::io::BufWriter::new(stdout.lock());
+    let mut out = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 1024);
     out.write_all(text.as_bytes())?;
     // Don't forget to flush!
     out.flush()?;

crates/ghostty-cli/src/list_themes.rs

@@ -233,7 +233,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     crate::parse_options(&mut opts, args)?;
 
     let stdout = std::io::stdout();
-    let mut stderr = std::io::stderr();
+    let mut stderr = crate::zig_writer::ZigWriter::new(crate::zig_writer::stderr_sink(), 4096);
 
     let resources_dir = resources_dir();
     if resources_dir.is_none() {
@@ -262,7 +262,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
         return Ok(0);
     }
 
-    let mut out = std::io::BufWriter::new(stdout.lock());
+    let mut out = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 4096);
     write_plain(&mut out, &themes, &opts)?;
     // Don't forget to flush!
     out.flush()?;

crates/ghostty-cli/src/new_window.rs

@@ -187,6 +187,13 @@ impl CliTarget for Options {
 ///
 /// Available since: 1.2.0
 pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
+    let mut stderr = crate::zig_writer::ZigWriter::new(crate::zig_writer::stderr_sink(), 1024);
+    let result = run_args(args, &mut stderr);
+    let _ = std::io::Write::flush(&mut stderr);
+    result
+}
+
+fn run_args(args: &[impl AsRef<[u8]>], stderr: &mut dyn std::io::Write) -> Result<u8, Error> {
     let mut opts = Options::default();
     let mut iter =
         ghostty_config::cli_args::ArgsIterator::new(args.iter().skip(1).map(AsRef::as_ref));
@@ -196,7 +203,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
             return Err(Error::ActionHelpRequested);
         }
         Err(err) => {
-            eprintln!("Error parsing args: {err}");
+            writeln!(stderr, "Error parsing args: {err}")?;
             return Ok(1);
         }
     }
@@ -237,7 +244,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
                 return Ok(1);
             }
             Err(e) => {
-                eprint!("Sending the IPC failed: {e}");
+                write!(stderr, "Sending the IPC failed: {e}")?;
                 return Ok(1);
             }
         },
@@ -248,7 +255,7 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     }
 
     // If we get here, the platform is not supported.
-    eprintln!("+new-window is not supported on this platform.");
+    writeln!(stderr, "+new-window is not supported on this platform.")?;
     Ok(1)
 }
 

crates/ghostty-cli/src/show_config.rs

@@ -60,9 +60,9 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     };
 
     let text = format_config_bytes(&config, &opts)?;
-    let mut stdout = std::io::stdout().lock();
+    let mut stdout = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 4096);
     stdout.write_all(&text)?;
-    stdout.flush()?;
+    stdout.end()?;
     Ok(0)
 }
 

crates/ghostty-cli/src/show_face.rs

@@ -1,6 +1,9 @@
 //! `+show-face` (ZIG/src/cli/show_face.zig).
 
+use std::io::Write;
+
 use ghostty_config::{
+    cli_args::U21,
     config::Config,
     config_enum,
     config_struct,
@@ -14,8 +17,12 @@ use ghostty_font::{
     face::DesiredSize,
     shared_grid_set::DerivedConfig,
 };
+use ghostty_os::osbytes::EncodedOs;
 
-use crate::error::Error;
+use crate::{
+    error::Error,
+    zig_writer::{Sink, ZigWriter, stdout_sink},
+};
 
 config_enum! {
     /// Font style (Zig: `font.Style`).
@@ -38,10 +45,10 @@ config_enum! {
 config_struct! {
     pub struct Options {
         /// The codepoint to search for.
-        "cp" => cp: Option<u32> = None,
+        "cp" => cp: Option<U21> = None,
 
         /// Search for all of the codepoints in the string.
-        "string" => string: Option<String> = None,
+        "string" => string: Option<EncodedOs> = None,
 
         /// Font style to search for.
         "style" => style: Style = Style::Regular,
@@ -82,7 +89,15 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     let mut opts = Options::default();
     crate::parse_options(&mut opts, args)?;
 
-    run_args(&opts, &mut std::io::stdout(), &mut std::io::stdout())
+    // Zig creates both writers on stdout (`File.stdout()`), each with its own
+    // 1024 byte buffer, and flushes stdout then stderr at the end.
+    let sink: Sink = stdout_sink();
+    let mut stdout = ZigWriter::new(sink.clone(), 1024);
+    let mut stderr = ZigWriter::new(sink, 1024);
+    let result = run_args(&opts, &mut stdout, &mut stderr);
+    let _ = stdout.flush();
+    let _ = stderr.flush();
+    result
 }
 
 fn run_args(
@@ -175,16 +190,25 @@ fn run_args(
 
     let mut rc = None;
     if let Some(cp) = opts.cp {
-        rc = lookup(stdout, stderr, &grid, style, presentation, cp)?;
+        rc = lookup(stdout, stderr, &grid, style, presentation, cp.0)?;
     }
     if rc.is_none()
         && let Some(string) = &opts.string
     {
-        for ch in string.chars() {
-            rc = lookup(stdout, stderr, &grid, style, presentation, ch as u32)?;
-            if rc.is_some() {
-                break;
+        // `Utf8View.init` validates the whole string before any lookup.
+        if let Ok(text) = std::str::from_utf8(&string.to_bytes()) {
+            for ch in text.chars() {
+                rc = lookup(stdout, stderr, &grid, style, presentation, ch as u32)?;
+                if rc.is_some() {
+                    break;
+                }
             }
+        } else {
+            write!(
+                stderr,
+                "Unable to parse string as unicode: error.InvalidUtf8"
+            )?;
+            rc = Some(1);
         }
     }
 
@@ -230,3 +254,67 @@ fn lookup(
     )?;
     Ok(None)
 }
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+
+    fn parse(args: &[&[u8]]) -> Options {
+        let mut full: Vec<&[u8]> = vec![b"ghostty"];
+        full.extend_from_slice(args);
+        let mut opts = Options::default();
+        crate::parse_options(&mut opts, &full).unwrap();
+        opts
+    }
+
+    #[test]
+    fn cp_is_u21() {
+        let o = parse(&[b"--cp=0x1FFFFF"]);
+        assert_eq!(o.cp, Some(U21(0x1f_ffff)));
+        assert!(o.diagnostics.is_empty());
+        for bad in ["--cp=0x200000", "--cp=4294967295", "--cp=-1"] {
+            let o = parse(&[bad.as_bytes()]);
+            assert_eq!(o.cp, None, "{bad}");
+            let d = &o.diagnostics.items()[0];
+            assert_eq!(d.key, "cp");
+            assert!(d.to_string().contains("invalid value"), "{d}");
+        }
+    }
+
+    #[test]
+    fn invalid_cp_exits_1_without_panic() {
+        let o = parse(&[b"--cp=4294967295"]);
+        let mut out = Vec::new();
+        let mut err = Vec::new();
+        assert_eq!(run_args(&o, &mut out, &mut err).unwrap(), 1);
+        let text = String::from_utf8(err).unwrap();
+        assert!(
+            text.starts_with("config error: cli:") && text.contains("cp: invalid value"),
+            "{text}"
+        );
+    }
+
+    #[test]
+    fn string_accepts_raw_bytes_at_parse() {
+        let o = parse(&[b"--cp=65", b"--string=\xff"]);
+        assert!(o.diagnostics.is_empty());
+        assert_eq!(o.string.unwrap().to_bytes(), b"\xff");
+    }
+
+    #[test]
+    fn invalid_utf8_string_fails_after_cp_lookup() {
+        let o = parse(&[b"--config-default-files=false", b"--string=\xff"]);
+        let mut out = Vec::new();
+        let mut err = Vec::new();
+        // Without a usable font setup this can fail earlier; only assert the
+        // Zig message when the grid was available.
+        let rc = run_args(&o, &mut out, &mut err).unwrap();
+        let err = String::from_utf8(err).unwrap();
+        if err.contains("Unable to") && !err.contains("as unicode") {
+            return;
+        }
+        assert_eq!(rc, 1);
+        assert_eq!(err, "Unable to parse string as unicode: error.InvalidUtf8");
+    }
+}

crates/ghostty-cli/src/ssh_cache.rs

@@ -50,8 +50,8 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     let mut opts = Options::default();
     crate::parse_options(&mut opts, args)?;
 
-    let mut stdout = std::io::BufWriter::new(std::io::stdout().lock());
-    let mut stderr = std::io::BufWriter::new(std::io::stderr().lock());
+    let mut stdout = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 1024);
+    let mut stderr = crate::zig_writer::ZigWriter::new(crate::zig_writer::stderr_sink(), 1024);
 
     let result = run_inner(&opts, &mut stdout, &mut stderr);
 

crates/ghostty-cli/src/validate_config.rs

@@ -29,9 +29,9 @@ pub fn run(args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     let mut opts = Options::default();
     crate::parse_options(&mut opts, args)?;
 
-    let mut stdout = std::io::BufWriter::new(std::io::stdout().lock());
+    let mut stdout = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 1024);
     let result = run_inner(&opts, &mut stdout);
-    stdout.flush()?;
+    stdout.end()?;
     result
 }
 

crates/ghostty-cli/src/version.rs

@@ -12,7 +12,7 @@ use crate::{
 pub fn run(_args: &[impl AsRef<[u8]>]) -> Result<u8, Error> {
     let stdout = std::io::stdout();
     let tty = stdout.is_terminal();
-    let mut out = std::io::BufWriter::new(stdout.lock());
+    let mut out = crate::zig_writer::ZigWriter::new(crate::zig_writer::stdout_sink(), 1024);
     write_version(&mut out, &build_info::get(), tty)?;
     out.flush()?;
     Ok(0)

crates/ghostty-cli/src/zig_writer.rs

@@ -0,0 +1,157 @@
+//! A model of Zig 0.15 `std.fs.File.writer(&buffer).interface`.
+//!
+//! Zig actions write through a fixed-size buffer that is only written to the
+//! file when it overflows or when the action calls `flush`, so two writers on
+//! the same file (as in `+show-face`) interleave in flush order, not call
+//! order. This type keeps that ordering.
+
+#[cfg(unix)]
+use std::os::fd::AsFd;
+use std::{
+    cell::RefCell,
+    io::{self, Write},
+    rc::Rc,
+};
+
+/// Where a [`ZigWriter`] drains to.
+pub enum Target {
+    /// A duplicate of a standard descriptor.
+    #[cfg(unix)]
+    Fd(std::fs::File),
+    /// A plain stream.
+    Stream(Box<dyn Write>),
+}
+
+/// A shared output target so several [`ZigWriter`]s can drain to one file.
+pub type Sink = Rc<RefCell<Target>>;
+
+/// Standard output as a [`Sink`].
+#[must_use]
+pub fn stdout_sink() -> Sink {
+    #[cfg(unix)]
+    if let Ok(fd) = io::stdout().as_fd().try_clone_to_owned() {
+        return Rc::new(RefCell::new(Target::Fd(fd.into())));
+    }
+    Rc::new(RefCell::new(Target::Stream(Box::new(io::stdout()))))
+}
+
+/// Standard error as a [`Sink`].
+#[must_use]
+pub fn stderr_sink() -> Sink {
+    #[cfg(unix)]
+    if let Ok(fd) = io::stderr().as_fd().try_clone_to_owned() {
+        return Rc::new(RefCell::new(Target::Fd(fd.into())));
+    }
+    Rc::new(RefCell::new(Target::Stream(Box::new(io::stderr()))))
+}
+
+/// A sink over any stream (tests).
+#[cfg(test)]
+#[must_use]
+pub fn stream_sink(w: impl Write + 'static) -> Sink {
+    Rc::new(RefCell::new(Target::Stream(Box::new(w))))
+}
+
+/// `File.Writer` with a `cap` byte buffer.
+pub struct ZigWriter {
+    buf: Vec<u8>,
+    cap: usize,
+    sink: Sink,
+}
+
+impl ZigWriter {
+    #[must_use]
+    pub fn new(sink: Sink, cap: usize) -> Self {
+        Self {
+            buf: Vec::with_capacity(cap),
+            cap,
+            sink,
+        }
+    }
+
+    /// `File.Writer.end`.
+    pub fn end(&mut self) -> io::Result<()> {
+        self.flush()
+    }
+
+    fn drain(&mut self, extra: &[u8]) -> io::Result<()> {
+        let mut pending = std::mem::take(&mut self.buf);
+        pending.extend_from_slice(extra);
+        if pending.is_empty() {
+            return Ok(());
+        }
+        match &mut *self.sink.borrow_mut() {
+            #[cfg(unix)]
+            Target::Fd(file) => file.write_all(&pending),
+            Target::Stream(w) => {
+                w.write_all(&pending)?;
+                w.flush()
+            }
+        }
+    }
+}
+
+impl Write for ZigWriter {
+    fn write(&mut self, data: &[u8]) -> io::Result<usize> {
+        self.write_all(data)?;
+        Ok(data.len())
+    }
+
+    /// Zig `Writer.write`: data that fits is buffered; otherwise the drain
+    /// writes the buffered bytes followed by the data straight to the file.
+    fn write_all(&mut self, data: &[u8]) -> io::Result<()> {
+        if self.buf.len() + data.len() <= self.cap {
+            self.buf.extend_from_slice(data);
+            return Ok(());
+        }
+        self.drain(data)
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        self.drain(&[])
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+
+    #[derive(Clone, Default)]
+    struct Mem(Rc<RefCell<Vec<u8>>>);
+    impl Write for Mem {
+        fn write(&mut self, d: &[u8]) -> io::Result<usize> {
+            self.0.borrow_mut().extend_from_slice(d);
+            Ok(d.len())
+        }
+        fn flush(&mut self) -> io::Result<()> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn buffers_until_flush_in_flush_order() {
+        let mem = Mem::default();
+        let sink: Sink = stream_sink(mem.clone());
+        let mut a = ZigWriter::new(sink.clone(), 1024);
+        let mut b = ZigWriter::new(sink, 1024);
+        b.write_all(b"err\n").unwrap();
+        a.write_all(b"out\n").unwrap();
+        assert!(mem.0.borrow().is_empty());
+        a.flush().unwrap();
+        b.flush().unwrap();
+        assert_eq!(&*mem.0.borrow(), b"out\nerr\n");
+    }
+
+    #[test]
+    fn overflow_drains_buffer_then_data() {
+        let mem = Mem::default();
+        let sink: Sink = stream_sink(mem.clone());
+        let mut w = ZigWriter::new(sink, 4);
+        w.write_all(b"ab").unwrap();
+        w.write_all(b"cdefg").unwrap();
+        assert_eq!(&*mem.0.borrow(), b"abcdefg");
+        w.write_all(b"h").unwrap();
+        assert_eq!(&*mem.0.borrow(), b"abcdefg");
+    }
+}