Lock Config and Preset Files Across Instances and Write Them Atomically

Every running instance shares one OrcaSlicer.conf and one user preset
tree, and nothing kept their writers apart. Two instances saving at the
same moment, or the cloud preset sync thread writing while the GUI thread
saved, could interleave, and a reader in another instance could open a
preset JSON or .info file between truncate and close and get a partial
file, dropping that preset for the session with a parse error.

Add InstanceLock, a scoped guard that serialises the threads of one
process through a recursive mutex and other processes through an advisory
OS file lock, which the OS releases when its holder dies. It is best
effort: when the lock file cannot be created, or another instance still
holds it after two seconds, the guard logs a warning and lets the write
proceed rather than letting a hung instance block every other one.

AppConfig::save() and load() hold OrcaSlicer.conf.lock; load is included
because the Windows path restores from the .bak copy, and because Windows
cannot replace a file another process has open, so an unlocked reader
there made the other instance's save fail. Every user preset writer and
reader holds user.lock: Preset::save(), save_info(), load_info() and
remove_files(), the whole directory scan in load_presets(), the bundle
metadata file, the .info removal after a cloud-confirmed delete and the
bundle folder removal on unsubscribe. The guard sits at the leaf writers
on purpose: set_sync_info_and_save() calls save_info() under the preset
collection mutex, so a batch lock around save_user_presets(), which takes
that mutex through delete_preset(), would invert the order.

Write preset JSON, .info and bundle metadata files through a temporary
file beside the target that is renamed over it, so a reader that never
waits still sees a complete old or new file. On Linux and macOS
rename_file() deleted the target before renaming, leaving a window in
which the file did not exist at all, and returned a meaningless error
code on failure; rename() replaces atomically, so call it directly.
AppConfig::save() now logs a failed final rename instead of dropping the
save silently.

.claude/skills/orca-profiles/SKILL.md

@@ -58,6 +58,9 @@ Paths below are relative to this skill. Commands run from the repository root.
 9. **Run the full profile checks before reporting completion.** A vendor-scoped pass is only a
    development loop. Review also covers version bumps, assets, non-default processes and hardware
    tuning that CI cannot establish.
+10. **One all-printer preset per product; color is a runtime property, never a preset.** Never ship
+    presets that differ only by color — CI accepts them, so this is a review call. See
+    [color is a runtime property](references/filament-profiles.md#color-is-a-runtime-property).
 
 ## Creating or modifying a profile
 
@@ -107,6 +110,7 @@ Paths below are relative to this skill. Commands run from the repository root.
 | A setting has no effect | Key spelling/type, `handle_legacy`, or a config key placed on a `machine_model` |
 | A preset exists but is not selectable | Index registration, `instantiation`, installation and compatibility |
 | A filament is missing, duplicated, or matches the wrong spool | [Compatibility and alias shadowing](references/filament-profiles.md#compatible_printers); [ids](references/ids.md) |
+| Presets differ only by color, or an all-printer library preset lacks `@System` | [Color is a runtime property](references/filament-profiles.md#color-is-a-runtime-property) |
 | A bed temperature is ignored | [Plate-specific temperature keys](references/filament-profiles.md#bed-temperature-is-twelve-keys-not-one) |
 | A change is absent from the running app | Version bump and [installed profile location](references/validation.md#testing-in-the-app) |
 | A check fails | [Error → remedy](references/validation.md#error--remedy) |

.claude/skills/orca-profiles/references/filament-profiles.md

@@ -52,6 +52,15 @@ a brand means adding a folder here; the folder name is a directory label only
   collection, so there is no duplicate-name error.
 - You may inherit from an instantiated preset as well as from a base; it is common.
 
+## Color is a runtime property
+
+`filament_id` identifies a product, not a color; filament sync/AMS reads the color from the spool at
+runtime. A product ships one all-printer preset and the color is chosen at runtime — never a sibling
+preset that differs only by color. A material family (PLA vs PLA Matte vs PLA Silk) is a new product; a
+color is not. A printer tune keeps the product alias and does not multiply per color either.
+
+CI does not catch this — per-color presets pass `check` — so it is a review call.
+
 ## The two most common contributions
 
 **A printer vendor tuning a generic.** Keep the `Generic X` base name so the alias shadows the library

.claude/skills/orca-profiles/references/naming.md

@@ -46,12 +46,17 @@ to the first `@`; the target half is a label except for reserved forms:
 
 - `@base` — a non-instantiated product root. `@base` is convention; a base is really identified by
   `instantiation: "false"` and no `setting_id` ([the three-part shape](filament-profiles.md#the-three-part-shape)).
-- `@System` — the OrcaFilamentLibrary selectable shim. The literal `Generic <mat> @System` is
-  load-bearing for 3MF/project recovery, beyond the alias rule ([alias shadowing](filament-profiles.md#alias-shadowing)).
+- `@System` — the OrcaFilamentLibrary selectable shim, and the convention for an all-printer product
+  (`<Product> @System`, empty `compatible_printers`); not enforced, so a deviation is worth a review
+  comment. The literal `Generic <mat> @System` is load-bearing for 3MF/project recovery, beyond the
+  alias rule ([alias shadowing](filament-profiles.md#alias-shadowing)).
 - `@<Vendor>`, `@<Vendor> <Model>`, `@<Vendor> <Model> <nozzle> nozzle` — printer tunes, BBL's shape.
   Other vendors differ (a bare model, a printer serial, Creality's `@<Model>-all`). Specificity is judged
   from `compatible_printers`, not the name
   ([one variant, one profile](filament-profiles.md#overlapping-coverage-one-variant-one-profile-per-product)).
+- Color is not part of the product name: `<Product> <Color>` presets are not authored; the color is
+  chosen at runtime
+  ([color is a runtime property](filament-profiles.md#color-is-a-runtime-property)).
 
 ## Not the same as the filename
 

.claude/skills/orca-profiles/references/review-checklist.md

@@ -15,6 +15,7 @@ The table highlights gaps that need human review. What CI *does* run:
 | Whether the intended default survived compatibility selection | The sweep can select a different compatible preset |
 | A dangling `compatible_printers` inside an `instantiation: "false"` base | A base never becomes a `Preset`, so the reference check never sees it (a bad `inherits` in a base *is* caught) |
 | A `renamed_from` whose old name is still a live preset | The redirect is inert while a live preset carries that name |
+| A preset differentiated only by color, or an all-printer library preset without `@System` | Per-color presets split one product across ids and the selector fills with near-duplicates; CI stays green |
 | Per-extruder vector length on a multi-nozzle printer | Silently padded (with the **first** value) or truncated |
 
 ## 1. Was the vendor `version` bumped?

resources/web/dialog/WebDialog/blank.html

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<!-- Bootstrap page for PluginWebDialog. The real plugin HTML is loaded via
+<!-- Bootstrap page for WebDialog. The real plugin HTML is loaded via
      wxWebView::SetPage once this page finishes loading; this file only exists
      to bring the webview up. -->
 <html>

sandboxes/orca_dock_panel_plugin_any.py

@@ -0,0 +1,146 @@
+# /// script
+# requires-python = ">=3.12"
+#
+# [tool.orcaslicer.plugin]
+# name = "Dock Panel Demo"
+# description = "Opens a dockable panel beside the 3D view that lists the objects on the plate."
+# author = "OrcaSlicer"
+# version = "0.0.1"
+# ///
+"""Dock Panel Demo -- orca.host.ui.create_dock_panel().
+
+Run it from the Plugins dialog. It opens an HTML panel docked on the right of the 3D view, in the
+same dock area as the sidebar. Drag its caption to dock it on another side (or float it, where the
+platform allows), hide it from the page and run the plugin again to bring it back, or close it with
+its close button or from the page.
+
+  page   --orca.postMessage({command: 'refresh'})-->  plugin.on_message()
+  page   --orca.postMessage({command: 'hide'})-->     plugin.on_message() -> panel.hide()
+  page   --orca.close()-->                            panel closes, plugin.on_close()
+  plugin --panel.post({command: 'objects', ...})-->   page (orca.onMessage)
+"""
+import orca
+
+PAGE = """
+<style>
+  body { margin: 0; padding: 12px; font-size: 13px; }
+  h3 { margin: 0 0 4px; font-size: 14px; }
+  .note { margin: 0 0 12px; color: var(--orca-muted); font-size: 12px; }
+  .actions { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 12px; }
+  .actions button.quiet { background: transparent; color: var(--orca-fg); border-color: var(--orca-border); }
+  table { width: 100%; border-collapse: collapse; }
+  td.count { text-align: right; font-variant-numeric: tabular-nums; }
+  #status { margin-top: 10px; color: var(--orca-muted); font-size: 12px; }
+</style>
+
+<h3>Objects on the plate</h3>
+<p class="note">Docked beside the 3D view. Drag the caption to move it.</p>
+
+<div class="actions">
+  <button type="button" id="refresh">Refresh</button>
+  <button type="button" id="hide" class="quiet">Hide</button>
+  <button type="button" id="close" class="quiet">Close</button>
+</div>
+
+<table>
+  <thead><tr><th>Name</th><th>Parts</th><th>Copies</th></tr></thead>
+  <tbody id="rows"></tbody>
+</table>
+<p id="status">Waiting for the plugin...</p>
+
+<script>
+(function () {
+  function text(value) {
+    var span = document.createElement("span");
+    span.textContent = value;
+    return span.innerHTML;
+  }
+
+  function render(message) {
+    var rows = document.getElementById("rows");
+    var status = document.getElementById("status");
+    if (message.error) {
+      rows.innerHTML = "";
+      status.textContent = message.error;
+      return;
+    }
+    rows.innerHTML = message.objects.map(function (object) {
+      return "<tr><td>" + text(object.name) + "</td><td class=\\"count\\">" + object.volumes +
+             "</td><td class=\\"count\\">" + object.instances + "</td></tr>";
+    }).join("");
+    status.textContent = message.objects.length + " object(s), refreshed " + new Date().toLocaleTimeString();
+  }
+
+  orca.onMessage(function (message) {
+    if (message && message.command === "objects")
+      render(message);
+  });
+
+  document.getElementById("refresh").addEventListener("click", function () {
+    orca.postMessage({ command: "refresh" });
+  });
+  document.getElementById("hide").addEventListener("click", function () {
+    orca.postMessage({ command: "hide" });
+  });
+  document.getElementById("close").addEventListener("click", function () {
+    orca.close();
+  });
+
+  orca.postMessage({ command: "refresh" });
+})();
+</script>
+"""
+
+
+def plate_objects():
+    try:
+        model = orca.host.model()
+    except RuntimeError as error:
+        return {"command": "objects", "error": str(error)}
+    return {
+        "command": "objects",
+        "objects": [
+            {"name": obj.name or "(unnamed)", "volumes": obj.volume_count(), "instances": obj.instance_count()}
+            for obj in model.objects()
+        ],
+    }
+
+
+class DockPanelDemo(orca.script.ScriptPluginCapabilityBase):
+    panel = None
+
+    def get_name(self):
+        return "Dock Panel Demo"
+
+    def execute(self):
+        # The capability instance lives as long as the plugin, so a second run finds the open panel.
+        if self.panel is not None and self.panel.is_open():
+            self.panel.show()
+            return orca.ExecutionResult.success("Dock Panel Demo is already open.")
+        self.panel = orca.host.ui.create_dock_panel(
+            html=PAGE,
+            title="Dock Panel Demo",
+            width=320,
+            height=480,
+            on_message=self.on_message,
+            on_close=self.on_close,
+            dock="right",
+        )
+        return orca.ExecutionResult.success("Dock Panel Demo opened.")
+
+    # Called on the UI thread when the page posts.
+    def on_message(self, message):
+        command = (message or {}).get("command")
+        if command == "refresh":
+            self.panel.post(plate_objects())
+        elif command == "hide":
+            self.panel.hide()
+
+    def on_close(self):
+        self.panel = None
+
+
+@orca.plugin
+class DockPanelDemoPlugin(orca.base):
+    def register_capabilities(self):
+        orca.register_capability(DockPanelDemo)

src/libslic3r/AppConfig.cpp

@@ -5,6 +5,7 @@
 //BBS
 #include "Preset.hpp"
 #include "Exception.hpp"
+#include "InstanceLock.hpp"
 #include "LocalesUtils.hpp"
 #include "Thread.hpp"
 #include "format.hpp"
@@ -734,6 +735,9 @@ std::string AppConfig::load()
 {
     json j;
 
+    // Keep another instance from replacing or restoring the file mid-read.
+    InstanceLock instance_lock(lock_path());
+
     // 1) Read the complete config file into a boost::property_tree.
     namespace pt = boost::property_tree;
     pt::ptree tree;
@@ -983,6 +987,7 @@ void AppConfig::save()
     // The config is first written to a file with a PID suffix and then moved
     // to avoid race conditions with multiple instances of Slic3r
     const auto path = config_path();
+    InstanceLock instance_lock(lock_path());
     std::string path_pid = (boost::format("%1%.%2%") % path % get_current_pid()).str();
 
     json j;
@@ -1142,7 +1147,8 @@ void AppConfig::save()
     // Rename the config atomically.
     // On Windows, the rename is likely NOT atomic, thus it may fail if PrusaSlicer crashes on another thread in the meanwhile.
     // To cope with that, we already made a backup of the config on Windows.
-    rename_file(path_pid, path);
+    if (const std::error_code ec = rename_file(path_pid, path))
+        BOOST_LOG_TRIVIAL(error) << "Failed to replace " << path << " with the new configuration: " << ec.message();
     m_dirty = false;
 }
 
@@ -1150,6 +1156,9 @@ void AppConfig::save()
 
 std::string AppConfig::load()
 {
+    // Keep another instance from replacing or restoring the file mid-read.
+    InstanceLock instance_lock(lock_path());
+
     // 1) Read the complete config file into a boost::property_tree.
     namespace pt = boost::property_tree;
     pt::ptree tree;
@@ -1287,6 +1296,7 @@ void AppConfig::save()
     // The config is first written to a file with a PID suffix and then moved
     // to avoid race conditions with multiple instances of Slic3r
     const auto path = config_path();
+    InstanceLock instance_lock(lock_path());
     std::string path_pid = (boost::format("%1%.%2%") % path % get_current_pid()).str();
 
     std::stringstream config_ss;
@@ -1351,7 +1361,8 @@ void AppConfig::save()
     // Rename the config atomically.
     // On Windows, the rename is likely NOT atomic, thus it may fail if PrusaSlicer crashes on another thread in the meanwhile.
     // To cope with that, we already made a backup of the config on Windows.
-    rename_file(path_pid, path);
+    if (const std::error_code ec = rename_file(path_pid, path))
+        BOOST_LOG_TRIVIAL(error) << "Failed to replace " << path << " with the new configuration: " << ec.message();
     m_dirty = false;
 }
 #endif
@@ -1844,6 +1855,11 @@ void AppConfig::reset_selections()
     }
 }
 
+std::string AppConfig::lock_path()
+{
+    return Slic3r::data_dir().empty() ? std::string() : config_path() + ".lock";
+}
+
 std::string AppConfig::config_path()
 {
 #ifdef USE_JSON_CONFIG

src/libslic3r/AppConfig.hpp

@@ -338,6 +338,8 @@ public:
 
 	// Get the default config path from Slic3r::data_dir().
 	std::string			config_path();
+	// Lock file guarding config_path() against other running instances; empty without a data dir.
+	std::string			lock_path();
 
 	// Returns true if the user's data directory comes from before Slic3r 1.40.0 (no updating)
 	bool 				legacy_datadir() const { return m_legacy_datadir; }

src/libslic3r/CMakeLists.txt

@@ -304,6 +304,8 @@ set(lisbslic3r_sources
     Geometry/VoronoiUtils.cpp
     Geometry/VoronoiUtils.hpp
     Geometry/VoronoiVisualUtils.hpp
+    InstanceLock.cpp
+    InstanceLock.hpp
     Int128.hpp
     KDTreeIndirect.hpp
     Layer.cpp

src/libslic3r/Config.cpp

@@ -1522,12 +1522,10 @@ void ConfigBase::save_to_json(const std::string &file, const std::string &name,
     // Serialize first: if that throws (invalid UTF-8), the existing file stays untouched.
     std::ostringstream ss;
     this->save_to_json(ss, name, from, version);
-    boost::nowide::ofstream c;
-    c.open(file, std::ios::out | std::ios::trunc);
-    c << ss.str();
-    c.close();
-
-    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << ":" <<__LINE__ << boost::format(", saved config to %1%\n")%file;
+    if (const std::error_code ec = write_file_atomically(file, ss.str()))
+        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << boost::format(": failed to save config to %1%: %2%") % file % ec.message();
+    else
+        BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << ":" <<__LINE__ << boost::format(", saved config to %1%\n")%file;
 }
 
 void ConfigBase::save_to_json(std::ostream &os, const std::string &name, const std::string &from, const std::string &version, bool replace_invalid_utf8) const

src/libslic3r/InstanceLock.cpp

@@ -0,0 +1,101 @@
+#include "InstanceLock.hpp"
+
+#include <map>
+#include <memory>
+#include <mutex>
+#include <thread>
+
+#include <boost/interprocess/sync/file_lock.hpp>
+#include <boost/log/trivial.hpp>
+#include <boost/nowide/fstream.hpp>
+#ifdef _WIN32
+#include <boost/nowide/convert.hpp>
+#endif
+
+namespace Slic3r {
+
+// One slot per lock file, shared by every guard in the process. A POSIX fcntl
+// lock is owned by the process, not the thread or descriptor, so a single
+// file_lock per path behind a mutex is what makes the guard re-entrant and
+// safe to use from the preset sync thread and the GUI thread at once.
+struct InstanceLock::Slot
+{
+    std::recursive_mutex mutex;
+    // Absent when the lock file could not be created or opened.
+    std::unique_ptr<boost::interprocess::file_lock> file_lock;
+    int  depth{0};
+    bool file_locked{false};
+};
+
+InstanceLock::Slot &InstanceLock::slot_for(const std::string &lock_file_path)
+{
+    static std::mutex registry_mutex;
+    // Never freed: the slots keep the lock files open for as long as anything
+    // in the process may still save, including during static destruction.
+    static auto *registry = new std::map<std::string, std::unique_ptr<Slot>>();
+
+    std::lock_guard<std::mutex> guard(registry_mutex);
+    std::unique_ptr<Slot> &slot = (*registry)[lock_file_path];
+    if (! slot) {
+        slot = std::make_unique<Slot>();
+        try {
+            // file_lock only opens existing files.
+            boost::nowide::ofstream(lock_file_path, std::ios::app).close();
+#ifdef _WIN32
+            slot->file_lock = std::make_unique<boost::interprocess::file_lock>(boost::nowide::widen(lock_file_path).c_str());
+#else
+            slot->file_lock = std::make_unique<boost::interprocess::file_lock>(lock_file_path.c_str());
+#endif
+        } catch (const std::exception &e) {
+            BOOST_LOG_TRIVIAL(warning) << "Cannot open lock file " << lock_file_path << ": " << e.what()
+                                       << "; other instances are not excluded from writing";
+        }
+    }
+    return *slot;
+}
+
+InstanceLock::InstanceLock(const std::string &lock_file_path, std::chrono::milliseconds timeout)
+{
+    if (lock_file_path.empty())
+        return;
+    m_slot = &slot_for(lock_file_path);
+    m_slot->mutex.lock();
+    if (m_slot->depth++ == 0 && m_slot->file_lock) {
+        const auto deadline = std::chrono::steady_clock::now() + timeout;
+        for (;;) {
+            try {
+                if (m_slot->file_lock->try_lock()) {
+                    m_slot->file_locked = true;
+                    break;
+                }
+            } catch (const std::exception &e) {
+                BOOST_LOG_TRIVIAL(warning) << "Cannot lock " << lock_file_path << ": " << e.what();
+                break;
+            }
+            if (std::chrono::steady_clock::now() >= deadline) {
+                BOOST_LOG_TRIVIAL(warning) << "Another instance has held " << lock_file_path << " for over "
+                                           << timeout.count() << " ms; writing without the lock";
+                break;
+            }
+            std::this_thread::sleep_for(std::chrono::milliseconds(5));
+        }
+    }
+    m_locked = m_slot->file_locked;
+}
+
+InstanceLock::~InstanceLock()
+{
+    if (m_slot == nullptr)
+        return;
+    if (--m_slot->depth == 0 && m_slot->file_locked) {
+        try {
+            m_slot->file_lock->unlock();
+        } catch (const std::exception &e) {
+            BOOST_LOG_TRIVIAL(warning) << "Cannot unlock instance lock: " << e.what();
+        }
+        m_slot->file_locked = false;
+    }
+    m_slot->mutex.unlock();
+}
+
+} // namespace Slic3r

src/libslic3r/InstanceLock.hpp

@@ -0,0 +1,42 @@
+#pragma once
+
+#include <chrono>
+#include <string>
+
+namespace Slic3r {
+
+// Scoped write lock on a file shared by every running instance of the
+// application, such as the app config or the user preset directory. Threads
+// of this process are serialised through a recursive mutex, other processes
+// through an advisory OS file lock on `lock_file_path`, created on first use.
+// The OS releases the file lock when its holder exits, so a crashed instance
+// never leaves a stale lock behind.
+//
+// The lock is best effort: when the lock file cannot be created, or another
+// instance still holds it after `timeout`, the guard keeps only the in-process
+// mutex and locked() reports false. Writes then proceed unprotected rather than
+// letting one hung instance block every other one from saving.
+class InstanceLock
+{
+public:
+    static constexpr std::chrono::milliseconds default_timeout{2000};
+
+    // An empty path makes the guard a no-op.
+    explicit InstanceLock(const std::string &lock_file_path, std::chrono::milliseconds timeout = default_timeout);
+    ~InstanceLock();
+
+    InstanceLock(const InstanceLock &) = delete;
+    InstanceLock &operator=(const InstanceLock &) = delete;
+
+    // True while this process holds the cross-process file lock.
+    bool locked() const { return m_locked; }
+
+private:
+    struct Slot;
+    static Slot &slot_for(const std::string &lock_file_path);
+
+    Slot *m_slot{nullptr};
+    bool  m_locked{false};
+};
+
+} // namespace Slic3r

src/libslic3r/Preset.cpp

@@ -48,6 +48,9 @@
 
 #include "libslic3r.h"
 #include "Utils.hpp"
+#include "InstanceLock.hpp"
+
+#include <sstream>
 #include "Time.hpp"
 #include "PlaceholderParser.hpp"
 #include "libslic3r/GCode/Thumbnails.hpp"
@@ -104,6 +107,11 @@ std::string get_preset_canonical_name(const std::string &preset_bare_name, const
     }
 }
 
+std::string user_presets_lock_path()
+{
+    return data_dir().empty() ? std::string() : (fs::path(data_dir()) / (PRESET_USER_DIR ".lock")).string();
+}
+
 std::string get_preset_bare_name(const std::string &canonical_name)
 {
     const auto pos = canonical_name.find_last_of('/');
@@ -603,6 +611,7 @@ Preset::Type Preset::get_type_from_string(std::string type_str)
 
 void Preset::load_info(const std::string& file)
 {
+    InstanceLock instance_lock(user_presets_lock_path());
     try {
         boost::property_tree::ptree tree;
         boost::nowide::ifstream ifs(file);
@@ -646,18 +655,20 @@ void Preset::save_info(std::string file)
         file = idx_file.string();
     }
 
-    boost::nowide::ofstream c;
-    c.open(file, std::ios::out | std::ios::trunc);
     std::string sync_info_to_save;
     //BBS: hold is used for stop requesting to server this time
     if (this->sync_info.compare("hold") != 0)
         sync_info_to_save = this->sync_info;
+    std::ostringstream c;
     c << "sync_info" << " = " << sync_info_to_save << std::endl;
     c << "user_id" << " = " << this->user_id << std::endl;
     c << "setting_id" << " = " << this->setting_id << std::endl;
     c << "base_id" << " = " << this->base_id << std::endl;
     c << "updated_time" << " = " << std::to_string(this->updated_time) << std::endl;
-    c.close();
+
+    InstanceLock instance_lock(user_presets_lock_path());
+    if (const std::error_code ec = write_file_atomically(file, c.str()))
+        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << ": failed to save " << file << ": " << ec.message();
 }
 
 void Preset::remove_files(bool cloud_already_deleted)
@@ -666,6 +677,7 @@ void Preset::remove_files(bool cloud_already_deleted)
     if (this->is_project_embedded) {
         return;
     }
+    InstanceLock instance_lock(user_presets_lock_path());
     // Erase the preset file.
     boost::nowide::remove(this->file.c_str());
     fs::path idx_path(this->file);
@@ -702,6 +714,7 @@ void Preset::save(DynamicPrintConfig* parent_config)
     else
         from_str = std::string("Default");
 
+    InstanceLock instance_lock(user_presets_lock_path());
     boost::filesystem::create_directories(fs::path(this->file).parent_path());
     const std::string bare_name = get_preset_bare_name(this->name);
 
@@ -1704,6 +1717,8 @@ void PresetCollection::load_presets(
     std::set<std::string> *key_set1 = nullptr, *key_set2 = nullptr;
     Preset::get_extruder_names_and_keysets(m_type, extruder_id_name, extruder_variant_name, &key_set1, &key_set2);
 
+    // Held across the scan so no instance replaces or removes a file mid-read.
+    InstanceLock instance_lock(user_presets_lock_path());
     //BBS: change to json format
     for (auto &dir_entry : boost::filesystem::directory_iterator(dir))
     {

src/libslic3r/Preset.hpp

@@ -484,6 +484,10 @@ std::string get_preset_canonical_name(const std::string &preset_bare_name, const
 // Tail segment of a canonical name — what's written to the bundle's .json filename and JSON "name" field.
 std::string get_preset_bare_name(const std::string &canonical_name);
 
+// Lock file guarding every user preset file under data_dir() against other
+// running instances and the preset sync thread; empty without a data dir.
+std::string user_presets_lock_path();
+
 // Resolve an origin from a directory path when the caller passes Kind::Auto.
 PresetOrigin detect_origin_from_path(const boost::filesystem::path &path, const PresetOrigin &explicit_origin = PresetOrigin());
 

src/libslic3r/PresetBundle.cpp

@@ -12,6 +12,7 @@
 #include "libslic3r.h"
 #include "I18N.hpp"
 #include "Utils.hpp"
+#include "InstanceLock.hpp"
 #include "LocalesUtils.hpp"
 #include "Model.hpp"
 #include "TriangleSelector.hpp"
@@ -2231,6 +2232,7 @@ void PresetBundle::remove_user_presets_directory(const std::string preset_folder
         return;
     }
     BOOST_LOG_TRIVIAL(debug) << __FUNCTION__ << boost::format(" enter, delete directory : %1%") % dir_user_presets;
+    InstanceLock instance_lock(user_presets_lock_path());
     fs::path folder(dir_user_presets);
     if (fs::exists(folder)) {
         fs::remove_all(folder);
@@ -7867,6 +7869,7 @@ bool PresetBundle::check_duplicate_filament_subtypes() const
 // Orca: BundleMetadata method implementations
 bool BundleMetadata::load_from_json(const std::string& path)
 {
+    InstanceLock instance_lock(user_presets_lock_path());
     try {
         boost::nowide::ifstream ifs(path);
         if (!ifs.good())
@@ -7928,13 +7931,16 @@ bool BundleMetadata::save_to_json(const std::string& path) const
         j["imported_time"] = this->imported_time;
         j["updated_time"] = this->updated_time;
 
+        InstanceLock instance_lock(user_presets_lock_path());
         j["print_presets"] = strip_prefix(this->print_presets);                                                                                                                                                                                                                             
         j["filament_presets"] = strip_prefix(this->filament_presets);                                                                                                                                                                                                                       
         j["printer_presets"] = strip_prefix(this->printer_presets);
 
-        boost::nowide::ofstream ofs(path);
-        ofs << j.dump(4);
-        return ofs.good();
+        if (const std::error_code ec = write_file_atomically(path, j.dump(4))) {
+            BOOST_LOG_TRIVIAL(error) << "Failed to save bundle metadata to " << path << ": " << ec.message();
+            return false;
+        }
+        return true;
     } catch (const std::exception& e) {
         BOOST_LOG_TRIVIAL(error) << "Failed to save bundle metadata to " << path << ": " << e.what();
         return false;

src/libslic3r/Utils.hpp

@@ -224,6 +224,10 @@ extern std::vector<std::string> split_string(const std::string &str, char delimi
 // On Windows, the file explorer (or anti-virus or whatever else) often locks the file
 // for a short while, so the file may not be movable. Retry while we see recoverable errors.
 extern std::error_code rename_file(const std::string &from, const std::string &to);
+// Write `content` to `path` through a temporary file beside it that is then renamed
+// over the target, so a concurrent reader sees the old or the new file, never a
+// partial one. The temporary file is removed on failure.
+extern std::error_code write_file_atomically(const std::string &path, const std::string &content);
 
 enum CopyFileResult {
 	SUCCESS = 0,

src/libslic3r/utils.cpp

@@ -9,6 +9,7 @@
 #include <stdio.h>
 #include <filesystem>
 #include <sstream>
+#include <cerrno>
 #include <iomanip>
 #include <algorithm>
 #include <cmath>
@@ -704,11 +705,30 @@ std::error_code rename_file(const std::string &from, const std::string &to)
 #ifdef _WIN32
 	return WindowsSupport::rename(from, to);
 #else
-	boost::nowide::remove(to.c_str());
-	return std::make_error_code(static_cast<std::errc>(boost::nowide::rename(from.c_str(), to.c_str())));
+	// rename(2) replaces an existing target atomically; removing it first would
+	// leave a window in which the file does not exist at all.
+	return std::make_error_code(static_cast<std::errc>(boost::nowide::rename(from.c_str(), to.c_str()) == 0 ? 0 : errno));
 #endif
 }
 
+std::error_code write_file_atomically(const std::string &path, const std::string &content)
+{
+	const std::string tmp_path = path + "." + std::to_string(get_current_pid()) + ".tmp";
+	{
+		boost::nowide::ofstream out(tmp_path, std::ios::out | std::ios::trunc);
+		out << content;
+		out.close();
+		if (out.fail()) {
+			boost::nowide::remove(tmp_path.c_str());
+			return std::make_error_code(std::errc::io_error);
+		}
+	}
+	std::error_code ec = rename_file(tmp_path, path);
+	if (ec)
+		boost::nowide::remove(tmp_path.c_str());
+	return ec;
+}
+
 #ifdef __linux__
 // Copied from boost::filesystem.
 // Called by copy_file_linux() in case linux sendfile() API is not supported.

src/slic3r/CMakeLists.txt

@@ -139,8 +139,16 @@ set(SLIC3R_GUI_SOURCES
     GUI/TerminalDialog.hpp
     GUI/PluginProgressDialog.cpp
     GUI/PluginProgressDialog.hpp
-    GUI/PluginWebDialog.cpp
-    GUI/PluginWebDialog.hpp
+    GUI/WebDialog.cpp
+    GUI/WebDialog.hpp
+    GUI/DockPanel.cpp
+    GUI/DockPanel.hpp
+    GUI/WebPanel.cpp
+    GUI/WebPanel.hpp
+    GUI/Widgets/WebHosting.cpp
+    GUI/Widgets/WebHosting.hpp
+    GUI/AuiPaneLayout.cpp
+    GUI/AuiPaneLayout.hpp
     GUI/DragCanvas.cpp
     GUI/DragCanvas.hpp
     GUI/EditGCodeDialog.cpp

src/slic3r/GUI/AuiPaneLayout.cpp

@@ -0,0 +1,20 @@
+#include "AuiPaneLayout.hpp"
+
+namespace Slic3r { namespace GUI {
+
+std::string aui_pane_layout_entry(const std::string& layout, const std::string& pane_name)
+{
+    // Panes are separated by '|'; SavePerspective() escapes a '|' inside a caption as "\|".
+    const std::string prefix = "name=" + pane_name + ";";
+    size_t            begin  = 0;
+    for (size_t i = 0; i <= layout.size(); ++i) {
+        if (i < layout.size() && (layout[i] != '|' || (i > 0 && layout[i - 1] == '\\')))
+            continue;
+        if (layout.compare(begin, prefix.size(), prefix) == 0)
+            return layout.substr(begin, i - begin);
+        begin = i + 1;
+    }
+    return {};
+}
+
+}} // namespace Slic3r::GUI

src/slic3r/GUI/AuiPaneLayout.hpp

@@ -0,0 +1,11 @@
+#pragma once
+
+#include <string>
+
+namespace Slic3r { namespace GUI {
+
+// The part a wxAuiManager layout string (wxAuiManager::SavePerspective) holds for `pane_name`, in the
+// form wxAuiManager::LoadPaneInfo() takes, or empty when the layout has no such pane.
+std::string aui_pane_layout_entry(const std::string& layout, const std::string& pane_name);
+
+}} // namespace Slic3r::GUI

src/slic3r/GUI/DockPanel.cpp

@@ -0,0 +1,103 @@
+#include "DockPanel.hpp"
+
+#include "GUI_App.hpp"
+#include "Plater.hpp"
+#include "Widgets/WebHosting.hpp"
+
+#include <wx/weakref.h>
+
+#include <algorithm>
+#include <utility>
+
+namespace Slic3r { namespace GUI {
+
+std::string plugin_pane_name(const std::string& plugin_key, const std::string& title)
+{
+    std::string name = "plugin:" + plugin_key + ":" + title;
+    std::replace_if(name.begin(), name.end(), [](char c) { return c == '|' || c == ';' || c == '=' || c == '\\'; }, '_');
+    return name;
+}
+
+DockPanel::DockPanel(wxWindow*          parent,
+                     const std::string& html,
+                     MessageHandler     on_message,
+                     CloseHandler       on_close,
+                     CloseHandler       on_destroyed)
+    : WebPanel(parent, web_hosting::orca_bridge_script())
+    , m_html(html)
+    , m_on_message(std::move(on_message))
+    , m_on_close(std::move(on_close))
+    , m_on_destroyed(std::move(on_destroyed))
+{
+    // A link asking for a new window has nowhere to open from a docked panel.
+    browser()->Bind(wxEVT_WEBVIEW_NEWWINDOW, [](wxWebViewEvent& event) { event.Veto(); });
+}
+
+DockPanel::~DockPanel()
+{
+    if (m_on_destroyed)
+        m_on_destroyed();
+}
+
+bool DockPanel::on_page_message(const std::string& kind, const nlohmann::json& data)
+{
+    if (kind == "message") {
+        if (m_on_message)
+            m_on_message(data);
+        return true;
+    }
+    if (kind == "close") {
+        request_close();
+        return true;
+    }
+    return false;
+}
+
+void DockPanel::push_message(const nlohmann::json& data)
+{
+    if (!m_closing)
+        post_to_page(data.dump(-1, ' ', false, nlohmann::json::error_handler_t::replace));
+}
+
+void DockPanel::fire_close()
+{
+    if (m_closing)
+        return;
+    m_closing = true;
+    if (m_on_close) {
+        CloseHandler on_close = std::move(m_on_close);
+        m_on_close            = nullptr;
+        on_close();
+    }
+}
+
+void DockPanel::request_close()
+{
+    if (m_closing)
+        return;
+    fire_close();
+    // A page-requested close arrives inside the web view's script callback, so destroy later; another
+    // close path may have destroyed the panel by then.
+    wxWeakRef<DockPanel> self(this);
+    CallAfter([self]() {
+        if (self)
+            self->remove_pane();
+    });
+}
+
+void DockPanel::destroy_silently()
+{
+    m_closing  = true;
+    m_on_close = nullptr;
+    remove_pane();
+}
+
+void DockPanel::remove_pane()
+{
+    if (Plater* plater = wxGetApp().plater())
+        plater->remove_dock_pane(this);
+    else
+        Destroy();
+}
+
+}} // namespace Slic3r::GUI

src/slic3r/GUI/DockPanel.hpp

@@ -0,0 +1,54 @@
+#pragma once
+
+#include "WebPanel.hpp"
+
+#include <functional>
+#include <string>
+
+namespace Slic3r { namespace GUI {
+
+// Stable across sessions so the saved layout finds the pane; free of wxAuiManager layout delimiters.
+std::string plugin_pane_name(const std::string& plugin_key, const std::string& title);
+
+// A WebPanel docked in the Plater, on the plugin-window bridge minus submit. It can be destroyed
+// without the GIL, so its hooks must not capture pybind11 objects.
+class DockPanel : public WebPanel
+{
+public:
+    using MessageHandler = std::function<void(const nlohmann::json& data)>;
+    using CloseHandler   = std::function<void()>;
+
+    // on_close fires once, on a user or page close. on_destroyed runs on every destruction and must
+    // touch host-side state only.
+    DockPanel(wxWindow*          parent,
+              const std::string& html,
+              MessageHandler     on_message,
+              CloseHandler       on_close,
+              CloseHandler       on_destroyed);
+    ~DockPanel() override;
+
+    // Main thread only.
+    void push_message(const nlohmann::json& data);
+    // Fires on_close, then removes the pane.
+    void request_close();
+    // Removes the pane without on_close, for plugin unload. Destroys at once: unload always comes from
+    // the host, never from this panel's own callbacks.
+    void destroy_silently();
+    // Fires on_close at most once; also run by the pane's own close button.
+    void fire_close();
+
+protected:
+    std::optional<std::string> page_html() override { return m_html; }
+    bool on_page_message(const std::string& kind, const nlohmann::json& data) override;
+
+private:
+    void remove_pane();
+
+    std::string    m_html;
+    bool           m_closing{false};
+    MessageHandler m_on_message;
+    CloseHandler   m_on_close;
+    CloseHandler   m_on_destroyed;
+};
+
+}} // namespace Slic3r::GUI

src/slic3r/GUI/GUI_App.cpp

@@ -85,6 +85,7 @@
 #include "libslic3r/Model.hpp"
 #include "libslic3r/I18N.hpp"
 #include "libslic3r/PresetBundle.hpp"
+#include "libslic3r/InstanceLock.hpp"
 #include "libslic3r/Thread.hpp"
 #include "libslic3r/miniz_extension.hpp"
 #include "libslic3r/Utils.hpp"
@@ -7624,7 +7625,10 @@ void GUI_App::start_sync_user_preset(bool with_progress_dlg)
                             // Delete the bundle folder and bundle
                             fs::path bundle_folder = fs::path(bundle.path.c_str()).parent_path();
                             boost::system::error_code ec;
-                            boost::filesystem::remove_all(bundle_folder, ec);
+                            {
+                                InstanceLock instance_lock(user_presets_lock_path());
+                                boost::filesystem::remove_all(bundle_folder, ec);
+                            }
 
                             preset_bundle->bundles.WriteLock();
                             preset_bundle->bundles.m_bundles.erase(bundle.id);
@@ -8889,6 +8893,7 @@ void GUI_App::preset_deleted_from_cloud(std::string setting_id)
 
     // Delete the .info file after cloud deletion is confirmed
     if (!preset_file_path.empty() && fs::exists(fs::path(preset_file_path))) {
+        InstanceLock instance_lock(user_presets_lock_path());
         boost::nowide::remove(preset_file_path.c_str());
         BOOST_LOG_TRIVIAL(info) << "Deleted .info file after cloud confirmation: " << preset_file_path;
     }

src/slic3r/GUI/MainFrame.cpp

@@ -1189,6 +1189,8 @@ void MainFrame::shutdown()
     if (m_project != nullptr)
         m_project->shutdown();
     m_plugin_pages.shutdown();
+    if (m_plater != nullptr)
+        m_plater->remove_dock_panes();
 #ifdef __WXGTK__
     // Edge panels are child windows — wxWidgets destroys them automatically.
     m_edge_bottom = nullptr;

src/slic3r/GUI/Plater.cpp

@@ -87,6 +87,7 @@
 #ifdef __WXGTK__
 #include "LinuxDisplayBackend.hpp"
 #endif
+#include "AuiPaneLayout.hpp"
 #include "GUI_Utils.hpp"
 #include "GUI_Factories.hpp"
 #include "wxExtensions.hpp"
@@ -6748,6 +6749,14 @@ struct Plater::priv
 
     // GUI elements
     AuiMgr m_aui_mgr;
+    // Live dock panes. `on_close` runs when the user closes one from its close button; `shown` is
+    // what the owner asked for.
+    struct DockPane
+    {
+        std::function<void()> on_close;
+        bool                  shown{true};
+    };
+    std::map<wxWindow*, DockPane> m_dock_panes;
     wxString m_default_window_layout;
     wxPanel* current_panel{ nullptr };
     std::vector<wxPanel*> panels;
@@ -6920,6 +6929,11 @@ struct Plater::priv
     void update_sidebar(bool force_update = false);
     void reset_window_layout();
     Sidebar::DockingState get_sidebar_docking_state();
+    void add_dock_pane(wxWindow* window, const std::string& name, const wxString& caption, const std::string& dock,
+                       const wxSize& size, std::function<void()> on_close);
+    void remove_dock_pane(wxWindow* window);
+    void show_dock_pane(wxWindow* window, bool show);
+    bool dock_pane_visible(const DockPane& dock_pane, const wxAuiPaneInfo& pane) const;
 
     bool is_view3D_layers_editing_enabled() const { return (current_panel == view3D) && view3D->get_canvas3d()->is_layers_editing_enabled(); }
 
@@ -7500,6 +7514,18 @@ Plater::priv::priv(Plater *q, MainFrame *main_frame)
     panel_3d->SetSizer(panel_sizer);
     m_aui_mgr.AddPane(panel_3d, wxAuiPaneInfo().Name("main").CenterPane().PaneBorder(false));
 
+    q->Bind(wxEVT_AUI_PANE_CLOSE, [this](wxAuiManagerEvent& evt) {
+        const wxAuiPaneInfo* pane = evt.GetPane();
+        auto                 it   = pane != nullptr ? m_dock_panes.find(pane->window) : m_dock_panes.end();
+        if (it != m_dock_panes.end()) {
+            const std::function<void()> on_close = std::move(it->second.on_close);
+            m_dock_panes.erase(it);
+            if (on_close)
+                on_close();
+        }
+        evt.Skip();
+    });
+
     m_default_window_layout = m_aui_mgr.SavePerspective();
 
     {
@@ -8165,6 +8191,14 @@ void Plater::priv::update_sidebar(bool force_update) {
         }
     }
 
+    for (const auto& [window, dock_pane] : m_dock_panes) {
+        wxAuiPaneInfo& pane = m_aui_mgr.GetPane(window);
+        if (pane.IsOk() && pane.IsShown() != dock_pane_visible(dock_pane, pane)) {
+            pane.Show(!pane.IsShown());
+            needs_update = true;
+        }
+    }
+
     if (needs_update) {
         notification_manager->set_sidebar_collapsed(sidebar.IsShown());
         m_aui_mgr.Update();
@@ -8174,10 +8208,96 @@ void Plater::priv::update_sidebar(bool force_update) {
 void Plater::priv::reset_window_layout()
 {
     m_aui_mgr.LoadPerspective(m_default_window_layout, false);
+    // Loading a layout docks and hides every pane it does not list, and the default layout lists no
+    // dock panes: a floating dock pane is docked again, like the rest of the window.
+    for (const auto& [window, dock_pane] : m_dock_panes)
+        if (wxAuiPaneInfo& pane = m_aui_mgr.GetPane(window); pane.IsOk())
+            pane.Show(dock_pane_visible(dock_pane, pane));
     sidebar_layout.is_collapsed = false;
     update_sidebar(true);
 }
 
+bool Plater::priv::dock_pane_visible(const DockPane& dock_pane, const wxAuiPaneInfo& pane) const
+{
+    // A floating pane is a top-level window, so it does not hide with the Plater on other tabs.
+    return dock_pane.shown && (!pane.IsFloating() || sidebar_layout.show);
+}
+
+void Plater::priv::add_dock_pane(wxWindow* window, const std::string& name, const wxString& caption, const std::string& dock,
+                                 const wxSize& size, std::function<void()> on_close)
+{
+    const wxString base_name   = wxString::FromUTF8(name);
+    wxString       unique_name = base_name;
+    for (int i = 2; m_aui_mgr.GetPane(unique_name).IsOk(); ++i)
+        unique_name = base_name + wxString::Format("#%d", i);
+
+    // A restored layout below already holds pixels.
+    const wxSize  pixels = q->FromDIP(size);
+    wxAuiPaneInfo info;
+    info.Name(unique_name).Caption(caption).BestSize(pixels).FloatingSize(pixels).DestroyOnClose(true);
+    if (dock == "left")
+        info.Left();
+    else if (dock == "bottom")
+        info.Bottom();
+    else
+        info.Right();
+    if (dock == "float")
+        info.Float();
+
+    // Put the pane back where it was the last time the window layout was saved with it open.
+    const std::string saved = aui_pane_layout_entry(wxGetApp().app_config->get("window_layout"), unique_name.utf8_string());
+    if (!saved.empty()) {
+        m_aui_mgr.LoadPaneInfo(wxString::FromUTF8(saved), info);
+        info.Caption(caption).DestroyOnClose(true).Show();
+    }
+
+    // Floating is disabled on Wayland.
+    if ((m_aui_mgr.GetFlags() & wxAUI_MGR_ALLOW_FLOATING) == 0) {
+        info.Dock().Floatable(false);
+        if (info.dock_direction == wxAUI_DOCK_NONE)
+            info.Right();
+    }
+
+    const DockPane& dock_pane = m_dock_panes[window] = DockPane{std::move(on_close)};
+    info.Show(dock_pane_visible(dock_pane, info));
+    m_aui_mgr.AddPane(window, info);
+
+    // wxAUI does not record a dragged sash in best_size, so track the docked size like the sidebar
+    // does, for the saved layout.
+    window->Bind(wxEVT_IDLE, [this, window](wxIdleEvent& evt) {
+        wxAuiPaneInfo& pane = m_aui_mgr.GetPane(window);
+        if (pane.IsOk() && pane.IsShown() && pane.IsDocked() && pane.rect.GetWidth() > 0 && pane.rect.GetHeight() > 0) {
+            const bool horizontal = pane.dock_direction == wxAUI_DOCK_TOP || pane.dock_direction == wxAUI_DOCK_BOTTOM;
+            pane.BestSize(horizontal ? pane.best_size.GetWidth() : pane.rect.GetWidth(),
+                          horizontal ? pane.rect.GetHeight() : pane.best_size.GetHeight());
+        }
+        evt.Skip();
+    });
+
+    m_aui_mgr.Update();
+}
+
+void Plater::priv::remove_dock_pane(wxWindow* window)
+{
+    m_dock_panes.erase(window);
+    if (m_aui_mgr.DetachPane(window))
+        m_aui_mgr.Update();
+    window->Destroy();
+}
+
+void Plater::priv::show_dock_pane(wxWindow* window, bool show)
+{
+    const auto     it   = m_dock_panes.find(window);
+    wxAuiPaneInfo& pane = m_aui_mgr.GetPane(window);
+    if (it == m_dock_panes.end() || !pane.IsOk())
+        return;
+    it->second.shown = show;
+    if (pane.IsShown() == dock_pane_visible(it->second, pane))
+        return;
+    pane.Show(!pane.IsShown());
+    m_aui_mgr.Update();
+}
+
 Sidebar::DockingState Plater::priv::get_sidebar_docking_state() {
     if (!sidebar_layout.is_enabled) {
         return Sidebar::None;
@@ -17772,6 +17892,19 @@ Sidebar::DockingState Plater::get_sidebar_docking_state() const { return p->get_
 
 void Plater::reset_window_layout() { p->reset_window_layout(); }
 
+void Plater::add_dock_pane(wxWindow* window, const std::string& name, const wxString& caption, const std::string& dock,
+                           const wxSize& size, std::function<void()> on_close)
+{
+    p->add_dock_pane(window, name, caption, dock, size, std::move(on_close));
+}
+void Plater::remove_dock_pane(wxWindow* window) { p->remove_dock_pane(window); }
+void Plater::remove_dock_panes()
+{
+    while (!p->m_dock_panes.empty())
+        p->remove_dock_pane(p->m_dock_panes.begin()->first);
+}
+void Plater::show_dock_pane(wxWindow* window, bool show) { p->show_dock_pane(window, show); }
+
 //BBS
 void Plater::select_curr_plate_all() { p->select_curr_plate_all(); }
 void Plater::remove_curr_plate_all() { p->remove_curr_plate_all(); }

src/slic3r/GUI/Plater.hpp

@@ -476,6 +476,17 @@ public:
 
     void reset_window_layout();
 
+    // Dock panes sit alongside the sidebar; `window` must be a child of the Plater. `dock` is
+    // "left", "right", "bottom" or "float", and `size` is in DIPs. A pane closed from its own close
+    // button is destroyed after on_close runs; remove_dock_pane() destroys it without calling on_close.
+    void add_dock_pane(wxWindow* window, const std::string& name, const wxString& caption, const std::string& dock,
+                       const wxSize& size, std::function<void()> on_close);
+    void remove_dock_pane(wxWindow* window);
+    void show_dock_pane(wxWindow* window, bool show);
+    // Removes every dock pane without calling on_close, for MainFrame::shutdown() (app exit and a
+    // language switch), while the Plater and any floating frames still exist.
+    void remove_dock_panes();
+
     // Called after the Preferences dialog is closed and the program settings are saved.
     // Update the UI based on the current preferences.
     void update_ui_from_settings();

src/slic3r/GUI/WebDialog.cpp

@@ -1,80 +1,23 @@
-#include "PluginWebDialog.hpp"
+#include "WebDialog.hpp"
 
-#include "slic3r/GUI/GUI.hpp"
 #include "slic3r/GUI/GUI_App.hpp"
-
-#include <libslic3r/Utils.hpp>
-
-#include <boost/filesystem.hpp>
+#include "slic3r/GUI/Widgets/WebHosting.hpp"
 
 #include <wx/event.h>
-#include <wx/uri.h>
 
 #include <utility>
 
 namespace Slic3r { namespace GUI {
 
-namespace {
-
-// Injected into the top-level page at document start (before the plugin's own
-// scripts). Defines window.orca as the only host surface the page may use. It
-// references window.wx lazily (at call time) so it never races the backend's
-// deferred registration of the "wx" message handler. Guarded against
-// double-injection so it is harmless if also prepended.
-constexpr char ORCA_BRIDGE_JS[] = R"JS(
-(function () {
-  if (window.top !== window.self) return;
-  if (window.orca) return;
-  var handlers = [];
-  function send(kind, data) {
-    try {
-      window.wx.postMessage(JSON.stringify({
-        channel: 'orca', kind: kind, data: (data === undefined ? null : data)
-      }));
-    } catch (e) { /* bridge not ready yet */ }
-  }
-  window.orca = {
-    postMessage: function (d) { send('message', d); },
-    submit:      function (d) { send('submit', d); },
-    close:       function ()  { send('close'); },
-    onMessage:   function (cb) { if (typeof cb === 'function') handlers.push(cb); }
-  };
-  window.__orcaDispatch = function (payload) {
-    var data = payload ? payload.data : null;
-    for (var i = 0; i < handlers.length; i++) {
-      try { handlers[i](data); } catch (e) {}
-    }
-  };
-})();
-)JS";
-
-// file:// base URL for plugin HTML loaded via SetPage, so self-referencing
-// relative URLs resolve against the bundled web resources directory.
-wxString web_base_url()
-{
-    const std::string dir = (boost::filesystem::path(resources_dir()) / "web").make_preferred().string();
-    return wxString("file://") + from_u8(dir) + "/";
-}
-
-// Whether a loaded document is the plugin HTML's own base URL. The web view reports the URL it
-// parsed, so any fragment the page navigated to is ignored and the escaping it applies to what the
-// resources path holds (a space, a non-ASCII character) is undone first.
-bool is_content_url(const wxString& url)
-{
-    return wxURI::Unescape(url.BeforeFirst('#')) == web_base_url();
-}
-
-} // namespace
-
-PluginWebDialog::PluginWebDialog(wxWindow*          parent,
-                                 const wxString&    title,
-                                 const std::string& html,
-                                 const wxSize&      size,
-                                 MessageHandler     on_message,
-                                 SubmitHandler      on_submit,
-                                 CloseHandler       on_close,
-                                 CloseHandler       on_destroyed,
-                                 long               wx_style)
+WebDialog::WebDialog(wxWindow*          parent,
+                     const wxString&    title,
+                     const std::string& html,
+                     const wxSize&      size,
+                     MessageHandler     on_message,
+                     SubmitHandler      on_submit,
+                     CloseHandler       on_close,
+                     CloseHandler       on_destroyed,
+                     long               wx_style)
     : WebViewHostDialog(parent, wxID_ANY, title, wxDefaultPosition, size, wx_style)
     , m_html(html)
     , m_on_message(std::move(on_message))
@@ -84,7 +27,7 @@ PluginWebDialog::PluginWebDialog(wxWindow*          parent,
 {
     // A tiny bundled bootstrap page brings the webview up; the real plugin HTML
     // is swapped in via SetPage once the bootstrap finishes loading.
-    create_webview("web/dialog/PluginWebDialog/blank.html", title, size, wxSize(320, 240));
+    create_webview(web_hosting::BOOTSTRAP_PAGE, title, size, wxSize(320, 240));
 
     // Paint the window/webview in the themed background so there is no white
     // flash before the (transparent) bootstrap page and plugin HTML render.
@@ -96,22 +39,22 @@ PluginWebDialog::PluginWebDialog(wxWindow*          parent,
         // create_webview() via add_user_scripts(); nothing to add here.
         // Swap in the plugin HTML once the bootstrap page settles. Bind ERROR too so a
         // missing/blocked bootstrap resource (e.g. a packaged build) still triggers it.
-        Bind(wxEVT_WEBVIEW_LOADED, &PluginWebDialog::on_bootstrap_event, this, wv->GetId());
-        Bind(wxEVT_WEBVIEW_ERROR, &PluginWebDialog::on_bootstrap_event, this, wv->GetId());
-        Bind(wxEVT_WEBVIEW_NAVIGATED, &PluginWebDialog::on_navigated, this, wv->GetId());
+        Bind(wxEVT_WEBVIEW_LOADED, &WebDialog::on_bootstrap_event, this, wv->GetId());
+        Bind(wxEVT_WEBVIEW_ERROR, &WebDialog::on_bootstrap_event, this, wv->GetId());
+        Bind(wxEVT_WEBVIEW_NAVIGATED, &WebDialog::on_navigated, this, wv->GetId());
     }
-    Bind(wxEVT_CLOSE_WINDOW, &PluginWebDialog::on_close_window, this);
+    Bind(wxEVT_CLOSE_WINDOW, &WebDialog::on_close_window, this);
 }
 
-void PluginWebDialog::add_user_scripts()
+void WebDialog::add_user_scripts()
 {
     if (wxWebView* wv = browser()) {
-        wv->AddUserScript(wxString::FromUTF8(WebViewHostDialog::plugin_defaults_user_script()));
-        wv->AddUserScript(ORCA_BRIDGE_JS);
+        wv->AddUserScript(wxString::FromUTF8(WebViewHostDialog::element_defaults_user_script()));
+        wv->AddUserScript(wxString::FromUTF8(web_hosting::orca_bridge_script()));
     }
 }
 
-PluginWebDialog::~PluginWebDialog()
+WebDialog::~WebDialog()
 {
     // Runs on every destruction path. Deliberately NOT a wxEVT_DESTROY handler:
     // that event is sent from the base ~wxDialog(), after this subclass's members
@@ -121,19 +64,19 @@ PluginWebDialog::~PluginWebDialog()
         m_on_destroyed();
 }
 
-void PluginWebDialog::post_message(PluginWebDialog* dialog, const nlohmann::json& data)
+void WebDialog::post_message(WebDialog* dialog, const nlohmann::json& data)
 {
     if (dialog != nullptr && dialog->is_open())
         dialog->push_message(data);
 }
 
-void PluginWebDialog::request_close(PluginWebDialog* dialog)
+void WebDialog::request_close(WebDialog* dialog)
 {
     if (dialog != nullptr)
         dialog->Close();
 }
 
-void PluginWebDialog::destroy_for_plugin(PluginWebDialog* dialog)
+void WebDialog::destroy_silently(WebDialog* dialog)
 {
     if (dialog == nullptr)
         return;
@@ -147,42 +90,42 @@ void PluginWebDialog::destroy_for_plugin(PluginWebDialog* dialog)
     dialog->Destroy();
 }
 
-void PluginWebDialog::on_bootstrap_event(wxWebViewEvent& event)
+void WebDialog::on_bootstrap_event(wxWebViewEvent& event)
 {
     const bool loaded = event.GetEventType() == wxEVT_WEBVIEW_LOADED;
     // The first bootstrap load (or its error) triggers the swap to plugin HTML.
     if (!m_content_loaded)
-        load_plugin_content();
+        load_page_html();
     // WebKit reloads the SetPage base URL, so a committed load of it that we did not start is a reload.
     // A failed navigation is reported against the page that stayed but never commits. Edge ignores the
     // base URL and restores SetPage content itself, so nothing matches there.
-    else if (is_content_url(event.GetURL())) {
+    else if (web_hosting::is_content_url(event.GetURL())) {
         if (m_own_page_load)
             m_own_page_load = false;
         else if (loaded && m_content_navigated)
-            load_plugin_content();
+            load_page_html();
     }
     if (loaded)
         m_content_navigated = false;
     event.Skip();
 }
 
-void PluginWebDialog::on_navigated(wxWebViewEvent& event)
+void WebDialog::on_navigated(wxWebViewEvent& event)
 {
-    m_content_navigated = is_content_url(event.GetURL());
+    m_content_navigated = web_hosting::is_content_url(event.GetURL());
     event.Skip();
 }
 
-void PluginWebDialog::load_plugin_content()
+void WebDialog::load_page_html()
 {
     m_content_loaded = true;
     if (wxWebView* wv = browser()) {
         m_own_page_load = true;
-        wv->SetPage(wxString::FromUTF8(m_html), web_base_url());
+        wv->SetPage(wxString::FromUTF8(m_html), web_hosting::content_base_url());
     }
 }
 
-void PluginWebDialog::on_script_message(const nlohmann::json& payload)
+void WebDialog::on_script_message(const nlohmann::json& payload)
 {
     if (payload.value("channel", std::string()) == "orca") {
         const std::string    kind = payload.value("kind", std::string());
@@ -202,7 +145,7 @@ void PluginWebDialog::on_script_message(const nlohmann::json& payload)
     handle_common_script_command(payload);
 }
 
-void PluginWebDialog::push_message(const nlohmann::json& data)
+void WebDialog::push_message(const nlohmann::json& data)
 {
     if (!m_open)
         return;
@@ -211,7 +154,7 @@ void PluginWebDialog::push_message(const nlohmann::json& data)
     call_web_handler(envelope, wxT("__orcaDispatch"));
 }
 
-void PluginWebDialog::finish(bool submitted, const nlohmann::json& data)
+void WebDialog::finish(bool submitted, const nlohmann::json& data)
 {
     if (!m_open)
         return;
@@ -230,7 +173,7 @@ void PluginWebDialog::finish(bool submitted, const nlohmann::json& data)
         Close();
 }
 
-void PluginWebDialog::on_close_window(wxCloseEvent&)
+void WebDialog::on_close_window(wxCloseEvent&)
 {
     if (!m_open) {
         // finish() already dispatched submit/close and requested the close.
@@ -250,7 +193,7 @@ void PluginWebDialog::on_close_window(wxCloseEvent&)
     Destroy();
 }
 
-void PluginWebDialog::fire_submit(const nlohmann::json& data)
+void WebDialog::fire_submit(const nlohmann::json& data)
 {
     if (m_on_submit) {
         SubmitHandler cb = std::move(m_on_submit);
@@ -258,7 +201,7 @@ void PluginWebDialog::fire_submit(const nlohmann::json& data)
     }
 }
 
-void PluginWebDialog::fire_close()
+void WebDialog::fire_close()
 {
     if (m_close_fired)
         return;

src/slic3r/GUI/WebDialog.hpp

@@ -1,5 +1,5 @@
-#ifndef slic3r_GUI_PluginWebDialog_hpp_
-#define slic3r_GUI_PluginWebDialog_hpp_
+#ifndef slic3r_GUI_WebDialog_hpp_
+#define slic3r_GUI_WebDialog_hpp_
 
 #include "Widgets/WebViewHostDialog.hpp"
 
@@ -21,7 +21,7 @@ namespace Slic3r { namespace GUI {
 // GIL held; the plugin layer wraps any Python callables in a GIL-safe holder.
 //
 // Usable both modally (ShowModal -> read result()) and modelessly (Show()).
-class PluginWebDialog : public Slic3r::GUI::WebViewHostDialog
+class WebDialog : public Slic3r::GUI::WebViewHostDialog
 {
 public:
     using MessageHandler = std::function<void(const nlohmann::json& data)>;
@@ -32,20 +32,20 @@ public:
     // user/JS-initiated close (while the window is alive). on_destroyed runs from
     // the destructor on every path and must touch host-side state only (no Python
     // / no derived members).
-    PluginWebDialog(wxWindow*          parent,
-                    const wxString&    title,
-                    const std::string& html,
-                    const wxSize&      size,
-                    MessageHandler     on_message,
-                    SubmitHandler      on_submit,
-                    CloseHandler       on_close,
-                    CloseHandler       on_destroyed,
-                    long               wx_style = wxSYSTEM_MENU | wxCAPTION | wxCLOSE_BOX | wxMAXIMIZE_BOX | wxRESIZE_BORDER);
-    ~PluginWebDialog() override;
+    WebDialog(wxWindow*          parent,
+              const wxString&    title,
+              const std::string& html,
+              const wxSize&      size,
+              MessageHandler     on_message,
+              SubmitHandler      on_submit,
+              CloseHandler       on_close,
+              CloseHandler       on_destroyed,
+              long               wx_style = wxSYSTEM_MENU | wxCAPTION | wxCLOSE_BOX | wxMAXIMIZE_BOX | wxRESIZE_BORDER);
+    ~WebDialog() override;
 
-    static void post_message(PluginWebDialog* dialog, const nlohmann::json& data);
-    static void request_close(PluginWebDialog* dialog);
-    static void destroy_for_plugin(PluginWebDialog* dialog);
+    static void post_message(WebDialog* dialog, const nlohmann::json& data);
+    static void request_close(WebDialog* dialog);
+    static void destroy_silently(WebDialog* dialog);
 
     // Push a payload to the page; delivered to handlers registered via
     // window.orca.onMessage(). MAIN-THREAD ONLY (the plugin layer marshals).
@@ -65,7 +65,7 @@ protected:
 private:
     void on_bootstrap_event(wxWebViewEvent& event);
     void on_navigated(wxWebViewEvent& event);
-    void load_plugin_content();
+    void load_page_html();
     void on_close_window(wxCloseEvent& event);
     void fire_submit(const nlohmann::json& data);
     void fire_close();
@@ -86,4 +86,4 @@ private:
 
 }} // namespace Slic3r::GUI
 
-#endif // slic3r_GUI_PluginWebDialog_hpp_
+#endif // slic3r_GUI_WebDialog_hpp_

src/slic3r/GUI/WebPanel.cpp

@@ -0,0 +1,111 @@
+#include "WebPanel.hpp"
+
+#include "GUI_App.hpp"
+#include "Widgets/WebHosting.hpp"
+#include "Widgets/WebView.hpp"
+#include "Widgets/WebViewHostDialog.hpp"
+
+#include <boost/log/trivial.hpp>
+
+#include <wx/sizer.h>
+
+namespace Slic3r { namespace GUI {
+
+WebPanel::WebPanel(wxWindow* parent, const char* bridge_script)
+    : wxPanel(parent, wxID_ANY)
+{
+    SetBackgroundColour(wxGetApp().get_window_default_clr());
+    auto* sizer = new wxBoxSizer(wxVERTICAL);
+    SetSizer(sizer);
+
+    // Never null: WebView::CreateWebView substitutes a placeholder view when no backend is available.
+    m_browser = WebView::CreateWebView(this, web_hosting::bootstrap_url());
+    m_browser->SetBackgroundColour(GetBackgroundColour());
+    m_browser->AddUserScript(wxString::FromUTF8(WebViewHostDialog::theme_user_script()));
+    m_browser->AddUserScript(wxString::FromUTF8(WebViewHostDialog::element_defaults_user_script()));
+    m_browser->AddUserScript(wxString::FromUTF8(bridge_script));
+    m_browser->Bind(wxEVT_WEBVIEW_LOADED, &WebPanel::on_load_event, this);
+    m_browser->Bind(wxEVT_WEBVIEW_ERROR, &WebPanel::on_load_event, this);
+    m_browser->Bind(wxEVT_WEBVIEW_NAVIGATED, &WebPanel::on_navigated, this);
+    m_browser->Bind(wxEVT_WEBVIEW_SCRIPT_MESSAGE_RECEIVED, &WebPanel::on_script_message, this);
+    m_browser->Bind(EVT_WEBVIEW_RECREATED, &WebPanel::on_webview_recreated, this);
+    sizer->Add(m_browser, 1, wxEXPAND);
+}
+
+void WebPanel::on_load_event(wxWebViewEvent& event)
+{
+    const bool loaded = event.GetEventType() == wxEVT_WEBVIEW_LOADED;
+    if (!m_content_loaded) {
+        // The first bootstrap load (or its error) triggers the swap to the plugin HTML.
+        m_content_loaded = true;
+        load_page_html();
+    } else if (!web_hosting::is_content_url(event.GetURL())) {
+        // Not our document (a linked page, a substituted error page), or any document on Edge, which ignores
+        // the base URL and restores SetPage content on a reload itself; either way it takes the app theme.
+        if (loaded)
+            apply_theme();
+    } else if (m_own_page_load) {
+        m_own_page_load = false;
+        // The document-start theme script is fixed at creation, so re-apply the app theme.
+        if (loaded)
+            apply_theme();
+    } else if (loaded && m_content_navigated) {
+        // WebKit reloads the SetPage base URL, so a committed load of it that we did not start is a
+        // reload. A failed navigation is reported against the page that stayed but never commits.
+        load_page_html();
+    }
+    if (loaded)
+        m_content_navigated = false;
+    event.Skip();
+}
+
+void WebPanel::on_navigated(wxWebViewEvent& event)
+{
+    m_content_navigated = web_hosting::is_content_url(event.GetURL());
+    event.Skip();
+}
+
+void WebPanel::load_page_html()
+{
+    if (const std::optional<std::string> html = page_html()) {
+        m_own_page_load = true;
+        m_browser->SetPage(wxString::FromUTF8(*html), web_hosting::content_base_url());
+    }
+}
+
+void WebPanel::on_script_message(wxWebViewEvent& event)
+{
+    const nlohmann::json payload = nlohmann::json::parse(event.GetString().utf8_string(), nullptr, false);
+    if (!payload.is_object() || payload.value("channel", std::string()) != "orca")
+        return;
+
+    const std::string kind = payload.value("kind", std::string());
+    if (!on_page_message(kind, payload.contains("data") ? payload["data"] : nlohmann::json()))
+        BOOST_LOG_TRIVIAL(warning) << "WebPanel ignored a window.orca '" << kind << "' call; this host does not support it";
+}
+
+void WebPanel::on_webview_recreated(wxCommandEvent&)
+{
+    SetBackgroundColour(wxGetApp().get_window_default_clr());
+    m_browser->SetBackgroundColour(GetBackgroundColour());
+    Refresh();
+    // Handled without Skip(), so WebView::RecreateAll() does not reload the plugin page.
+    apply_theme();
+}
+
+void WebPanel::apply_theme()
+{
+    WebView::RunScript(m_browser, wxString::FromUTF8(WebViewHostDialog::theme_apply_script()));
+}
+
+void WebPanel::post_to_page(const std::string& json)
+{
+    WebView::RunScript(m_browser, wxString::Format(
+        "(function dispatch(payload, attempts) {\n"
+        "  if (typeof window.__orcaDispatch === 'function') { window.__orcaDispatch(payload); return; }\n"
+        "  if (attempts < 100) window.setTimeout(function() { dispatch(payload, attempts + 1); }, 25);\n"
+        "})({data: %s}, 0);",
+        wxString::FromUTF8(json)));
+}
+
+}} // namespace Slic3r::GUI

src/slic3r/GUI/WebPanel.hpp

@@ -0,0 +1,48 @@
+#pragma once
+
+#include <nlohmann/json.hpp>
+
+#include <wx/panel.h>
+#include <wx/webview.h>
+
+#include <optional>
+#include <string>
+
+namespace Slic3r { namespace GUI {
+
+// Host-supplied HTML in a web view panel, for any window that embeds or derives from it (today plugin
+// Pages tabs and docked panels): bootstrap page and swap, theme and bridge scripts, live re-theming, and
+// window.orca messages routed to on_page_message().
+class WebPanel : public wxPanel
+{
+public:
+    WebPanel(wxWindow* parent, const char* bridge_script);
+
+protected:
+    wxWebView* browser() const { return m_browser; }
+
+    // Delivers an already serialised JSON value to the page's window.orca.onMessage handlers,
+    // waiting briefly for the bridge while the page is still loading. Main thread only.
+    void post_to_page(const std::string& json);
+
+    // The plugin HTML to show once the bootstrap page has loaded, and again when WebKit reloads it;
+    // std::nullopt leaves it blank.
+    virtual std::optional<std::string> page_html() = 0;
+    // A window.orca message from the page; false for a kind this host does not handle (logged).
+    virtual bool on_page_message(const std::string& kind, const nlohmann::json& data) = 0;
+
+private:
+    void on_load_event(wxWebViewEvent& event);
+    void on_navigated(wxWebViewEvent& event);
+    void on_script_message(wxWebViewEvent& event);
+    void on_webview_recreated(wxCommandEvent& event);
+    void apply_theme();
+    void load_page_html();
+
+    wxWebView* m_browser{nullptr};
+    bool       m_content_loaded{false};
+    bool       m_own_page_load{false};   // a SetPage of the plugin HTML is in flight
+    bool       m_content_navigated{false}; // a navigation to the base URL has committed
+};
+
+}} // namespace Slic3r::GUI

src/slic3r/GUI/Widgets/WebHosting.cpp

@@ -0,0 +1,69 @@
+#include "WebHosting.hpp"
+
+#include "slic3r/GUI/GUI.hpp"
+
+#include <libslic3r/Utils.hpp>
+
+#include <boost/filesystem.hpp>
+
+#include <wx/uri.h>
+
+namespace Slic3r { namespace GUI { namespace web_hosting {
+
+namespace {
+
+// Injected into the top-level page at document start (before the plugin's own
+// scripts). Defines window.orca as the only host surface the page may use. It
+// references window.wx lazily (at call time) so it never races the backend's
+// deferred registration of the "wx" message handler. Guarded against
+// double-injection so it is harmless if also prepended.
+constexpr char ORCA_BRIDGE_JS[] = R"JS(
+(function () {
+  if (window.top !== window.self) return;
+  if (window.orca) return;
+  var handlers = [];
+  function send(kind, data) {
+    try {
+      window.wx.postMessage(JSON.stringify({
+        channel: 'orca', kind: kind, data: (data === undefined ? null : data)
+      }));
+    } catch (e) { /* bridge not ready yet */ }
+  }
+  window.orca = {
+    postMessage: function (d) { send('message', d); },
+    submit:      function (d) { send('submit', d); },
+    close:       function ()  { send('close'); },
+    onMessage:   function (cb) { if (typeof cb === 'function') handlers.push(cb); }
+  };
+  window.__orcaDispatch = function (payload) {
+    var data = payload ? payload.data : null;
+    for (var i = 0; i < handlers.length; i++) {
+      try { handlers[i](data); } catch (e) {}
+    }
+  };
+})();
+)JS";
+
+} // namespace
+
+wxString bootstrap_url()
+{
+    return wxString("file://") + from_u8((boost::filesystem::path(resources_dir()) / BOOTSTRAP_PAGE).make_preferred().string());
+}
+
+wxString content_base_url()
+{
+    const std::string dir = (boost::filesystem::path(resources_dir()) / "web").make_preferred().string();
+    return wxString("file://") + from_u8(dir) + "/";
+}
+
+bool is_content_url(const wxString& url)
+{
+    // The web view reports the URL it parsed, which escapes anything the resources path holds
+    // (a space, a non-ASCII character), while content_base_url() is the raw path.
+    return wxURI::Unescape(url.BeforeFirst('#')) == content_base_url();
+}
+
+const char* orca_bridge_script() { return ORCA_BRIDGE_JS; }
+
+}}} // namespace Slic3r::GUI::web_hosting

src/slic3r/GUI/Widgets/WebHosting.hpp

@@ -0,0 +1,25 @@
+#pragma once
+
+#include <wx/string.h>
+
+namespace Slic3r { namespace GUI { namespace web_hosting {
+
+// Shared by the hosts that show plugin HTML: WebDialog and WebPanel.
+
+// The bundled blank page a plugin web view loads before the plugin HTML is swapped in.
+constexpr const char* BOOTSTRAP_PAGE = "web/dialog/WebDialog/blank.html";
+
+// The file:// URL of BOOTSTRAP_PAGE.
+wxString bootstrap_url();
+
+// The file:// base URL plugin HTML is loaded against, so relative URLs resolve to bundled resources.
+wxString content_base_url();
+
+// Whether `url` is the plugin HTML's base URL, ignoring any fragment. WebKit reports it for the
+// injected page, a reload and a failed navigation alike, so a match alone is not a new document.
+bool is_content_url(const wxString& url);
+
+// The window.orca bridge of plugin windows and docked panels. Pages tabs ship their own.
+const char* orca_bridge_script();
+
+}}} // namespace Slic3r::GUI::web_hosting

src/slic3r/GUI/Widgets/WebViewHostDialog.cpp

@@ -75,6 +75,8 @@ if(document.documentElement)
 
 } // namespace
 
+std::string WebViewHostDialog::theme_apply_script() { return host_theme_apply_js(); }
+
 // Document-start user script: injects the contract <style>, stamps data-orca-theme before
 // first paint, and raises a JS flag so the legacy globalapi.js dark.css poll stands down for
 // host-themed pages. The WebView2 timing guard lives in document_start_injector().
@@ -87,7 +89,7 @@ std::string WebViewHostDialog::theme_user_script()
         "if(document.documentElement)document.documentElement.setAttribute('data-orca-theme',theme);");
 }
 
-std::string WebViewHostDialog::plugin_defaults_user_script()
+std::string WebViewHostDialog::element_defaults_user_script()
 {
     std::string css;
     css += "<style id=\"orca-plugin-defaults\">";

src/slic3r/GUI/Widgets/WebViewHostDialog.hpp

@@ -49,9 +49,11 @@ public:
                                                const std::string& prelude   = {},
                                                const std::string& on_inject = {});
 
-    // Shared by modeless Pages tabs and PluginWebDialog.
+    // Shared by WebPanel hosts and WebDialog.
     static std::string theme_user_script();
-    static std::string plugin_defaults_user_script();
+    static std::string element_defaults_user_script();
+    // Re-themes an already-loaded page in place, for web views hosted outside a dialog.
+    static std::string theme_apply_script();
 
 protected:
     wxWebView* browser() const { return m_browser; }

src/slic3r/plugin/host/PluginHostUi.cpp

@@ -7,8 +7,10 @@
 #include <slic3r/GUI/GUI_App.hpp>
 #include <slic3r/GUI/MainFrame.hpp>
 #include <slic3r/GUI/MsgDialog.hpp>
+#include <slic3r/GUI/Plater.hpp>
+#include <slic3r/GUI/DockPanel.hpp>
 #include <slic3r/GUI/PluginProgressDialog.hpp>
-#include <slic3r/GUI/PluginWebDialog.hpp>
+#include <slic3r/GUI/WebDialog.hpp>
 #include <slic3r/GUI/NotificationManager.hpp>
 
 #include <nlohmann/json.hpp>
@@ -20,6 +22,7 @@
 #include <wx/defs.h>
 #include <wx/window.h>
 
+#include <algorithm>
 #include <atomic>
 #include <cstdint>
 #include <future>
@@ -73,7 +76,7 @@ CallablePtr make_holder(py::object obj)
 
 // Adapt a Python callable to a GUI message handler that acquires the GIL and
 // swallows/logs exceptions (a raising handler must not escape into wx events).
-GUI::PluginWebDialog::MessageHandler make_message_adapter(py::object on_message)
+GUI::WebDialog::MessageHandler make_message_adapter(py::object on_message)
 {
     CallablePtr holder = make_holder(std::move(on_message));
     if (!holder)
@@ -91,7 +94,7 @@ GUI::PluginWebDialog::MessageHandler make_message_adapter(py::object on_message)
     };
 }
 
-GUI::PluginWebDialog::SubmitHandler make_submit_adapter(py::object on_submit)
+GUI::WebDialog::SubmitHandler make_submit_adapter(py::object on_submit)
 {
     CallablePtr holder = make_holder(std::move(on_submit));
     if (!holder)
@@ -109,6 +112,25 @@ GUI::PluginWebDialog::SubmitHandler make_submit_adapter(py::object on_submit)
     };
 }
 
+// The plugin's on_close: fired only on a user/JS-initiated close (not forced teardown), while the
+// window is alive. Empty if the plugin passed None.
+std::function<void()> make_close_adapter(const CallablePtr& holder)
+{
+    if (!holder)
+        return nullptr;
+    return [holder]() {
+        PythonGILState gil;
+        if (!gil)
+            return;
+        try {
+            holder->fn();
+        } catch (py::error_already_set& e) {
+            BOOST_LOG_TRIVIAL(error) << "orca.host.ui on_close handler raised: " << e.what();
+            PyErr_Clear();
+        }
+    };
+}
+
 // --------------------------------------------------------------------------
 // Registry of live plugin UI resources. Keyed by an opaque id; tracks the
 // owning plugin so all of a plugin's UI can be torn down on unload.
@@ -350,28 +372,13 @@ py::object ui_create_window(const std::string& html, const std::string& title, i
         if (!UiRegistry::instance().is_open(new_id))
             return;
 
-        // Plugin's on_close: fired only on a user/JS-initiated close (not forced
-        // teardown), while the dialog is alive. Empty if the plugin passed None.
-        GUI::PluginWebDialog::CloseHandler on_close;
-        if (close_holder) {
-            on_close = [close_holder]() {
-                PythonGILState gil;
-                if (!gil)
-                    return;
-                try {
-                    close_holder->fn();
-                } catch (py::error_already_set& e) {
-                    BOOST_LOG_TRIVIAL(error) << "orca.host.ui on_close handler raised: " << e.what();
-                    PyErr_Clear();
-                }
-            };
-        }
+        GUI::WebDialog::CloseHandler on_close = make_close_adapter(close_holder);
         // Registry cleanup: GIL-free, runs from the dialog destructor on every path.
         auto on_destroyed = [new_id]() { UiRegistry::instance().remove(new_id); };
 
-        auto* dlg = new GUI::PluginWebDialog(ui_parent(), wxString::FromUTF8(title), html,
-                                             wxSize(w, h), std::move(msg_adapter), std::move(submit_adapter),
-                                             std::move(on_close), std::move(on_destroyed), PLUGIN_WX_STYLE);
+        auto* dlg = new GUI::WebDialog(ui_parent(), wxString::FromUTF8(title), html,
+                                       wxSize(w, h), std::move(msg_adapter), std::move(submit_adapter),
+                                       std::move(on_close), std::move(on_destroyed), PLUGIN_WX_STYLE);
         UiRegistry::instance().bind(new_id, dlg, plugin_key);
         if (modal) {
             dlg->ShowModal();
@@ -387,14 +394,69 @@ py::object ui_create_window(const std::string& html, const std::string& title, i
     return py::cast(UiWindowHandle{new_id});
 }
 
+// --------------------------------------------------------------------------
+// orca.host.ui.create_dock_panel + UiDockPanel handle
+// --------------------------------------------------------------------------
+constexpr const char* DOCK_POSITIONS[] = {"left", "right", "bottom", "float"};
+
+struct UiDockPanelHandle
+{
+    int id{0};
+};
+
+py::object ui_create_dock_panel(const std::string& html, const std::string& title, int width, int height,
+                                py::object on_message, py::object on_close, const std::string& dock)
+{
+    if (std::find(std::begin(DOCK_POSITIONS), std::end(DOCK_POSITIONS), dock) == std::end(DOCK_POSITIONS))
+        throw std::invalid_argument("orca.host.ui.create_dock_panel dock must be \"left\", \"right\", \"bottom\" or \"float\"");
+
+    auto              msg_adapter  = make_message_adapter(std::move(on_message));
+    CallablePtr       close_holder = make_holder(std::move(on_close));
+    const std::string plugin_key   = PluginAuditManager::instance().current_plugin();
+    const int         w            = width > 0 ? width : 320;
+    const int         h            = height > 0 ? height : 480;
+
+    if (wxTheApp == nullptr)
+        throw std::runtime_error("OrcaSlicer application is not initialized");
+
+    // Deferred and pre-bound for the same reasons as create_window().
+    const int new_id = UiRegistry::instance().reserve_id();
+    UiRegistry::instance().bind(new_id, nullptr, plugin_key);
+
+    GUI::wxGetApp().CallAfter([new_id, plugin_key, html, title, dock, w, h,
+                               msg_adapter = std::move(msg_adapter),
+                               close_holder = std::move(close_holder)]() mutable {
+        if (!UiRegistry::instance().is_open(new_id))
+            return;
+
+        GUI::Plater* plater = GUI::wxGetApp().plater();
+        if (plater == nullptr || GUI::wxGetApp().is_closing()) {
+            UiRegistry::instance().remove(new_id);
+            return;
+        }
+
+        auto  on_destroyed = [new_id]() { UiRegistry::instance().remove(new_id); };
+        auto* panel = new GUI::DockPanel(plater, html, std::move(msg_adapter), make_close_adapter(close_holder),
+                                         std::move(on_destroyed));
+        UiRegistry::instance().bind(new_id, panel, plugin_key);
+        plater->add_dock_pane(panel, GUI::plugin_pane_name(plugin_key, title), wxString::FromUTF8(title), dock,
+                              wxSize(w, h), [panel]() { panel->fire_close(); });
+    });
+
+    return py::cast(UiDockPanelHandle{new_id});
+}
+
 void handle_post(int id, py::object data)
 {
     if (wxTheApp == nullptr)
         return;
     json j = py_to_json(data); // GIL held (binding body)
     GUI::wxGetApp().CallAfter([id, j = std::move(j)]() {
-        auto* d = UiRegistry::instance().get_as<GUI::PluginWebDialog>(id);
-        GUI::PluginWebDialog::post_message(d, j);
+        auto* window = UiRegistry::instance().get_as<wxWindow>(id);
+        if (auto* panel = dynamic_cast<GUI::DockPanel*>(window))
+            panel->push_message(j);
+        else
+            GUI::WebDialog::post_message(dynamic_cast<GUI::WebDialog*>(window), j);
     });
 }
 
@@ -403,8 +465,23 @@ void handle_close(int id)
     if (wxTheApp == nullptr)
         return;
     GUI::wxGetApp().CallAfter([id]() {
-        auto* d = UiRegistry::instance().get_as<GUI::PluginWebDialog>(id);
-        GUI::PluginWebDialog::request_close(d);
+        auto* window = UiRegistry::instance().get_as<wxWindow>(id);
+        if (auto* panel = dynamic_cast<GUI::DockPanel*>(window))
+            panel->request_close();
+        else
+            GUI::WebDialog::request_close(dynamic_cast<GUI::WebDialog*>(window));
+    });
+}
+
+void handle_show(int id, bool show)
+{
+    if (wxTheApp == nullptr)
+        return;
+    GUI::wxGetApp().CallAfter([id, show]() {
+        auto*        panel  = UiRegistry::instance().get_as<GUI::DockPanel>(id);
+        GUI::Plater* plater = GUI::wxGetApp().plater();
+        if (panel != nullptr && plater != nullptr)
+            plater->show_dock_pane(panel, show);
     });
 }
 
@@ -563,6 +640,31 @@ void PluginHostUi::RegisterBindings(pybind11::module_& host)
            "or WINDOW_MODAL. on_message(data) is called on the UI thread when the page posts; on_submit(data) "
            "is called when the page submits; offload heavy work to a thread and push results back with window.post().");
 
+    py::class_<UiDockPanelHandle>(ui, "UiDockPanel", "Handle to a dockable plugin HTML panel created by create_dock_panel().")
+        .def_property_readonly("id", [](const UiDockPanelHandle& h) { return h.id; })
+        .def(
+            "post", [](const UiDockPanelHandle& h, py::object data) { handle_post(h.id, std::move(data)); },
+            py::arg("data"), "Send a payload to the page (delivered to window.orca.onMessage handlers).")
+        .def(
+            "show", [](const UiDockPanelHandle& h) { handle_show(h.id, true); }, "Show the panel again after hide().")
+        .def(
+            "hide", [](const UiDockPanelHandle& h) { handle_show(h.id, false); }, "Hide the panel without closing it.")
+        .def(
+            "close", [](const UiDockPanelHandle& h) { handle_close(h.id); }, "Close the panel (fires on_close).")
+        .def(
+            "is_open", [](const UiDockPanelHandle& h) { return UiRegistry::instance().is_open(h.id); },
+            "Return True until the panel is closed; a hidden panel is still open.");
+
+    ui.def("create_dock_panel", &ui_create_dock_panel, py::arg("html"), py::arg("title") = "OrcaSlicer",
+           py::arg("width") = 320, py::arg("height") = 480, py::arg("on_message") = py::none(),
+           py::arg("on_close") = py::none(), py::arg("dock") = "right",
+           "Open an HTML panel docked beside the 3D view and return a UiDockPanel. dock is \"left\", \"right\", "
+           "\"bottom\" or \"float\", and width/height are in DIPs; the user can move and resize the panel, and a panel "
+           "opened again comes back where the window layout was last saved. The panel belongs to the Prepare and "
+           "Preview tabs. on_message(data) is called on the UI thread when the page posts; window.orca.close() "
+           "or the panel's close button closes it and calls on_close(). A post() made before the page has "
+           "loaded can be dropped, so have the page request its first data.");
+
     py::class_<UiProgressHandle>(ui, "ProgressDialog", "Handle to a native progress dialog.")
         .def(py::init(&new_progress_dialog), py::arg("title"), py::arg("message"), py::arg("maximum") = 100,
              py::arg("style") = wxPD_APP_MODAL | wxPD_AUTO_HIDE)
@@ -630,8 +732,10 @@ void PluginHostUi::close_windows_for_plugin(const std::string& plugin_key)
         // Destroy() bypasses wxEVT_CLOSE, so the plugin's on_close is not fired on
         // forced teardown (intended); the resource destructor still cleans the registry.
         for (auto* window : UiRegistry::instance().take_for_plugin(plugin_key)) {
-            if (auto* dialog = dynamic_cast<GUI::PluginWebDialog*>(window))
-                GUI::PluginWebDialog::destroy_for_plugin(dialog);
+            if (auto* dialog = dynamic_cast<GUI::WebDialog*>(window))
+                GUI::WebDialog::destroy_silently(dialog);
+            else if (auto* panel = dynamic_cast<GUI::DockPanel*>(window))
+                panel->destroy_silently();
             else if (window != nullptr)
                 window->Destroy();
         }

src/slic3r/plugin/host/PluginPages.cpp

@@ -1,17 +1,12 @@
 #include "PluginPages.hpp"
 
 #include "libslic3r/AppConfig.hpp"
-#include "slic3r/GUI/GUI.hpp"
 #include "slic3r/GUI/Notebook.hpp"
 #include "slic3r/GUI/GUI_App.hpp"
 #include "slic3r/GUI/Widgets/Button.hpp"
-#include "slic3r/GUI/Widgets/WebView.hpp"
-#include "slic3r/GUI/Widgets/WebViewHostDialog.hpp"
 #include "slic3r/GUI/wxExtensions.hpp"
 #include "slic3r/plugin/PluginManager.hpp"
 
-#include <libslic3r/Utils.hpp>
-
 #include <algorithm>
 
 #include <boost/filesystem/path.hpp>
@@ -66,27 +61,11 @@ constexpr char PLUGIN_PAGE_BRIDGE_JS[] = R"JS(
 } // namespace
 
 PluginPage::PluginPage(wxWindow* parent, std::shared_ptr<PagesPluginCapability> capability)
-    : wxPanel(parent, wxID_ANY, wxDefaultPosition, wxDefaultSize)
+    : GUI::WebPanel(parent, PLUGIN_PAGE_BRIDGE_JS)
     , m_cap(std::move(capability))
     , m_lifetime(std::make_shared<std::atomic<PluginPage*>>(this))
 {
-    auto* topsizer = new wxBoxSizer(wxVERTICAL);
-    SetSizer(topsizer);
-
-    m_browser = WebView::CreateWebView(this, bootstrap_url());
-    if (m_browser == nullptr) {
-        wxLogError("Could not initialize plugin page web view");
-        return;
-    }
-
-    topsizer->Add(m_browser, wxSizerFlags().Expand().Proportion(1));
-    m_browser->Bind(wxEVT_WEBVIEW_LOADED, &PluginPage::on_bootstrap_event, this);
-    m_browser->Bind(wxEVT_WEBVIEW_ERROR, &PluginPage::on_bootstrap_event, this);
-    m_browser->Bind(wxEVT_WEBVIEW_NEWWINDOW, &PluginPage::on_new_window, this);
-    m_browser->Bind(wxEVT_WEBVIEW_SCRIPT_MESSAGE_RECEIVED, &PluginPage::on_script_message, this);
-    m_browser->AddUserScript(wxString::FromUTF8(GUI::WebViewHostDialog::theme_user_script()));
-    m_browser->AddUserScript(wxString::FromUTF8(GUI::WebViewHostDialog::plugin_defaults_user_script()));
-    m_browser->AddUserScript(PLUGIN_PAGE_BRIDGE_JS);
+    browser()->Bind(wxEVT_WEBVIEW_NEWWINDOW, &PluginPage::on_new_window, this);
 
     const std::shared_ptr<std::atomic<PluginPage*>> lifetime = m_lifetime;
     m_cap->set_message_sender([lifetime](const std::string& message) {
@@ -117,89 +96,54 @@ void PluginPage::detach_capability()
     m_cap.reset();
 }
 
-wxString PluginPage::web_base_url() const
+std::optional<std::string> PluginPage::page_html()
 {
-    const auto path = (boost::filesystem::path(resources_dir()) / "web").make_preferred().string();
-    return wxString("file://") + GUI::from_u8(path) + "/";
-}
+    if (m_cap == nullptr)
+        return std::nullopt;
 
-wxString PluginPage::bootstrap_url() const
-{
-    const auto path = (boost::filesystem::path(resources_dir()) / "web/dialog/PluginWebDialog/blank.html").make_preferred().string();
-    return wxString("file://") + GUI::from_u8(path);
-}
-
-void PluginPage::on_bootstrap_event(wxWebViewEvent& event)
-{
-    load_plugin_content();
-    event.Skip();
-}
-
-void PluginPage::load_plugin_content()
-{
-    if (m_content_loaded || m_browser == nullptr || m_cap == nullptr)
-        return;
-
-    m_content_loaded = true;
     try {
-        m_browser->SetPage(wxString::FromUTF8(m_cap->get_ui()), web_base_url());
+        return m_cap->get_ui();
     } catch (const std::exception& error) {
         BOOST_LOG_TRIVIAL(error) << "Failed to load plugin page '" << m_cap->name() << "': " << error.what();
-        detach_capability();
     } catch (...) {
         BOOST_LOG_TRIVIAL(error) << "Failed to load plugin page '" << m_cap->name() << "'";
-        detach_capability();
     }
+    detach_capability();
+    return std::nullopt;
 }
 
 void PluginPage::on_new_window(wxWebViewEvent& event)
 {
     const wxString url = event.GetURL();
-    if (!url.empty() && m_browser != nullptr)
-        m_browser->LoadURL(url);
+    if (!url.empty())
+        browser()->LoadURL(url);
     event.Veto();
 }
 
-void PluginPage::on_script_message(wxWebViewEvent& event)
+bool PluginPage::on_page_message(const std::string& kind, const nlohmann::json& data)
 {
+    if (kind != "message")
+        return false;
     if (!m_cap)
-        return;
+        return true;
 
-    const wxString payload = event.GetString();
-    nlohmann::json root    = nlohmann::json::parse(payload.utf8_string(), nullptr, false);
-    if (root.is_discarded() || root.value("channel", std::string()) != "orca" ||
-        root.value("kind", std::string()) != "message")
-        return;
-
-    const auto data = root.find("data");
     try {
-        m_cap->on_message(data == root.end()
-                              ? "null"
-                              : data->dump(-1, ' ', false, nlohmann::json::error_handler_t::replace));
+        m_cap->on_message(data.dump(-1, ' ', false, nlohmann::json::error_handler_t::replace));
     } catch (const std::exception& error) {
         BOOST_LOG_TRIVIAL(error) << "Plugin page message handler failed for '" << m_cap->name() << "': " << error.what();
     } catch (...) {
         BOOST_LOG_TRIVIAL(error) << "Plugin page message handler failed for '" << m_cap->name() << "'";
     }
+    return true;
 }
 
 void PluginPage::push_message(const std::string& message)
 {
-    if (m_browser == nullptr)
-        return;
-
     // PagesPluginCapability::post_message() already dumps JSON, so accept it as-is; only a
     // non-JSON payload needs wrapping as a string literal.
-    const std::string payload = nlohmann::json::accept(message)
-                                    ? message
-                                    : nlohmann::json(message).dump(-1, ' ', false, nlohmann::json::error_handler_t::replace);
-
-    WebView::RunScript(m_browser, wxString::Format(
-        "(function dispatch(payload, attempts) {\n"
-        "  if (typeof window.__orcaDispatch === 'function') { window.__orcaDispatch(payload); return; }\n"
-        "  if (attempts < 100) window.setTimeout(function() { dispatch(payload, attempts + 1); }, 25);\n"
-        "})({data: %s}, 0);",
-        wxString::FromUTF8(payload)));
+    post_to_page(nlohmann::json::accept(message)
+                     ? message
+                     : nlohmann::json(message).dump(-1, ' ', false, nlohmann::json::error_handler_t::replace));
 }
 
 PluginPages::~PluginPages()
@@ -268,10 +212,6 @@ bool PluginPages::create_page(const PluginCapabilityId& id)
     }
 
     auto* page = new PluginPage(m_parent, std::move(capability));
-    if (!page->is_valid()) {
-        page->Destroy();
-        return false;
-    }
 
     if (!icon.empty()) {
         try {

src/slic3r/plugin/host/PluginPages.hpp

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <slic3r/GUI/WebPanel.hpp>
 #include <slic3r/plugin/PythonPluginInterface.hpp>
 #include <slic3r/plugin/pluginTypes/pages/PagesPluginCapability.hpp>
 
@@ -11,14 +12,13 @@
 #include <vector>
 
 #include <wx/bitmap.h>
-#include <wx/panel.h>
 #include <wx/webview.h>
 
 class Notebook;
 
 namespace Slic3r {
 
-class PluginPage : public wxPanel
+class PluginPage : public GUI::WebPanel
 {
 public:
     PluginPage(wxWindow* parent, std::shared_ptr<PagesPluginCapability> capability);
@@ -26,24 +26,20 @@ public:
 
     PluginPage() = delete;
 
-    bool is_valid() const { return m_browser != nullptr && m_cap != nullptr; }
     void detach_capability();
-    void on_bootstrap_event(wxWebViewEvent& event);
-    void on_new_window(wxWebViewEvent& event);
-    void on_script_message(wxWebViewEvent& event);
     void push_message(const std::string& message);
     void set_icon(const wxBitmap& icon) { m_icon = icon; }
     const wxBitmap& icon() const { return m_icon; }
 
+protected:
+    std::optional<std::string> page_html() override;
+    bool on_page_message(const std::string& kind, const nlohmann::json& data) override;
+
 private:
-    void load_plugin_content();
-    wxString bootstrap_url() const;
-    wxString web_base_url() const;
+    void on_new_window(wxWebViewEvent& event);
 
-    wxWebView* m_browser{nullptr};
     std::shared_ptr<PagesPluginCapability> m_cap;
     std::shared_ptr<std::atomic<PluginPage*>> m_lifetime;
-    bool m_content_loaded{false};
     wxBitmap m_icon;
 };
 

tests/libslic3r/CMakeLists.txt

@@ -49,6 +49,7 @@ add_executable(${_TEST_NAME}_tests
     test_ordering_strategies.cpp
     # test_png_io.cpp
     test_indexed_triangle_set.cpp
+    test_instance_lock.cpp
     ../libnest2d/printer_parts.cpp
     )
 

tests/libslic3r/test_instance_lock.cpp

@@ -0,0 +1,135 @@
+#include <catch2/catch_all.hpp>
+
+#include <atomic>
+#include <chrono>
+#include <thread>
+
+#include <boost/filesystem.hpp>
+
+#include "libslic3r/InstanceLock.hpp"
+#include "test_utils.hpp"
+
+#ifndef _WIN32
+#include <fcntl.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#endif
+
+using namespace Slic3r;
+using namespace std::chrono_literals;
+
+TEST_CASE("InstanceLock creates its lock file and holds it for the guard's scope", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+    const std::string  path = (dir.path() / "shared.lock").string();
+
+    {
+        InstanceLock lock(path);
+        REQUIRE(lock.locked());
+        REQUIRE(boost::filesystem::exists(path));
+    }
+    // Released: a fresh guard gets the lock at once instead of waiting out a timeout.
+    const auto   started = std::chrono::steady_clock::now();
+    InstanceLock again(path, 5000ms);
+    REQUIRE(again.locked());
+    REQUIRE(std::chrono::steady_clock::now() - started < 1000ms);
+}
+
+TEST_CASE("InstanceLock nests within one thread", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+    const std::string  path = (dir.path() / "shared.lock").string();
+
+    InstanceLock outer(path);
+    {
+        InstanceLock inner(path, 100ms);
+        REQUIRE(inner.locked());
+    }
+    // The inner guard leaving does not release the outer one.
+    REQUIRE(outer.locked());
+}
+
+TEST_CASE("InstanceLock is a no-op for an empty path and survives an unwritable one", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+
+    InstanceLock none("");
+    REQUIRE_FALSE(none.locked());
+
+    // The directory does not exist, so the lock file cannot be created; the
+    // guard still constructs and the write it guards can go ahead.
+    InstanceLock unwritable((dir.path() / "missing" / "shared.lock").string(), 100ms);
+    REQUIRE_FALSE(unwritable.locked());
+}
+
+TEST_CASE("InstanceLock serialises the threads of one process", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+    const std::string  path = (dir.path() / "shared.lock").string();
+
+    std::atomic<bool> holder_ready{false};
+    std::atomic<bool> holder_released{false};
+    std::thread holder([&] {
+        InstanceLock lock(path);
+        holder_ready = true;
+        std::this_thread::sleep_for(150ms);
+        holder_released = true;
+    });
+    while (! holder_ready)
+        std::this_thread::yield();
+
+    bool released_before_acquire = false;
+    {
+        InstanceLock lock(path);
+        released_before_acquire = holder_released;
+    }
+    holder.join();
+    REQUIRE(released_before_acquire);
+}
+
+#ifndef _WIN32
+// The cross-process side of the lock is a POSIX fcntl write lock, which a
+// child process takes here directly; the same primitive backs the guard on
+// Windows through LockFileEx, but spawning a child there is not worth a test.
+TEST_CASE("InstanceLock yields to another process and reports it", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+    const std::string  path = (dir.path() / "shared.lock").string();
+
+    int child_holds[2], child_may_exit[2];
+    REQUIRE(::pipe(child_holds) == 0);
+    REQUIRE(::pipe(child_may_exit) == 0);
+
+    const pid_t child = ::fork();
+    REQUIRE(child >= 0);
+    if (child == 0) {
+        int fd = ::open(path.c_str(), O_RDWR | O_CREAT, 0644);
+        struct flock lock{};
+        lock.l_type   = F_WRLCK;
+        lock.l_whence = SEEK_SET;
+        char byte = ::fcntl(fd, F_SETLK, &lock) == 0 ? '1' : '0';
+        if (::write(child_holds[1], &byte, 1) != 1 || ::read(child_may_exit[0], &byte, 1) != 1)
+            ::_exit(1);
+        ::_exit(0);
+    }
+
+    char byte = '0';
+    REQUIRE(::read(child_holds[0], &byte, 1) == 1);
+    REQUIRE(byte == '1');
+
+    bool locked_while_child_holds;
+    {
+        InstanceLock lock(path, 100ms);
+        locked_while_child_holds = lock.locked();
+    }
+    REQUIRE(::write(child_may_exit[1], "x", 1) == 1);
+    int status = 0;
+    REQUIRE(::waitpid(child, &status, 0) == child);
+    for (int fd : {child_holds[0], child_holds[1], child_may_exit[0], child_may_exit[1]})
+        ::close(fd);
+
+    REQUIRE_FALSE(locked_while_child_holds);
+    InstanceLock lock(path);
+    REQUIRE(lock.locked());
+}
+#endif

tests/libslic3r/test_utils.cpp

@@ -62,6 +62,32 @@ TEST_CASE("per-user temp root is unchanged on Windows, isolated elsewhere", "[ut
 #endif
 }
 
+TEST_CASE("write_file_atomically replaces the target and leaves no temporary file", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "preset.json";
+
+    REQUIRE_FALSE(write_file_atomically(target.string(), "first"));
+    REQUIRE_FALSE(write_file_atomically(target.string(), "second"));
+
+    std::string content;
+    load_string_file(target, content);
+    REQUIRE(content == "second");
+    size_t entries = 0;
+    for (auto &entry : boost::filesystem::directory_iterator(dir.path())) {
+        (void) entry;
+        ++entries;
+    }
+    REQUIRE(entries == 1);
+}
+
+TEST_CASE("write_file_atomically reports a missing directory and writes nothing", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "missing" / "preset.json";
+
+    REQUIRE(write_file_atomically(target.string(), "x"));
+    REQUIRE_FALSE(boost::filesystem::exists(target));
+}
+
 TEST_CASE("copy_file reports the OS error when the destination cannot be written", "[utils]") {
     ScopedTemporaryFile source(".txt");
     {

tests/slic3rutils/test_plugin_host_api.cpp

@@ -3,8 +3,12 @@
 #include <libslic3r/Model.hpp>
 #include <libslic3r/PresetBundle.hpp>
 #include <libslic3r/TriangleMesh.hpp>
+#include <slic3r/GUI/DockPanel.hpp>
+#include <slic3r/GUI/AuiPaneLayout.hpp>
+#include <slic3r/GUI/Widgets/WebHosting.hpp>
 #include <slic3r/plugin/PythonPluginBridge.hpp>
 
+#include "plugin_test_utils.hpp"
 #include "python_test_support.hpp"
 
 #include <pybind11/embed.h>
@@ -141,6 +145,8 @@ TEST_CASE("Plugin host API exposes the UI module and guards it before Orca app i
     CHECK(ui.attr("WINDOW_MODELESS").cast<long>() == 0);
     CHECK(ui.attr("WINDOW_MODAL").cast<long>() == 1);
     CHECK(has_attr(ui, "UiWindow"));
+    CHECK(has_attr(ui, "create_dock_panel"));
+    CHECK(has_attr(ui, "UiDockPanel"));
 
     // With no wx application the UI calls marshal to a main thread that does not
     // exist here; they must fail cleanly with a clear error, not crash.
@@ -151,6 +157,74 @@ TEST_CASE("Plugin host API exposes the UI module and guards it before Orca app i
         CHECK(error.matches(PyExc_RuntimeError));
         CHECK(std::string(error.what()).find("OrcaSlicer application is not initialized") != std::string::npos);
     }
+
+    try {
+        ui.attr("create_dock_panel")("<p>panel</p>");
+        FAIL("orca.host.ui.create_dock_panel unexpectedly succeeded without a wx application");
+    } catch (const py::error_already_set& error) {
+        CHECK(error.matches(PyExc_RuntimeError));
+        CHECK(std::string(error.what()).find("OrcaSlicer application is not initialized") != std::string::npos);
+    }
+
+    // Positional arguments follow create_window(): width and height come straight after the title.
+    try {
+        ui.attr("create_dock_panel")("<p>panel</p>", "Panel", 400, 300);
+        FAIL("orca.host.ui.create_dock_panel unexpectedly succeeded without a wx application");
+    } catch (const py::error_already_set& error) {
+        CHECK(error.matches(PyExc_RuntimeError));
+    }
+
+    // An unknown dock position is rejected before the application is needed.
+    try {
+        ui.attr("create_dock_panel")("<p>panel</p>", py::arg("dock") = "top");
+        FAIL("orca.host.ui.create_dock_panel accepted an unknown dock position");
+    } catch (const py::error_already_set& error) {
+        CHECK(error.matches(PyExc_ValueError));
+    }
+}
+
+TEST_CASE("Plugin pane names identify the plugin and title without layout delimiters", "[PluginHost]")
+{
+    using Slic3r::GUI::plugin_pane_name;
+
+    CHECK(plugin_pane_name("dock_demo", "Scene") == "plugin:dock_demo:Scene");
+    CHECK(plugin_pane_name("key", "a|b;c=d\\e").find_first_of("|;=\\") == std::string::npos);
+}
+
+TEST_CASE("A pane's saved layout entry is found by pane name", "[PluginHost]")
+{
+    using Slic3r::GUI::aui_pane_layout_entry;
+
+    const std::string sidebar = "name=sidebar;caption=;state=2099196;dir=4;layer=0;row=0;pos=0;bestw=390;besth=900";
+    // The caption holds an escaped '|', which must not end the entry.
+    const std::string plugin  = "name=plugin:demo:Scene;caption=Scene \\| stats;state=2099198;dir=2;layer=0;row=1;pos=0;bestw=320;besth=480";
+    const std::string layout  = "layout3|" + sidebar + "|" + plugin + "|dock_size(4,0,0)=392|";
+
+    CHECK(aui_pane_layout_entry(layout, "plugin:demo:Scene") == plugin);
+    CHECK(aui_pane_layout_entry(layout, "sidebar") == sidebar);
+    CHECK(aui_pane_layout_entry(layout, "plugin:demo").empty());
+    CHECK(aui_pane_layout_entry("", "plugin:demo:Scene").empty());
+}
+
+TEST_CASE("A reloaded plugin page is recognised by its base URL, fragment aside", "[PluginHost]")
+{
+    using namespace Slic3r::GUI::web_hosting;
+
+    // A resources path holding a space, which the web view reports escaped.
+    const Slic3r::ScopedResourcesDir resources("web content check");
+
+    // The swapped-in page, then after an in-page anchor and a reload.
+    CHECK(is_content_url(content_base_url()));
+    CHECK(is_content_url(content_base_url() + "#tab2"));
+    wxString escaped = content_base_url();
+    escaped.Replace(" ", "%20");
+    REQUIRE(escaped != content_base_url());
+    CHECK(is_content_url(escaped));
+    CHECK(is_content_url(escaped + "#tab2"));
+    // A page the plugin linked to keeps its own URL and must be left alone.
+    CHECK_FALSE(is_content_url(content_base_url() + "guide.html"));
+    CHECK_FALSE(is_content_url("https://example.com/"));
+    CHECK_FALSE(is_content_url(""));
 }
 
 TEST_CASE("Plugin host API exposes model geometry and structure to Python", "[PluginHost][Python]")