diff --git a/.gitignore b/.gitignore
index 1e32f66..735e3fc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,13 @@ repobuild/*/*
 repobuild/*/*/
 repobuild/*/*/*
 
+laboratory/*/
+laboratory/*/*
+laboratory/*/*/
+laboratory/*/*/*
+laboratory/*/*/*/
+laboratory/*/*/*/*
+
 inst.lua
 # Available as the respective release
 inst-gold.lua
diff --git a/code/apps/sys-everest.lua b/code/apps/sys-everest.lua
index d370e6d..16e9789 100644
--- a/code/apps/sys-everest.lua
+++ b/code/apps/sys-everest.lua
@@ -269,7 +269,7 @@ local function moveSurface(surface, m, x, y, w, h, force)
     monitorResetBF(monitors[m])
    end
    if cb then
-    cb.copy(ox, oy, w, h, x - ox, y - oy)
+    pcall(cb.copy, ox, oy, w, h, x - ox, y - oy)
     if surface == surfaces[1] then
      local cacheControl = {}
      for i = 1, h do
diff --git a/code/apps/sys-icecap.lua b/code/apps/sys-icecap.lua
index 32fc700..f144a3b 100644
--- a/code/apps/sys-icecap.lua
+++ b/code/apps/sys-icecap.lua
@@ -34,18 +34,20 @@ nexus = {
      neo.emergency("icecap nexus prereg issue")
      theEventHandler("k.registration", "x.neo.pub.window")
     end
-    local dw = e(w, h, t)
+    local dwo, dw = pcall(e, w, h, t)
+    if not dwo then
+     addOnReg("x.neo.pub.window", cb)
+     return
+    end
     c(dw)
     everestWindows[dw.id] = function (...)
      return c(dw, ...)
     end
-    return true
+   else
+    addOnReg("x.neo.pub.window", cb)
    end
   end
-  if not cb() then
-   addOnReg("x.neo.pub.window", cb)
-  end
-  return dw
+  cb()
  end,
  windows = everestWindows,
  startDialog = function (tx, ti)
diff --git a/code/data/app-claw/local.lua b/code/data/app-claw/local.lua
index fc456c5..2680900 100644
--- a/code/data/app-claw/local.lua
+++ b/code/data/app-claw/local.lua
@@ -3,7 +3,7 @@
 return {
  ["neo"] = {
   desc = "KittenOS NEO Kernel & Base Libs",
-  v = 2,
+  v = 3,
   deps = {
   },
   dirs = {
@@ -54,7 +54,7 @@ return {
  },
  ["neo-everest"] = {
   desc = "KittenOS NEO / Everest (windowing)",
-  v = 2,
+  v = 3,
   deps = {
    "neo"
   },
@@ -67,7 +67,7 @@ return {
  },
  ["neo-icecap"] = {
   desc = "KittenOS NEO / Icecap",
-  v = 2,
+  v = 3,
   deps = {
    "neo"
   },
diff --git a/code/init.lua b/code/init.lua
index b6b9dc3..405c7b2 100644
--- a/code/init.lua
+++ b/code/init.lua
@@ -134,7 +134,7 @@ function wrapMeta(t)
    end,
    __pairs = function ()
     return function (x, key)
-     local k, v = next(t, k)
+     local k, v = next(t, key)
      if k then return k, wrapMeta(v) end
     end, 9, nil
    end,
@@ -166,7 +166,7 @@ function ensureType(a, t)
 end
 
 function ensurePathComponent(s)
- if not string.match(s, "^[a-zA-Z0-9_%-%+%,%.%#%~%@%'%;%[%]%(%)%&%%%$%! %=%{%}%^]+$") then error("chars disallowed: " .. s) end
+ if not string.match(s, "^[a-zA-Z0-9_%-%+%,%.%#%~%@%'%;%[%]%(%)%&%%%$%! %=%{%}%^\x80-\xFF]+$") then error("chars disallowed: " .. s) end
  if s == "." then error("single dot disallowed") end
  if s == ".." then error("double dot disallowed") end
 end
@@ -302,7 +302,6 @@ baseProcEnvCore = {
  utf8 = wrapUtf8,
  require = loadLibraryInner,
  assert = assert,     ipairs = ipairs,
- load = load,
  next = function (t, k)
   local mt = getmetatable(t)
   if mt == uniqueNEOProtectionObject then error("NEO-Protected Object") end
@@ -314,14 +313,15 @@ baseProcEnvCore = {
  tonumber = tonumber, tostring = tostring,
  setmetatable = setmetatable, getmetatable = function (n)
   local mt = getmetatable(n)
-  if mt == uniqueNEOProtectionObject then return "NEO-Protected Object" end
+  if rawequal(mt, uniqueNEOProtectionObject) then return "NEO-Protected Object" end
   return mt
  end,
  rawset = function (t, i, v)
   local mt = getmetatable(t)
-  if mt == uniqueNEOProtectionObject then error("NEO-Protected Object") end
+  if rawequal(mt, uniqueNEOProtectionObject) then error("NEO-Protected Object") end
   return rawset(t, i, v)
  end, rawget = rawget, rawlen = rawlen, rawequal = rawequal,
+ checkArg = checkArg
 }
 baseProcNeo = {
  emergency = emergencyFunction,
@@ -357,6 +357,12 @@ baseProcNeoMT = {
 
 function baseProcEnv()
  local pe = setmetatable({}, baseProcEnvMT)
+ pe.load = function (a, b, c, d, ...)
+  if rawequal(d, nil) then
+   d = pe
+  end
+  return load(a, b, c, d, ...)
+ end
  pe.neo = setmetatable({}, baseProcNeoMT)
  pe._G = pe
  return pe
@@ -490,6 +496,7 @@ end
 function start(pkg, ppkg, ppid, ...)
  local proc = {}
  local pid = lastPID
+ emergencyFunction("starting:", pkg)
  lastPID = lastPID + 1
 
  local function startFromUser(ipkg, ...)
diff --git a/laboratory/launch.sh b/laboratory/launch.sh
new file mode 100755
index 0000000..5bdefc7
--- /dev/null
+++ b/laboratory/launch.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+# This is released into the public domain.
+# No warranty is provided, implied or otherwise.
+
+XPWD=`pwd`
+export XPWD
+
+cd "$OCEMU/src"
+./boot.lua "$XPWD"
diff --git a/laboratory/ocemu.cfg b/laboratory/ocemu.cfg
new file mode 100644
index 0000000..ab0c9ae
--- /dev/null
+++ b/laboratory/ocemu.cfg
@@ -0,0 +1,140 @@
+--OCEmu configuration. Designed to mimic HOCON syntax, but is not exactly HOCON
+--syntax.
+ocemu {
+
+  --Client side settings, presentation and performance related stuff.
+  client {
+
+    --The sample rate used for generating beeps of computers' internal speakers.
+    --Use custom values at your own responsibility here; if it breaks OC you'll
+    --get no support. Some potentially reasonable lower values are 16000 or even
+    --8000 (which was the old default, but leads to artifacting on certain
+    --frequencies).
+    beepSampleRate=44100
+
+    --The base volume of beeps generated by computers. This may be in a range of
+    --[0, 127], where 0 means mute (the sound will not even be generated), and
+    --127 means maximum amplitude / volume.
+    beepVolume=32
+
+    --The color of monochrome text (i.e. displayed when in 1-bit color depth,
+    --e.g. tier one screens / GPUs, or higher tier set to 1-bit color depth).
+    --Defaults to white, feel free to make it some other color, tho!
+    monochromeColor="0xFFFFFF"
+  }
+
+  --Computer related settings, concerns server performance and security.
+  computer {
+
+    --The maximum size of the byte array that can be stored on EEPROMs as
+    --configuration data.
+    eepromDataSize=256
+
+    --The maximum size of the byte array that can be stored on EEPROMs as
+    --executable data..
+    eepromSize=4096
+
+    --Settings specific to the Lua architecture.
+    lua {
+
+      --Whether to allow loading precompiled bytecode via Lua's `load` function,
+      --or related functions (`loadfile`, `dofile`). Enable this only if you
+      --absolutely trust all users on your server and all Lua code you run. This
+      --can be a MASSIVE SECURITY RISK, since precompiled code can easily be
+      --used for exploits, running arbitrary code on the real server! I cannot
+      --stress this enough: only enable this is you know what you're doing.
+      allowBytecode=false
+
+      --Whether to allow user defined __gc callbacks, i.e. __gc callbacks
+      --defined *inside* the sandbox. Since garbage collection callbacks are not
+      --sandboxed (hooks are disabled while they run), this is not recommended.
+      allowGC=false
+    }
+
+    --The time in seconds a program may run without yielding before it is
+    --forcibly aborted. This is used to avoid stupidly written or malicious
+    --programs blocking other computers by locking down the executor threads.
+    --Note that changing this won't have any effect on computers that are
+    --already running - they'll have to be rebooted for this to take effect.
+    timeout=5
+  }
+
+  --Emulator related settings. Components, accuracy, and debugging.
+  emulator {
+
+    --Default components available to the computer.
+    components {
+
+      {"gpu", "c1-gpu-tier3", 0, 160, 50, 3},
+      {"gpu", "c1-gpu-tier1", 0, 50, 16, 1},
+      {"screen_sdl2", "c1-screen-tier3", -1, 160, 50, 3},
+      {"screen_sdl2", "c1-screen-tier1", -1, 50, 16, 1},
+      {"modem", "c1-modem", 1, false},
+      {"eeprom", "c1-eeprom", 9, "lua/bios.lua"},
+      {"filesystem", "c1-tmpfs", -1, "tmpfs", "tmpfs", false, 5},
+      {"filesystem", "c1-sda", 5, nil, "Workbench", false, 4},
+      {"filesystem", "c1-sdb", 5, nil, "Repository", false, 4},
+      {"filesystem", "openos", 0, "loot/openos", "openos", true, 1},
+      {"internet", "c1-internet", 2},
+      {"computer", "c1-computer", -1},
+      {"ocemu", "c1-ocemu", -1},
+      {"keyboard_sdl2", "c1-keyboard", -1}
+    }
+
+    --Whether to enable the emulator's extremely verbose logging.
+    debug=false
+
+    --Whether to choose performance over timing-accuracy.
+    fast=false
+
+    --Whether to return vague error messages like OpenComputers.
+    vague=false
+  }
+
+  filesystem {
+
+    --The maximum block size that can be read in one 'read' call on a file
+    --system. This is used to limit the amount of memory a call from a user
+    --program can cause to be allocated on the host side: when 'read' is, called
+    --a byte array with the specified size has to be allocated. So if this
+    --weren't limited, a Lua program could trigger massive memory allocations
+    --regardless of the amount of RAM installed in the computer it runs on. As a
+    --side effect this pretty much determines the read performance of file
+    --systems.
+    maxReadBuffer=2048
+  }
+
+  internet {
+
+    --Whether to allow HTTP requests via internet cards. When enabled, the
+    --`request` method on internet card components becomes available.
+    enableHttp=true
+
+    --Whether to allow TCP connections via internet cards. When enabled, the
+    --`connect` method on internet card components becomes available.
+    enableTcp=true
+  }
+
+  --Other settings that you might find useful to tweak.
+  misc {
+
+    --The maximum size of network packets to allow sending via network cards.
+    --This has *nothing to do* with real network traffic, it's just a limit for
+    --the network cards, mostly to reduce the chance of computer with a lot of
+    --RAM killing those with less by sending huge packets. This does not apply
+    --to HTTP traffic.
+    maxNetworkPacketSize=8192
+
+    --The maximum distance a wireless message can be sent. In other words, this
+    --is the maximum signal strength a wireless network card supports. This is
+    --used to limit the search range in which to check for modems, which may or
+    --may not lead to performance issues for ridiculous ranges - like, you know,
+    --more than the loaded area. See also: `wirelessCostPerRange`.
+    maxWirelessRange=400
+  }
+
+  --The configuration version this config was generated at. This is used to
+  --allow the emulator to reset/migrate parts of the config when their meaning
+  --has changed across versions.
+  version=3
+}
diff --git a/laboratory/ocemu.cfg.default b/laboratory/ocemu.cfg.default
new file mode 100644
index 0000000..4935009
--- /dev/null
+++ b/laboratory/ocemu.cfg.default
@@ -0,0 +1,28 @@
+ocemu {
+  emulator {
+    components {
+      {"gpu", "c1-gpu-tier3", 0, 160, 50, 3},
+      {"gpu", "c1-gpu-tier1", 0, 50, 16, 1},
+      {"screen_sdl2", "c1-screen-tier3", -1, 160, 50, 3},
+      {"screen_sdl2", "c1-screen-tier1", -1, 50, 16, 1},
+      {"modem", "c1-modem", 1, false},
+      {"eeprom", "c1-eeprom", 9, "lua/bios.lua"},
+      {"filesystem", "c1-tmpfs", -1, "tmpfs", "tmpfs", false, 5},
+      {"filesystem", "c1-sda", 5, nil, "Workbench", false, 4},
+      {"filesystem", "c1-sdb", 5, nil, "Repository", false, 4},
+      {"filesystem", "openos", 0,"loot/openos","openos",true,1},
+      {"internet", "c1-internet", 2},
+      {"computer", "c1-computer", -1},
+      {"ocemu", "c1-ocemu", -1},
+      {"keyboard_sdl2", "c1-keyboard", -1}
+    }
+    debug=false
+    fast=false
+    vague=false
+  }
+  internet {
+    enableHttp=true
+    enableTcp=true
+  }
+  version=3
+}
diff --git a/laboratory/reset.sh b/laboratory/reset.sh
new file mode 100755
index 0000000..6ceb5b9
--- /dev/null
+++ b/laboratory/reset.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+# This is released into the public domain.
+# No warranty is provided, implied or otherwise.
+
+cp ocemu.cfg.default ocemu.cfg && rm -rf c1-sda c1-sdb tmpfs
+mkdir c1-sda c1-sdb
+echo -n c1-sda > c1-eeprom/data.bin
+cd ..
+cp -r code/* laboratory/c1-sdb/
+cp -r repository/* laboratory/c1-sdb/
+lua clawmerge.lua repository/data/app-claw/local.lua code/data/app-claw/local.lua > laboratory/c1-sdb/data/app-claw/local.lua
+cp -r laboratory/c1-sdb/* laboratory/c1-sda/