diff --git a/code/apps/app-klogo.lua b/code/apps/app-klogo.lua
index 35700d5..824d25a 100644
--- a/code/apps/app-klogo.lua
+++ b/code/apps/app-klogo.lua
@@ -68,7 +68,8 @@ local function decodeRGB(rgb, igp)
 end
 
 local bW, bH = math.ceil(bitmap.width / 2), math.ceil(bitmap.height / 4)
-neoux.create(bW, bH, nil, neoux.tcwindow(bW, bH, {
+
+local fp = neoux.tcwindow(bW, bH, {
  braille.new(1, 1, bW, bH, {
   selectable = true,
   get = function (window, x, y, bg, fg, selected, colour)
@@ -81,7 +82,20 @@ neoux.create(bW, bH, nil, neoux.tcwindow(bW, bH, {
 }, function (w)
  w.close()
  running = false
-end, 0xFFFFFF, 0))
+end, 0xFFFFFF, 0)
+
+neoux.create(bW, bH, nil, function (w, t, r, ...)
+ if t == "focus" then
+  if r then
+   local pal = {}
+   for i = 0, 15 do
+    pal[i + 1] = bitmap.getPalette(i)
+   end
+   w.recommendPalette(pal)
+  end
+ end
+ return fp(w, t, r, ...)
+end)
 
 while running do
  event.pull()
diff --git a/code/apps/sys-everest.lua b/code/apps/sys-everest.lua
index 9133c29..b6000c1 100644
--- a/code/apps/sys-everest.lua
+++ b/code/apps/sys-everest.lua
@@ -141,7 +141,7 @@ local function doBackgroundLine(m, mg, bdx, bdy, bdl)
   pcall(mg.set, bdx, bdy, unicode.undoSafeTextFormat(str))
   pcall(mg.fill, bdx + strl, bdy, bdl - strl, 1, " ")
  else
-  monitorGPUColours(m, mg, 0x000020, 0)
+  monitorGPUColours(m, mg, 0x000040, 0)
   pcall(mg.fill, bdx, bdy, bdl, 1, " ")
  end
 end
@@ -352,14 +352,72 @@ local function handleSpan(target, x, y, text, bg, fg)
  submitSegment()
 end
 
+local basePalT2 = {
+ -- on T2 we provide 'system colours'
+ -- by default
+ 0x000000, 0x0080FF, 0x000040, 0xFFFFFF,
+ -- stuff above cannot be altered by
+ -- user applications to prevent
+ -- graphical glitches
+ 0xFF0000, 0xC04000, 0x808000, 0x40C000,
+ 0x00FF00, 0x00C040, 0x008080, 0x0040C0,
+ 0x0000FF, 0x4000C0, 0x800080, 0xC00040
+}
+local basePalT3 = {
+ -- on T3 we provide the Tier 3 pal.
+ 0x0F0F0F, 0x1E1E1E, 0x2D2D2D, 0x3C3C3C,
+ 0x4B4B4B, 0x5A5A5A, 0x696969, 0x787878,
+ 0x878787, 0x969696, 0xA5A5A5, 0xB4B4B4,
+ 0xC3C3C3, 0xD2D2D2, 0xE1E1E1, 0xF0F0F0
+}
+
+local function setSurfacePalette(surf, pal)
+ if neo.dead then return 0 end
+ local m = monitors[surf[1]]
+ if not m then return 0 end
+ local cb, rb = m[1]()
+ if not cb then return 0 end
+ local dok, depth = pcall(cb.getDepth)
+ if not dok then depth = 4 end
+ if rb then
+  monitorResetBF(m)
+ end
+ if not rawequal(pal, nil) then
+  neo.ensureType(pal, "table")
+ elseif depth < 8 then
+  pal = basePalT1
+ else
+  pal = basePalT2
+ end
+ local ko = -1
+ if depth == 4 then
+  ko = 3 -- start overriding at 4+
+ end
+ for k, v in ipairs(pal) do
+  -- prevent graphical glitches for
+  -- critical system colours on T3
+  local av = v % 0x1000000
+  if av ~= 0xFFFFFF and
+     av ~= 0x000000 and
+     av ~= 0x0080FF and
+     av ~= 0x000040 then
+   local ok = pcall(cb.setPaletteColor, k + ko, v)
+   if not ok then return k - 1 end
+  end
+ end
+ return #pal
+end
+
 local function changeFocus(oldSurface, optcache)
  local ns1 = surfaces[1]
  optcache = optcache or {}
  if ns1 ~= oldSurface then
   if oldSurface then
+   setSurfacePalette(oldSurface, basePal)
    oldSurface[6]("focus", false)
   end
   if ns1 then
+   setSurfacePalette(ns1, basePal)
    ns1[6]("focus", true)
   end
   updateStatus()
@@ -501,20 +559,8 @@ everestProvider(function (pkg, pid, sendSig)
     handleSpan(surf, x, y + 1, text, bg, fg)
    end,
    recommendPalette = function (pal)
-    neo.ensureType(pal, "table")
-    if neo.dead then return 0 end
     if not focusState then return 0 end
-    local m = monitors[surf[1]]
-    if not m then return 0 end
-    local cb, rb = m[1]()
-    if not cb then return 0 end
-    if rb then
-     monitorResetBF(m)
-    end
-    for k, v in ipairs(pal) do
-     local ok = pcall(cb.setPaletteColor, k - 1, v)
-     if not ok then return k - 1 end
-    end
+    return setSurfacePalette(surf, pal)
    end,
    close = function ()
     if neo.dead then return end
diff --git a/code/data/app-claw/local.lua b/code/data/app-claw/local.lua
index ea86ec3..8bce7fb 100644
--- a/code/data/app-claw/local.lua
+++ b/code/data/app-claw/local.lua
@@ -83,7 +83,7 @@ return {
  },
  ["neo-secpolicy"] = {
   desc = "KittenOS NEO / Secpolicy",
-  v = 1,
+  v = 2,
   deps = {
   },
   dirs = {
diff --git a/code/libs/neoux.lua b/code/libs/neoux.lua
index 06be233..d076bbb 100644
--- a/code/libs/neoux.lua
+++ b/code/libs/neoux.lua
@@ -67,13 +67,14 @@ newNeoux = function (event, neo)
   window.getSize = function ()
    return w, h
   end
-  window.getDepth = windowCore.getDepth
   window.setSize = function (nw, nh)
    w = nw
    h = nh
    windowCore.setSize(w, h)
   end
+  window.getDepth = windowCore.getDepth
   window.span = windowCore.span
+  window.recommendPalette = windowCore.recommendPalette
   window.close = function ()
    windowCore.close()
    lclEvToW[windowCore.id] = nil
diff --git a/code/libs/sys-secpolicy.lua b/code/libs/sys-secpolicy.lua
index 83f93e0..df9abfa 100644
--- a/code/libs/sys-secpolicy.lua
+++ b/code/libs/sys-secpolicy.lua
@@ -11,7 +11,7 @@
 -- IRC is usually pretty safe, but no guarantees.
 
 -- Returns "allow", "deny", or "ask".
-local actualPolicy = function (pkg, pid, perm)
+local function actualPolicy(pkg, pid, perm, matchesSvc)
  -- System stuff is allowed.
  if pkg:sub(1, 4) == "sys-" then
   return "allow"