diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 48237d77..c8fd7c5d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -443,3 +443,23 @@ jobs:
           bun run build
       - name: Drive the fixture through the real process boundary
         run: cargo test -p ps-blitz-script --features debug-control --test debug_control
+      # Activation behaviour, driven by ps-qa against this checkout.
+      #
+      # The host is built here rather than installed: `qa-inspect-host` depends
+      # on the published engine, so an installed one judges the last release and
+      # a change in this workspace could not fail it. `ps-qa` itself carries no
+      # engine, so the published binary drives whatever host it is given.
+      - uses: actions/checkout@v5
+        with:
+          repository: pathscale/ps-observability
+          path: .ps-observability
+      # Both binaries from the same checkout, rather than `cargo install ps-qa`.
+      # The harness and the host move together, and installing one while
+      # building the other makes this job depend on a release of the harness as
+      # well as on the checkout, so a change to either has to be published
+      # before it can be used here.
+      - name: Drive the fixtures with ps-qa
+        env:
+          PS_OBSERVABILITY: .ps-observability
+          QA_BUILD_PS_QA: "1"
+        run: tests/qa/run.sh
diff --git a/Cargo.toml b/Cargo.toml
index 8b17e19c..f5f29cc2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,7 +39,7 @@ exclude = ["sites", "packages/blitz-wasm/guest"]
 resolver = "2"
 
 [workspace.package]
-version = "0.4.2"
+version = "0.4.3"
 license = "MIT OR Apache-2.0"
 homepage = "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/pathscale/ps-blitz"
 repository = "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/pathscale/ps-blitz"
diff --git a/packages/blitz-dom/src/document.rs b/packages/blitz-dom/src/document.rs
index 80ab47b7..5f731cb8 100644
--- a/packages/blitz-dom/src/document.rs
+++ b/packages/blitz-dom/src/document.rs
@@ -151,6 +151,14 @@ pub trait Document: Any + 'static {
     }
 }
 
+/// What the pre-click activation steps changed, so a cancelled click can put
+/// it back. Produced by [`BaseDocument::run_pre_click_activation`].
+#[derive(Debug, Clone, PartialEq)]
+pub struct PreClickActivation {
+    /// Every node whose checkedness moved, paired with the value it held.
+    previous: Vec<(NodeId, bool)>,
+}
+
 pub struct PlainDocument(pub BaseDocument);
 impl Document for PlainDocument {
     fn inner(&self) -> DocGuard<'_> {
@@ -756,6 +764,79 @@ impl BaseDocument {
         }
     }
 
+    /// The checkedness a click changed, kept so the click's *canceled
+    /// activation steps* can put it back when a listener calls
+    /// `preventDefault()`.
+    ///
+    /// A radio carries its whole set, because selecting one clears the others.
+    pub fn run_pre_click_activation(&mut self, target: NodeId) -> Option<PreClickActivation> {
+        let node_id = crate::events::pointer::checkable_activation_target(self, target)?;
+        let el = self.get_node(node_id)?.data.downcast_element()?;
+        let is_radio = el.attr(local_name!("type")) == Some("radio");
+
+        if !is_radio {
+            let previous = el.checkbox_input_checked()?;
+            let el = self.get_node_mut(node_id)?.data.downcast_element_mut()?;
+            Self::toggle_checkbox(el);
+            return Some(PreClickActivation {
+                previous: vec![(node_id, previous)],
+            });
+        }
+
+        let radio_set = el.attr(local_name!("name")).map(str::to_string);
+        let Some(radio_set) = radio_set else {
+            let previous = el.checkbox_input_checked()?;
+            let el = self.get_node_mut(node_id)?.data.downcast_element_mut()?;
+            *el.checkbox_input_checked_mut()? = true;
+            return Some(PreClickActivation {
+                previous: vec![(node_id, previous)],
+            });
+        };
+
+        // Recorded *while* selecting rather than before it. Selecting one radio
+        // clears every other in the set, so cancelling has to restore all of
+        // them, and reading them first meant walking the whole arena twice for
+        // one press. The membership test is `toggle_radio`'s, deliberately: two
+        // predicates that disagreed would restore a different set than the one
+        // that changed.
+        //
+        // That predicate is name plus "has checkbox state", which is neither
+        // scoped to `type=radio` nor to a form owner. Wrong per HTML, and
+        // longstanding; matching it here keeps this change to the ordering it
+        // is about.
+        let mut previous: Vec<(NodeId, bool)> = Vec::new();
+        for (id, node) in self.nodes.iter_mut() {
+            let Some(el) = node.data.downcast_element_mut() else {
+                continue;
+            };
+            if el.attr(local_name!("name")) != Some(&*radio_set) {
+                continue;
+            }
+            let Some(is_checked) = el.checkbox_input_checked_mut() else {
+                continue;
+            };
+            previous.push((id, *is_checked));
+            *is_checked = id == node_id;
+        }
+        Some(PreClickActivation { previous })
+    }
+
+    /// Undo [`Self::run_pre_click_activation`]. The click's *canceled
+    /// activation steps*.
+    pub fn undo_pre_click_activation(&mut self, activation: PreClickActivation) {
+        for (node_id, was_checked) in activation.previous {
+            let Some(node) = self.get_node_mut(node_id) else {
+                continue;
+            };
+            let Some(el) = node.data.downcast_element_mut() else {
+                continue;
+            };
+            if let Some(is_checked) = el.checkbox_input_checked_mut() {
+                *is_checked = was_checked;
+            }
+        }
+    }
+
     pub fn toggle_checkbox(el: &mut ElementData) -> bool {
         let Some(is_checked) = el.checkbox_input_checked_mut() else {
             return false;
diff --git a/packages/blitz-dom/src/events/driver.rs b/packages/blitz-dom/src/events/driver.rs
index efb72354..da60368b 100644
--- a/packages/blitz-dom/src/events/driver.rs
+++ b/packages/blitz-dom/src/events/driver.rs
@@ -341,8 +341,26 @@ impl<'doc, Handler: EventHandler> EventDriver<'doc, Handler> {
 
     fn process_queue(&mut self) {
         while let Some(mut event) = self.queue.pop_front() {
+            // HTML runs a click's *pre-click activation steps* before the event
+            // is dispatched, so a checkbox or radio has already taken its new
+            // value by the time any listener runs. Doing it afterwards -- as
+            // the default action, with everything else -- hands `click`
+            // listeners the value from before the press, which reads as a
+            // control that responds to every second press. Cancelling the click
+            // runs the canceled activation steps and puts it back.
+            let activation = match event.data {
+                DomEventData::Click(_) => {
+                    self.doc.inner_mut().run_pre_click_activation(event.target)
+                }
+                _ => None,
+            };
+
             let event_state = self.run_handler_event(&mut event, EventState::default());
-            if !event_state.is_cancelled() {
+            if event_state.is_cancelled() {
+                if let Some(activation) = activation {
+                    self.doc.inner_mut().undo_pre_click_activation(activation);
+                }
+            } else {
                 self.run_default_action(&mut event);
             }
         }
diff --git a/packages/blitz-dom/src/events/mod.rs b/packages/blitz-dom/src/events/mod.rs
index 5ccdf235..a14b657b 100644
--- a/packages/blitz-dom/src/events/mod.rs
+++ b/packages/blitz-dom/src/events/mod.rs
@@ -2,7 +2,7 @@ mod driver;
 mod focus;
 mod ime;
 mod keyboard;
-mod pointer;
+pub(crate) mod pointer;
 
 use crate::util::Point;
 use blitz_traits::events::{DomEvent, DomEventData, PointerCoords, UiEvent};
diff --git a/packages/blitz-dom/src/events/pointer.rs b/packages/blitz-dom/src/events/pointer.rs
index fa5f4104..48f726ae 100644
--- a/packages/blitz-dom/src/events/pointer.rs
+++ b/packages/blitz-dom/src/events/pointer.rs
@@ -597,6 +597,56 @@ pub(crate) fn handle_pointerup<F: FnMut(DomEvent)>(
     }
 }
 
+/// The checkbox or radio that a click at `target` activates, or `None` if the
+/// click activates something else.
+///
+/// This walks the tree the way [`handle_click`] does -- stopping at a disabled
+/// element or a text input -- because the two have to agree. The pre-click
+/// activation steps flip the checkedness of whatever this returns, and
+/// `handle_click` reports it afterwards; if they disagreed, a control would
+/// either toggle without an `input` event or fire one without having toggled.
+///
+/// A `<label>` ends the walk with `None`. The label is the nearest thing with
+/// an activation behaviour of its own, and that behaviour is to fire a *fresh*
+/// click at the control -- which arrives here again with the control as its
+/// target. Following the label from here as well would toggle twice and leave
+/// the control exactly as it was.
+pub(crate) fn checkable_activation_target(doc: &BaseDocument, target: NodeId) -> Option<NodeId> {
+    let mut maybe_node_id = Some(target);
+
+    while let Some(node_id) = maybe_node_id {
+        let node = doc.get_node(node_id)?;
+        let Some(el) = node.data.downcast_element() else {
+            maybe_node_id = node.parent;
+            continue;
+        };
+
+        if el.attr(local_name!("disabled")).is_some() {
+            return None;
+        }
+        if let SpecialElementData::TextInput(_) = el.special_data {
+            return None;
+        }
+
+        match el.name.local {
+            local_name!("input")
+                if matches!(
+                    el.attr(local_name!("type")),
+                    Some("checkbox") | Some("radio")
+                ) =>
+            {
+                return Some(node_id);
+            }
+            local_name!("label") => return None,
+            _ => {}
+        }
+
+        maybe_node_id = node.parent;
+    }
+
+    None
+}
+
 pub(crate) fn handle_click(
     doc: &mut BaseDocument,
     target: NodeId,
@@ -629,7 +679,10 @@ pub(crate) fn handle_click(
 
             match el.name.local {
                 local_name!("input") if el.attr(local_name!("type")) == Some("checkbox") => {
-                    let is_checked = BaseDocument::toggle_checkbox(el);
+                    // Checkedness was already flipped by the pre-click
+                    // activation steps, so this is only the post-click half:
+                    // report the value the press produced.
+                    let is_checked = el.checkbox_input_checked().unwrap_or(false);
                     let value = is_checked.to_string();
                     dispatch_event(DomEvent::new(
                         node_id,
@@ -645,12 +698,7 @@ pub(crate) fn handle_click(
                     break 'matched true;
                 }
                 local_name!("input") if el.attr(local_name!("type")) == Some("radio") => {
-                    if let Some(radio_set) = el.attr(local_name!("name")).map(str::to_string) {
-                        BaseDocument::toggle_radio(doc, radio_set, node_id);
-                    } else if let Some(is_checked) = el.checkbox_input_checked_mut() {
-                        *is_checked = true;
-                    }
-
+                    // The selection was made by the pre-click activation steps.
                     // TODO: make input event conditional on value actually changing
                     let value = String::from("true");
                     dispatch_event(DomEvent::new(
@@ -695,15 +743,33 @@ pub(crate) fn handle_click(
                         }
                     }
                 }
-                // Clicking labels triggers click, and possibly input event, of associated input
+                // A label's activation behaviour is to fire a click at the
+                // control it labels. Dispatching that click -- rather than
+                // running the control's default action here -- is what puts it
+                // through the pre-click activation steps and past every
+                // listener, so a press on the label is indistinguishable from a
+                // press on the control. Running the default action alone meant
+                // a component whose input is visually hidden behind its label,
+                // which is every switch and every styled checkbox, never saw a
+                // `click` at all.
                 local_name!("label") => {
                     if let Some(target_node_id) =
                         doc.label_bound_input_element(node_id).map(|n| n.id)
                     {
-                        // Apply default click event action for target node
-                        let target_node = doc.get_node_mut(target_node_id).unwrap();
-                        let syn_event = target_node.synthetic_click_event_data(event.mods);
-                        handle_click(doc, target_node_id, &syn_event, dispatch_event);
+                        let target_node = doc.get_node(target_node_id).unwrap();
+                        // A disabled control has no activation behaviour, so
+                        // the label has nothing to forward and the press ends
+                        // here. Dispatching anyway would run the control's own
+                        // `click` listeners, which is the one thing `disabled`
+                        // is there to prevent -- and the pre-click activation
+                        // steps refusing to toggle it would not stop them.
+                        let disabled = target_node
+                            .element_data()
+                            .is_some_and(|el| el.attr(local_name!("disabled")).is_some());
+                        if !disabled {
+                            let syn_event = target_node.synthetic_click_event(event.mods);
+                            dispatch_event(DomEvent::new(target_node_id, syn_event));
+                        }
                         break 'matched true;
                     }
                 }
diff --git a/packages/blitz-dom/src/lib.rs b/packages/blitz-dom/src/lib.rs
index 85104977..6b83f9c8 100644
--- a/packages/blitz-dom/src/lib.rs
+++ b/packages/blitz-dom/src/lib.rs
@@ -85,7 +85,10 @@ pub use crate::node::{
 };
 pub use blitz_traits::node_id::NodeId;
 pub use config::{DocumentConfig, StyleThreading};
-pub use document::{AnimationPacing, BaseDocument, DocGuard, DocGuardMut, Document, PlainDocument};
+pub use document::{
+    AnimationPacing, BaseDocument, DocGuard, DocGuardMut, Document, PlainDocument,
+    PreClickActivation,
+};
 /// Per-resolve layout counters. Present only with `log-phase-times`, which is
 /// the same feature that pays for the counting.
 #[cfg(feature = "log-phase-times")]
diff --git a/packages/blitz-script/src/dom/element.rs b/packages/blitz-script/src/dom/element.rs
index dc1f9ee1..aa3486af 100644
--- a/packages/blitz-script/src/dom/element.rs
+++ b/packages/blitz-script/src/dom/element.rs
@@ -466,13 +466,56 @@ fn set_checked(this: &JsValue, args: &[JsValue], context: &mut Context) -> JsRes
     let ctx = dom_ctx(context)?;
     let node_id = this_node_id(this)?;
     let checked = args.first().map(JsValue::to_boolean).unwrap_or(false);
-    // blitz-dom's checked handling parses the value as a boolean
-    write_attr(
-        &ctx,
-        node_id,
-        "checked",
-        if checked { "true" } else { "false" },
-    );
+
+    /*
+     * Once the input has been constructed its checkedness lives in the
+     * element's special data, and that is what the renderer, the accessibility
+     * tree and `change` all read. The attribute is `defaultChecked`: the
+     * document as it was parsed, which the IDL property is not supposed to
+     * move.
+     *
+     * Writing only the attribute left a controlled component -- one that
+     * renders `checked` from its own state -- unable to drive its own input at
+     * all, because the write landed nowhere anything observes.
+     *
+     * The snapshot is what asks for a restyle. `:checked` is matched from this
+     * same state, and taking the attribute write away takes its invalidation
+     * with it.
+     */
+    let has_live_state = {
+        let mut doc = ctx.mutate_doc();
+        match doc
+            .get_node_mut(node_id)
+            .and_then(|node| node.data.downcast_element_mut())
+            .and_then(|element| element.checkbox_input_checked_mut())
+        {
+            Some(is_checked) => {
+                let changed = *is_checked != checked;
+                *is_checked = checked;
+                if changed {
+                    doc.snapshot_node(node_id);
+                }
+                true
+            }
+            None => false,
+        }
+    };
+
+    /*
+     * Before construction the attribute is the only carrier of the initial
+     * value, so a property write has to reach it or the value is lost.
+     *
+     * `checked` is an HTML boolean attribute: present means on, whatever the
+     * value reads. Writing `checked="false"` therefore *set* it, and every
+     * controlled checkbox, radio and switch came up already on.
+     */
+    if !has_live_state {
+        if checked {
+            write_attr(&ctx, node_id, "checked", "");
+        } else {
+            clear_attr(&ctx, node_id, "checked");
+        }
+    }
     Ok(JsValue::undefined())
 }
 
diff --git a/packages/blitz-script/tests/fixtures/cancelled-click.html b/packages/blitz-script/tests/fixtures/cancelled-click.html
new file mode 100644
index 00000000..9f617bf5
--- /dev/null
+++ b/packages/blitz-script/tests/fixtures/cancelled-click.html
@@ -0,0 +1,46 @@
+<!--
+  A control that refuses its own activation. `preventDefault` on the click runs
+  the canceled activation steps, so the checkedness has to go back.
+
+  The heading names *both* halves, and that is the whole point. "It ended off"
+  is satisfied just as well by a press that never toggled anything, so a check
+  asserting only that passes on an engine with no activation at all -- which is
+  exactly what it did: with the pre-click activation steps disabled, every other
+  fixture failed and this one passed.
+
+  So the page records the checkedness inside the click listener, where the
+  pre-click activation steps have already run and it must be `true`, and again
+  once the press is over, where the canceled activation steps must have put it
+  back to `false`. Only the pair distinguishes an undo from an engine that
+  never did anything.
+-->
+<html>
+  <body>
+    <h1>Cancelled click</h1>
+
+    <label id="vetoed-label">
+      <input type="checkbox" id="vetoed" aria-label="Vetoed">
+      <span>Vetoed</span>
+    </label>
+    <div id="out"></div>
+
+    <script>
+      const box = document.getElementById("vetoed");
+      const out = document.getElementById("out");
+      box.addEventListener("click", (event) => {
+        // Read before `preventDefault`, so this is the value the press
+        // produced rather than anything the refusal did.
+        const during = box.checked;
+        event.preventDefault();
+        // Once the current task is over, so the canceled activation steps have
+        // run. Not a guess about ordering inside the dispatch: this is the next
+        // task, which is after all of it.
+        setTimeout(() => {
+          const heading = document.createElement("h2");
+          heading.textContent = "Press saw " + during + ", left " + box.checked;
+          out.appendChild(heading);
+        }, 0);
+      });
+    </script>
+  </body>
+</html>
diff --git a/packages/blitz-script/tests/fixtures/checkbox-activation.html b/packages/blitz-script/tests/fixtures/checkbox-activation.html
new file mode 100644
index 00000000..e77d68a1
--- /dev/null
+++ b/packages/blitz-script/tests/fixtures/checkbox-activation.html
@@ -0,0 +1,30 @@
+<!--
+  What a listener on a checkbox sees when the control is pressed.
+  Outcomes are headings, because that is what the harness can name and assert.
+-->
+<html>
+  <body>
+    <h1>Checkbox activation</h1>
+
+    <label id="bare-label">
+      <input type="checkbox" id="bare" aria-label="Bare checkbox">
+      <span>Bare checkbox</span>
+    </label>
+    <div id="bare-out"></div>
+
+    <script>
+      const bare = document.getElementById("bare");
+      const bareOut = document.getElementById("bare-out");
+      const seen = [];
+      for (const name of ["click", "input", "change"]) {
+        bare.addEventListener(name, () => {
+          seen.push(name + ":" + bare.checked);
+          bareOut.textContent = "";
+          const heading = document.createElement("h2");
+          heading.textContent = "Bare saw " + seen.join(",");
+          bareOut.appendChild(heading);
+        });
+      }
+    </script>
+  </body>
+</html>
diff --git a/packages/blitz-script/tests/fixtures/controlled-checkbox.html b/packages/blitz-script/tests/fixtures/controlled-checkbox.html
new file mode 100644
index 00000000..74d4260f
--- /dev/null
+++ b/packages/blitz-script/tests/fixtures/controlled-checkbox.html
@@ -0,0 +1,31 @@
+<!--
+  A checkbox whose state is written from script, which is what a controlled
+  component does on its first render and on every render after.
+
+  `checked` is an HTML boolean attribute, so a written `false` reflected into it
+  reads as *checked*. The heading names what the control actually reports.
+-->
+<html>
+  <body>
+    <h1>Controlled checkbox</h1>
+
+    <input type="checkbox" id="controlled" aria-label="Controlled">
+    <div id="out"></div>
+
+    <script>
+      const box = document.getElementById("controlled");
+      const out = document.getElementById("out");
+      const show = () => {
+        out.textContent = "";
+        const heading = document.createElement("h2");
+        heading.textContent = "Reports " + (box.checked ? "on" : "off");
+        out.appendChild(heading);
+      };
+
+      // The initial render of a control bound to `false`.
+      box.checked = false;
+      show();
+      box.addEventListener("change", show);
+    </script>
+  </body>
+</html>
diff --git a/packages/blitz-script/tests/fixtures/disabled-label.html b/packages/blitz-script/tests/fixtures/disabled-label.html
new file mode 100644
index 00000000..2fab72c0
--- /dev/null
+++ b/packages/blitz-script/tests/fixtures/disabled-label.html
@@ -0,0 +1,46 @@
+<!--
+  A disabled control inside a label, and an enabled one beside it.
+
+  The press lands on the label, and nothing may reach the disabled control: the
+  pre-click activation steps refuse to toggle it, but a `click` delivered anyway
+  runs whatever the application wired to it, which is the one thing `disabled`
+  is there to prevent.
+
+  The enabled control is not decoration. "The disabled one heard nothing" is
+  satisfied just as well by a press that never arrived, so the page carries a
+  control that must hear the same kind of press. One check asserts the heading
+  appears, the other that it does not, and only the pair means anything.
+-->
+<html>
+  <body>
+    <h1>Disabled label</h1>
+
+    <label id="allowed-label" aria-label="Allowed region">
+      <input type="checkbox" id="allowed" aria-label="Allowed control">
+      <span>Allowed</span>
+    </label>
+
+    <label id="off-limits-label" aria-label="Forbidden region">
+      <input type="checkbox" id="off-limits" aria-label="Off limits control" disabled>
+      <span>Off limits</span>
+    </label>
+
+    <div id="out"></div>
+
+    <script>
+      const out = document.getElementById("out");
+      const announce = (who, name) => {
+        const heading = document.createElement("h2");
+        heading.textContent = who + " heard " + name;
+        out.appendChild(heading);
+      };
+
+      for (const [id, who] of [["allowed", "Allowed"], ["off-limits", "Disabled"]]) {
+        const input = document.getElementById(id);
+        for (const name of ["click", "input", "change"]) {
+          input.addEventListener(name, () => announce(who, name));
+        }
+      }
+    </script>
+  </body>
+</html>
diff --git a/packages/blitz-script/tests/fixtures/radio-set.html b/packages/blitz-script/tests/fixtures/radio-set.html
new file mode 100644
index 00000000..20714d2f
--- /dev/null
+++ b/packages/blitz-script/tests/fixtures/radio-set.html
@@ -0,0 +1,25 @@
+<!--
+  Selecting a radio clears the rest of its set, and a listener has to see the
+  finished selection rather than the one before it.
+-->
+<html>
+  <body>
+    <h1>Radio set</h1>
+
+    <input type="radio" name="pick" id="one" aria-label="First" checked>
+    <input type="radio" name="pick" id="two" aria-label="Second">
+    <div id="out"></div>
+
+    <script>
+      const one = document.getElementById("one");
+      const two = document.getElementById("two");
+      const out = document.getElementById("out");
+      two.addEventListener("click", () => {
+        const heading = document.createElement("h2");
+        heading.textContent =
+          "Click saw first=" + one.checked + " second=" + two.checked;
+        out.appendChild(heading);
+      });
+    </script>
+  </body>
+</html>
diff --git a/packages/blitz-script/tests/fixtures/switch-over-label.html b/packages/blitz-script/tests/fixtures/switch-over-label.html
new file mode 100644
index 00000000..a891876c
--- /dev/null
+++ b/packages/blitz-script/tests/fixtures/switch-over-label.html
@@ -0,0 +1,42 @@
+<!--
+  The shape `@pathscale/ui` ships and every styled checkbox on the web uses: the
+  real input clipped to a pixel, the visible control a sibling span. A press
+  lands on the label, and everything the component depends on has to come out of
+  that.
+-->
+<html>
+  <head>
+    <style>
+      .switch { display: block; width: 40px; height: 20px; }
+      .switch-input {
+        position: absolute; width: 1px; height: 1px;
+        clip-path: inset(50%); opacity: 0;
+      }
+      .switch-control { display: block; width: 40px; height: 20px; }
+    </style>
+  </head>
+  <body>
+    <h1>Switch over label</h1>
+
+    <label class="switch" id="switch">
+      <input type="checkbox" class="switch-input" id="hidden-input" aria-label="Hidden switch">
+      <span class="switch-control" id="control"></span>
+    </label>
+    <div id="out"></div>
+
+    <script>
+      const input = document.getElementById("hidden-input");
+      const out = document.getElementById("out");
+      const seen = [];
+      for (const name of ["click", "input", "change"]) {
+        input.addEventListener(name, () => {
+          seen.push(name + ":" + input.checked);
+          out.textContent = "";
+          const heading = document.createElement("h2");
+          heading.textContent = "Switch saw " + seen.join(",");
+          out.appendChild(heading);
+        });
+      }
+    </script>
+  </body>
+</html>
diff --git a/ps-qa.ron b/ps-qa.ron
new file mode 100644
index 00000000..2655a68a
--- /dev/null
+++ b/ps-qa.ron
@@ -0,0 +1,18 @@
+// What ps-qa has to be told about these fixtures.
+//
+// Almost empty, and that is the point. An application profile carries surfaces,
+// collapsible sections and controls that must not be pressed, because the
+// harness has to find its way around a product before it can touch anything.
+// Here each page is one control and its outcome, already on screen, so there is
+// nothing to navigate and nothing to avoid.
+AppProfile(
+    // One surface: the page. Every fixture renders an `<h1>`, so arrival is
+    // decidable without knowing which fixture is loaded.
+    surfaces: [
+        (name: "fixture", opener: "\u{0}dynamic-document", marker: None),
+    ],
+
+    permanent_surfaces: [],
+    navigation_controls: [],
+    sections: [],
+)
diff --git a/tests/blitz-tests/target/snapshots/chip-big.png b/tests/blitz-tests/target/snapshots/chip-big.png
deleted file mode 100644
index f7feee92..00000000
Binary files a/tests/blitz-tests/target/snapshots/chip-big.png and /dev/null differ
diff --git a/tests/blitz-tests/target/snapshots/chip.png b/tests/blitz-tests/target/snapshots/chip.png
deleted file mode 100644
index af611072..00000000
Binary files a/tests/blitz-tests/target/snapshots/chip.png and /dev/null differ
diff --git a/tests/blitz-tests/target/snapshots/chip2-big.png b/tests/blitz-tests/target/snapshots/chip2-big.png
deleted file mode 100644
index 1490b51c..00000000
Binary files a/tests/blitz-tests/target/snapshots/chip2-big.png and /dev/null differ
diff --git a/tests/blitz-tests/target/snapshots/chip2.png b/tests/blitz-tests/target/snapshots/chip2.png
deleted file mode 100644
index 2f96f7f1..00000000
Binary files a/tests/blitz-tests/target/snapshots/chip2.png and /dev/null differ
diff --git a/tests/blitz-tests/target/snapshots/sq-big.png b/tests/blitz-tests/target/snapshots/sq-big.png
deleted file mode 100644
index 4a7fbab4..00000000
Binary files a/tests/blitz-tests/target/snapshots/sq-big.png and /dev/null differ
diff --git a/tests/blitz-tests/target/snapshots/sq.png b/tests/blitz-tests/target/snapshots/sq.png
deleted file mode 100644
index ebda49f6..00000000
Binary files a/tests/blitz-tests/target/snapshots/sq.png and /dev/null differ
diff --git a/tests/blitz-tests/target/snapshots/tab-after-switch.png b/tests/blitz-tests/target/snapshots/tab-after-switch.png
deleted file mode 100644
index 4f9bf360..00000000
Binary files a/tests/blitz-tests/target/snapshots/tab-after-switch.png and /dev/null differ
diff --git a/tests/blitz-tests/target/snapshots/tab-before-switch.png b/tests/blitz-tests/target/snapshots/tab-before-switch.png
deleted file mode 100644
index 4f9bf360..00000000
Binary files a/tests/blitz-tests/target/snapshots/tab-before-switch.png and /dev/null differ
diff --git a/tests/ps-qa/cancelled-click.ron b/tests/ps-qa/cancelled-click.ron
new file mode 100644
index 00000000..f5cf1b1a
--- /dev/null
+++ b/tests/ps-qa/cancelled-click.ron
@@ -0,0 +1,25 @@
+// The canceled activation steps: `preventDefault` on the click puts the
+// checkedness back, so a control can refuse its own activation.
+[
+    (
+        id: "cancelled-click-paints",
+        group: "cancelled-click",
+        what: "the fixture builds and paints",
+        open: None,
+        hover: None,
+        click: None,
+        subject: "heading:Cancelled click",
+        expect: PaintsNamed,
+    ),
+    (
+        id: "cancelled-click-is-undone",
+        group: "cancelled-click",
+        what: "a cancelled press toggles, then puts it back",
+        open: None,
+        hover: None,
+        settle_after_ms: 300,
+        click: Some("checkbox:Vetoed"),
+        subject: "heading:Press saw true, left false",
+        expect: PaintsNamed,
+    ),
+]
diff --git a/tests/ps-qa/checkbox-activation.ron b/tests/ps-qa/checkbox-activation.ron
new file mode 100644
index 00000000..09d72a15
--- /dev/null
+++ b/tests/ps-qa/checkbox-activation.ron
@@ -0,0 +1,27 @@
+// Pressing a checkbox, and what its listeners saw.
+//
+// The page writes what each listener observed into a heading, so the assertion
+// is a name the renderer painted rather than anything read out of the engine.
+[
+    (
+        id: "checkbox-activation-paints",
+        group: "checkbox-activation",
+        what: "the fixture builds and paints",
+        open: None,
+        hover: None,
+        click: None,
+        subject: "heading:Checkbox activation",
+        expect: PaintsNamed,
+    ),
+    (
+        id: "checkbox-activation-listeners-see-the-new-state",
+        group: "checkbox-activation",
+        what: "every listener sees the checkedness the press produced",
+        open: None,
+        hover: None,
+        settle_after_ms: 300,
+        click: Some("checkbox:Bare checkbox"),
+        subject: "heading:Bare saw click:true,input:true,change:true",
+        expect: PaintsNamed,
+    ),
+]
diff --git a/tests/ps-qa/controlled-checkbox.ron b/tests/ps-qa/controlled-checkbox.ron
new file mode 100644
index 00000000..a7daf22b
--- /dev/null
+++ b/tests/ps-qa/controlled-checkbox.ron
@@ -0,0 +1,38 @@
+// What a control bound to `false` reports before anything touches it.
+//
+// `checked` is an HTML boolean attribute, so reflecting a written `false` into
+// it sets the input, and every controlled checkbox, radio and switch came up
+// already selected whatever its state said.
+[
+    (
+        id: "controlled-checkbox-paints",
+        group: "controlled-checkbox",
+        what: "the fixture builds and paints",
+        open: None,
+        hover: None,
+        click: None,
+        subject: "heading:Controlled checkbox",
+        expect: PaintsNamed,
+    ),
+    (
+        id: "controlled-checkbox-starts-off",
+        group: "controlled-checkbox",
+        what: "a control bound to false is not checked",
+        open: None,
+        hover: None,
+        click: None,
+        subject: "heading:Reports off",
+        expect: PaintsNamed,
+    ),
+    (
+        id: "controlled-checkbox-follows-the-property",
+        group: "controlled-checkbox",
+        what: "pressing it moves the state a component reads back",
+        open: None,
+        hover: None,
+        settle_after_ms: 300,
+        click: Some("checkbox:Controlled"),
+        subject: "heading:Reports on",
+        expect: PaintsNamed,
+    ),
+]
diff --git a/tests/ps-qa/disabled-label.ron b/tests/ps-qa/disabled-label.ron
new file mode 100644
index 00000000..329a8ce8
--- /dev/null
+++ b/tests/ps-qa/disabled-label.ron
@@ -0,0 +1,40 @@
+// A press on a label whose control is disabled.
+//
+// The two checks are a pair. "The disabled control heard nothing" is satisfied
+// just as well by a press that never arrived, so the first one presses an
+// enabled control the same way and requires that it did hear. Without it the
+// second is vacuous, which is the failure this whole area is about.
+[
+    (
+        id: "disabled-label-paints",
+        group: "disabled-label",
+        what: "the fixture builds and paints",
+        open: None,
+        hover: None,
+        click: None,
+        subject: "heading:Disabled label",
+        expect: PaintsNamed,
+    ),
+    (
+        id: "disabled-label-delivers-to-an-enabled-control",
+        group: "disabled-label",
+        what: "a press on a label reaches an enabled control",
+        open: None,
+        hover: None,
+        settle_after_ms: 300,
+        click: Some("#allowed-label"),
+        subject: "heading:Allowed heard click",
+        expect: PaintsNamed,
+    ),
+    (
+        id: "disabled-label-delivers-nothing-to-a-disabled-control",
+        group: "disabled-label",
+        what: "the same press reaches a disabled control not at all",
+        open: None,
+        hover: None,
+        settle_after_ms: 300,
+        click: Some("#off-limits-label"),
+        subject: "heading:Disabled heard click",
+        expect: Absent,
+    ),
+]
diff --git a/tests/ps-qa/radio-set.ron b/tests/ps-qa/radio-set.ron
new file mode 100644
index 00000000..cc1a195f
--- /dev/null
+++ b/tests/ps-qa/radio-set.ron
@@ -0,0 +1,25 @@
+// Selecting a radio clears the rest of its set, and a listener has to see the
+// finished selection rather than the one before it.
+[
+    (
+        id: "radio-set-paints",
+        group: "radio-set",
+        what: "the fixture builds and paints",
+        open: None,
+        hover: None,
+        click: None,
+        subject: "heading:Radio set",
+        expect: PaintsNamed,
+    ),
+    (
+        id: "radio-set-is-settled-when-listeners-run",
+        group: "radio-set",
+        what: "a listener sees the whole set already moved",
+        open: None,
+        hover: None,
+        settle_after_ms: 300,
+        click: Some("radio:Second"),
+        subject: "heading:Click saw first=false second=true",
+        expect: PaintsNamed,
+    ),
+]
diff --git a/tests/ps-qa/switch-over-label.ron b/tests/ps-qa/switch-over-label.ron
new file mode 100644
index 00000000..07ad6d5f
--- /dev/null
+++ b/tests/ps-qa/switch-over-label.ron
@@ -0,0 +1,29 @@
+// A press on a label whose control is clipped to a pixel.
+//
+// A label's activation behaviour is to fire a click at the control it labels.
+// Running the control's default action instead toggles it and fires `input` and
+// `change` while no `click` ever arrives, and every switch on the web puts its
+// input inside its label, so this is the case that matters most.
+[
+    (
+        id: "switch-over-label-paints",
+        group: "switch-over-label",
+        what: "the fixture builds and paints",
+        open: None,
+        hover: None,
+        click: None,
+        subject: "heading:Switch over label",
+        expect: PaintsNamed,
+    ),
+    (
+        id: "switch-over-label-delivers-the-press",
+        group: "switch-over-label",
+        what: "a press over the label reaches the control it labels",
+        open: None,
+        hover: None,
+        settle_after_ms: 300,
+        click: Some("checkbox:Hidden switch"),
+        subject: "heading:Switch saw click:true,input:true,change:true",
+        expect: PaintsNamed,
+    ),
+]
diff --git a/tests/qa/run.sh b/tests/qa/run.sh
new file mode 100755
index 00000000..bd008556
--- /dev/null
+++ b/tests/qa/run.sh
@@ -0,0 +1,104 @@
+#!/usr/bin/env sh
+#
+# Drive the fixture pages under `packages/blitz-script/tests/fixtures` with
+# ps-qa, against *this* checkout of the engine.
+#
+# The host is built here rather than installed. `qa-inspect-host` depends on the
+# published engine, so a `cargo install`ed one judges whatever was last released
+# and a change to this workspace cannot fail it -- which is the whole point of
+# running it from here. Cargo's `--config` injects the patch on the command
+# line, so nothing in the host's repository is edited and there is no manifest
+# to remember to revert.
+#
+# ps-qa itself needs no engine: it speaks the control protocol over a socket, so
+# the published binary drives whatever host it is pointed at.
+set -eu
+
+readonly ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+readonly FIXTURES="$ROOT/packages/blitz-script/tests/fixtures"
+readonly CHECKS="$ROOT/tests/ps-qa"
+readonly PACKAGES="$ROOT/packages"
+
+export PATH="$HOME/.cargo/bin:$PATH"
+
+# `QA_PS_QA` wins, for someone iterating on the harness and the fixtures
+# together; otherwise the published binary, which carries no engine of its own
+# and drives whatever host it is pointed at.
+#
+# `QA_BUILD_PS_QA` builds it from the same checkout the host comes from. The
+# two move together, so installing one while building the other would make this
+# depend on a release of the harness as well, and a change to either could not
+# be used here until it had been published.
+qa="${QA_PS_QA:-}"
+if [ -z "$qa" ] && [ -z "${QA_BUILD_PS_QA:-}" ]; then
+  qa="$(command -v ps-qa || true)"
+  if [ -z "$qa" ]; then
+    echo "ps-qa is not on PATH; cargo install ps-qa" >&2
+    echo "  (or set QA_PS_QA to a local build, or QA_BUILD_PS_QA=1)" >&2
+    exit 1
+  fi
+fi
+
+# A checkout of the host's repository. `QA_HOST` skips the build entirely, for
+# someone iterating on the host and the fixtures together.
+host="${QA_HOST:-}"
+if [ -z "$host" ]; then
+  observability="${PS_OBSERVABILITY:-$ROOT/../ps-observability}"
+  if [ ! -d "$observability" ]; then
+    echo "no ps-observability checkout at $observability" >&2
+    echo "  set PS_OBSERVABILITY, or QA_HOST to a prebuilt qa-inspect-host" >&2
+    exit 1
+  fi
+  echo "building qa-inspect-host against $PACKAGES"
+  ( cd "$observability" && cargo build --release -p qa-inspect-host \
+      --config "patch.crates-io.ps-blitz-dom.path='$PACKAGES/blitz-dom'" \
+      --config "patch.crates-io.ps-blitz-script.path='$PACKAGES/blitz-script'" \
+      --config "patch.crates-io.ps-blitz-traits.path='$PACKAGES/blitz-traits'" \
+      --config "patch.crates-io.ps-blitz-paint.path='$PACKAGES/blitz-paint'" \
+      --config "patch.crates-io.ps-blitz-shell.path='$PACKAGES/blitz-shell'" )
+  host="$observability/target/release/qa-inspect-host"
+
+  # The same patches, because building any member resolves the whole workspace
+  # and the host's engine requirement names a version that is not published yet.
+  if [ -z "$qa" ]; then
+    echo "building ps-qa from $observability"
+    ( cd "$observability" && cargo build --release -p ps-qa \
+        --config "patch.crates-io.ps-blitz-dom.path='$PACKAGES/blitz-dom'" \
+        --config "patch.crates-io.ps-blitz-script.path='$PACKAGES/blitz-script'" \
+        --config "patch.crates-io.ps-blitz-traits.path='$PACKAGES/blitz-traits'" \
+        --config "patch.crates-io.ps-blitz-paint.path='$PACKAGES/blitz-paint'" \
+        --config "patch.crates-io.ps-blitz-shell.path='$PACKAGES/blitz-shell'" )
+    qa="$observability/target/release/ps-qa"
+  fi
+fi
+
+if [ -z "$qa" ] || [ ! -x "$qa" ]; then
+  echo "no ps-qa at ${qa:-<unset>}" >&2
+  exit 1
+fi
+
+if [ ! -x "$host" ]; then
+  echo "no qa-inspect-host at $host" >&2
+  exit 1
+fi
+
+# One page per group, named alike, so adding a fixture is adding two files and
+# nothing else. A page with no checks is a mistake rather than a skip.
+status=0
+for page in "$FIXTURES"/*.html; do
+  group="$(basename "$page" .html)"
+  if [ ! -f "$CHECKS/$group.ron" ]; then
+    echo "FAIL $group: no checks at $CHECKS/$group.ron" >&2
+    status=1
+    continue
+  fi
+  if "$qa" --app "$ROOT/ps-qa.ron" qa-hosted \
+      --host "$host" --page "$page" --checks "$CHECKS" "$group"; then
+    echo "PASS $group"
+  else
+    echo "FAIL $group"
+    status=1
+  fi
+done
+
+exit "$status"